Privacy Policy

a) Account information: When you sign in — using Google Sign-In, Sign in with Apple (iOS), or email and password — we collect your email address and, where provided, your display name (including the shop name you enter at registration) via Firebase Authentication. Signing in with Google also requests access to a private Google Drive storage area (the app-data folder) at sign-in time. That access is used only to find and restore an older Google Drive backup and, on App versions before 6.5, to make Google Drive backups (Section 3); we never use it to read your other Drive files. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

b) Business data you enter: All inventory items, sales records, expense entries, and other business data you create within the App are stored locally on your device using SQLite database storage. This data leaves your device only if you use a feature that needs it: BusinessX Cloud backup and sync (Section 1(h)), restoring an older Google Drive or iCloud backup (Section 3), or Shared Workspaces (Section 1(i)).

c) Account and notification data: To keep your subscription status in sync across your devices and to deliver push notifications (such as app updates or announcements), the App automatically syncs a limited set of account data — your user ID, subscription/plan status, and a device push-notification token — to our Firebase backend whenever you are signed in. This happens independently of the backup feature described in Section 3.

d) Usage and diagnostic data: We collect usage statistics and crash/error reports via Firebase Analytics and Firebase Crashlytics to improve app performance and stability. These use pseudonymous identifiers (such as a Firebase app-instance ID) rather than your name or email, and we use them only to understand and fix the App. Pseudonymous identifiers can still be personal data under some laws, and we treat them that way.

e) Device information: We may collect basic device information (operating system version, device model, app version, language) to help us diagnose compatibility issues and improve the App. Like any online service, our providers also receive your IP address (and the approximate location it implies) whenever the App or Website contacts them.

f) Camera and photos: If you use the App's camera or photo-library option to photograph stock items, the resulting image is stored locally on your device. It is not transmitted anywhere unless you back up your data (to BusinessX Cloud, Google Drive, or iCloud), turn on sync, or share a shop (Sections 1(h), 3, and 15).

g) Web purchase data: If you buy BusinessX Premium on our website, the checkout email address you provide and related payment metadata (such as order identifiers, plan duration, and payment status) are collected so we can fulfill the purchase, email your redeem code, and support billing or refund requests. Card details are handled by Lemon Squeezy as merchant of record; we do not receive or store your full payment card number.

h) Cloud backup and sync data: BusinessX Premium also offers cloud backup and real-time multi-device sync built on our own servers (Google Cloud Firestore and Cloud Storage), as an alternative or successor to the Google Drive / iCloud backup described in Section 3. Where this feature is available on your account and app version, backups you make from the App go to BusinessX Cloud by default. When you back up, restore, or turn on sync, your inventory, sales, expense records, and item photos are uploaded to our servers, hosted in the asia-south1 (India) Google Cloud region, so they can be restored on, and kept in sync across, your own devices. This feature is rolled out gradually and may not yet be available on your account or app version; Section 3 below describes exactly what is stored and where once it is.

i) Shared workspace data: BusinessX Premium lets a shop owner invite another BusinessX account (for example, a staff member) to see that shop's data and record sales in it, and optionally edit its stock, in real time (“Shared Workspaces”). If you send or accept such an invitation, the shop's inventory and sales data becomes visible to the other account, and that account's email address becomes visible to the shop owner. If you decline an invitation, the shop owner sees that it was declined and when. See Section 15 for details.

j) Device and security identifiers: To make multi-device sync reliable and to prevent abuse of our backend, we collect a per-device identifier and, where supported, a platform-level app-integrity signal (Google Play Integrity on Android, Apple DeviceCheck on iOS). These identifiers are used only for app functionality and abuse prevention — never for advertising or cross-app tracking.

k) Consent records: When you accept this Privacy Policy and our Terms of Service, we record that acceptance — including the date and time, the version of these documents you accepted, and the app platform and version — so we can demonstrate compliance with applicable consent requirements. See Section 16.

l) Website and messages you send us: When you visit mybusinessx.com, our hosting provider (Vercel) processes your IP address and request details to serve and secure the pages, and we use Vercel Web Analytics and Speed Insights to count page views and measure performance. These do not use cookies and do not track you across other sites, and we do not use advertising or tracking cookies on the Website. If you send us a support request or a data deletion request through the Website or by email, we collect the name, email address, and message details you provide, and (for a deletion request) enough to locate and verify your account. These messages are delivered to our Google-hosted support mailbox. If you join the desktop waiting list on the Website, we collect the email address and the computer type (Mac, Windows or both) you give us, and optionally the kind of shop you run. We use them only to tell you when the desktop version launches, and we delete them after the launch message or sooner if you ask. That email is also delivered to our support mailbox.

We do not knowingly collect special categories of personal data (such as health, biometric, or religious data), and the App does not ask for your precise location, contacts, or microphone.

We use the information we collect to:

• Operate and maintain the App and its features
• Let you restore an older Google Drive or iCloud backup (only when you ask to)
• Operate our own cloud backup, multi-device sync, and (if you choose to use it) Shared Workspaces functionality (only when you activate it)
• Process web purchases, email your redeem code, and handle billing, refund, and chargeback questions
• Show ads when you do not have Premium (Section 5)
• Record and verify your acceptance of this Privacy Policy and our Terms of Service
• Detect and prevent fraud, abuse, and unauthorized access to our backend services
• Improve app performance, fix bugs, and develop new features
• Send push notifications about app updates, announcements, or your account (only if you grant notification permission)
• Send you service emails to the email address on your account — including account and security notices, subscription or billing notices, and important alerts such as material changes to this Privacy Policy or our Terms of Service. These are operational communications about your account and the Service, not marketing, and you cannot opt out of them while keeping an active account
• Respond to support requests and user inquiries
• Comply with legal obligations and enforce our Terms of Service

We do not sell your personal data, and we never use or disclose your business data (inventory, sales, expenses, photos) for advertising. Without Premium, Google AdMob collects device identifiers (such as your advertising ID — on iPhone, the advertising identifier only if you allow tracking) and ad-interaction data directly from your device to show ads, as explained in Section 5. Other than that, we share personal data only with the service providers in Section 4 (who process it to provide their service to us), with other BusinessX users you choose to share a shop with (Section 15), and in the limited cases in Section 19.

Local storage: Your business data (inventory, sales, reports) is stored on your device using SQLite. It is not transmitted to our servers during normal app use, other than the limited account and sync data described in Section 1(c) and, for Premium users where BusinessX Cloud is active, the backup and sync data described below.

Google Drive backup (legacy, Android and iOS): App versions before 6.5 offered optional Google Drive backup. From version 6.5, backups go to BusinessX Cloud instead and Google Drive is no longer written to; it is read once, only when BusinessX Cloud has nothing for your account, so you can restore an older backup. Accounts created on version 6.5 or later do not use Google Drive or iCloud at all. Where you did (or do) use it, your data is held in a hidden, app-private storage area within your Google Drive account (Google's “Application Data” folder). This area is not visible in your regular Drive file list and cannot be browsed or managed from the Drive app or website — only from within BusinessX, or by revoking BusinessX's access from your Google Account's third-party access settings. This data is stored under your Google account and governed by Google's Privacy Policy. We do not retain copies of your backed-up data on our servers.

iCloud backup (legacy, iOS only): Older iOS versions offered iCloud backup instead of Google Drive, uploading your data via Apple's CloudKit to your personal iCloud account; as with Google Drive, version 6.5 and later no longer write to it and use it only to restore an older backup. This data is stored under your Apple ID and governed by Apple's Privacy Policy. We do not retain copies of this data on our servers.

BusinessX Cloud Backup & Sync (Premium, servers we control): As described in Section 1(h), we also offer a backup and real-time multi-device sync option built on Google Cloud Firestore and Cloud Storage for Firebase. Where it is available, it is where backups made from the App are stored by default. When you back up or turn on sync, your inventory, sales, expense records, and item photos are uploaded to and stored on servers we control, in the asia-south1 (India) Google Cloud region, regardless of where you or your device are located. Unlike the Google Drive / iCloud option above, this data is retained on our servers (governed by the retention schedule in Section 9) so it can be synced across your devices in real time and, if you use Shared Workspaces (Section 15), made available to an account you invite. This feature rolls out gradually across accounts and app versions; while it is inactive on your account, your business data continues to be stored only as described elsewhere in this Section.

The App and Website use the following third-party services. Most process data on our behalf, under their data-processing terms, only to provide their service to us; Google (for advertising), Apple, and Lemon Squeezy (for payments) also act as independent controllers of some data under their own policies. Each has its own privacy policy:

• Google Play Services & Google Play Billing — For app distribution, updates, and Android purchases. Google Privacy Policy
• Google Drive API — Used only to find and restore an older Google Drive backup (and to make one on App versions before 6.5). Google Privacy Policy
• Google AdMob — Used to display advertisements within the App when you do not have an active Premium subscription. AdMob may use device identifiers and usage data to serve relevant ads in accordance with Google's Advertising Policy.
• Firebase Authentication — Manages sign-in and account security. Google Privacy Policy
• Cloud Firestore — Stores your account ID, subscription/plan status, and push-notification token so your entitlement stays in sync across your devices. Google Privacy Policy
• Firebase Cloud Messaging — Delivers push notifications to your device. Google Privacy Policy
• Firebase Crashlytics — Collects crash and error reports to help us fix bugs. Google Privacy Policy
• Firebase Analytics — Collects aggregate, anonymized app-usage statistics. Google Privacy Policy
• Sign in with Apple (iOS only) — An alternative sign-in method offered on iOS. Apple Privacy Policy
• Apple iCloud / CloudKit (iOS only) — Used only to restore an older iCloud backup (and to make one on iOS versions before 6.5). Apple Privacy Policy
• Apple App Store (iOS only) — For app distribution, updates, and billing. Apple Privacy Policy
• Cloud Firestore & Cloud Storage for Firebase — Store your business data when you activate BusinessX Cloud Backup & Sync or Shared Workspaces (Sections 1(h)-(i), 3, 15). Google Privacy Policy
• Google Play Integrity API (Android) / Apple DeviceCheck (iOS) — Device-integrity attestation used to prevent abuse of our backend sync services (Section 1(j)). Google Privacy Policy / Apple Privacy Policy
• Lemon Squeezy — Merchant of record and payment processor for BusinessX Premium purchases made on our website. Lemon Squeezy processes checkout, payment, and related order data under its own policies. Lemon Squeezy Privacy Policy
• Google Cloud Functions & Cloud Monitoring — Run our server-side jobs (subscription status, redeem codes, scheduled deletion, abuse prevention) in the same asia-south1 (India) region. Google Privacy Policy
• Resend — Sends our transactional emails (redeem codes, and Premium-lapse warnings) to the email address on your account or checkout. Resend Privacy Policy
• Vercel — Hosts the Website and provides cookieless Web Analytics and Speed Insights. Vercel Privacy Notice
• Google Workspace / Gmail — Hosts the mailbox that receives support and data-deletion messages. Google Privacy Policy

The App displays advertisements provided by Google AdMob when you do not have an active Premium subscription. To show them, AdMob collects device identifiers and ad-interaction data directly from your device and, unless you opt out, may personalize ads based on your interests. On iPhone the App first asks your permission (Apple's App Tracking Transparency); if you choose Ask App Not to Track, your advertising identifier is not used. Google acts as an independent controller of that advertising data under its own policies; we receive only aggregate ad reporting, never your business data. Some laws treat this as “sharing” or “targeted advertising”; see Sections 14 and 22.

How to opt out: on Android, open Settings > Google > Ads and choose Opt out of Ads Personalization (or Delete advertising ID). On iPhone, choose Ask App Not to Track, or turn off Settings > Privacy & Security > Tracking for BusinessX. You will still see ads, but not ones based on your interests. Any active Premium subscription removes advertisements altogether. We do not direct advertising at children (Section 7).

We take reasonable technical and organizational measures to protect your data. Since your business data is stored locally on your device, the security of your device (screen lock, encryption) directly affects the security of your data.

For data backed up to Google Drive, security is managed by Google's infrastructure, which includes encryption in transit and at rest. For data backed up to iCloud, security is similarly managed by Apple's infrastructure, which also includes encryption in transit and at rest.

For data in BusinessX Cloud (Section 3), Google Cloud encrypts data in transit and at rest by default, and our security rules and server checks restrict each shop's data to its owner and the people the owner has invited. Device-integrity checks and daily usage limits help stop abuse of our servers (Section 20). These measures are our “reasonable security practices and procedures” under India's Information Technology Act, 2000 and its rules, and our “appropriate technical and organisational measures” under GDPR.

No method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but are committed to using industry-standard practices. If a personal data breach affects you, we will tell you and the authorities as described in Section 19.

BusinessX is a business tool for adults. It is not intended for, or directed at, anyone under 18 (or the age of majority where you live, if higher), and our Terms of Service require you to be at least that age. We do not knowingly collect personal information from anyone under 18 (and in particular from children under 13, or under 16 in the EEA), we do not track or monitor the behavior of children, and we do not direct advertising at them. If you believe a child has provided personal information through the App, please contact us at businessxteam@gmail.com and we will delete that information promptly.

We offer the following rights to everyone, wherever you live, subject to the exceptions the law allows (see Sections 13, 14, 18, and 22 for statutory detail if you are in the EEA, UK, Switzerland, the US, India, or elsewhere):

• Access the personal data we hold about you, and get a copy
• Request correction or updating of inaccurate or incomplete data
• Request deletion (erasure) of your data
• Withdraw consent for data processing (where consent is the legal basis), as easily as you gave it
• Request portability (a structured, machine-readable copy), and object to or ask us to restrict certain processing
• Opt out of personalized advertising (Section 5) and of any “sale” or “sharing” of personal data (we do not sell it)
• Complain to us, and to your local data protection authority

In the App: “Delete all data” removes the shops you own (on your phone and in BusinessX Cloud) and keeps your login; “Delete account” removes your account and your cloud data. A small set of records we keep after deletion is described in Section 9.

How to ask: visit our data deletion page or email businessxteam@gmail.com. We will confirm receipt within 48 hours and respond within 30 days (or any shorter period the law requires). We may need to verify your identity, normally by using the email address on your account, and there is no charge unless a request is clearly excessive or repetitive. If we decline a request, we will say why, and you can appeal by replying with the subject “Appeal” (we respond within 45 days). You may also act through an authorized agent or, in India, through a person you have nominated (Section 18).

Business data stored locally on your device is retained until you delete it within the App or uninstall the App.

If you use Google Drive or iCloud backup, backed-up files remain in your account until deleted. When you delete your BusinessX account from within the App, the App also deletes your Google Drive or iCloud backup files where it can still reach them without asking you to sign in again, and tells you if any remain. If you stop using the App without deleting your account (for example, you simply uninstall it), backup files remain in your Google Drive or iCloud account until removed. Google Drive backups are stored in a hidden, app-private area that is not visible in the regular Drive file list (see Section 3), so removing them requires either reinstalling the App and using in-app account deletion, or revoking BusinessX's access from your Google Account's third-party access settings; iCloud backups can be managed from your device's iCloud storage settings. We have no server-side access to delete data from your personal cloud storage outside of these paths.

BusinessX Cloud data when Premium ends: We keep your BusinessX Cloud backup and sync data while your Premium is active. If Premium ends, backup, sync and shop sharing pause, and we keep that cloud data for 6 months. During that time we remind you in the App, by push notification (where you have granted permission) and by email to the address on your account. Renewing Premium at any point in those 6 months resumes everything automatically. If Premium is not renewed within 6 months, we delete your backup and sync data from our servers; anyone you shared a shop with loses access, and that shop's copy is removed from their device.

This schedule never deletes your account itself or the data stored on your own devices, and backups held in your own Google Drive or iCloud account are governed by the paragraph above rather than by this one.

Records we keep after you delete your account. Deleting your account removes your account, your BusinessX Cloud data, and your shared-shop memberships. We keep only what we need or are required to keep: (i) consent records (the date, time, document version, and platform of your acceptance), for as long as needed to show that consent was given and to establish or defend legal claims; (ii) web purchase and redeem-code records (checkout email, order and code identifiers, plan, and payment status), for as long as tax, accounting, and consumer-law obligations require, generally several years, and to resolve refund or chargeback disputes; and (iii) support and deletion-request messages, for as long as needed to deal with your request and to show we did. Lemon Squeezy, Google, and Apple keep their own payment records under their own policies.

Other periods. Analytics and crash data are kept by Firebase for limited periods (no more than 14 months for analytics and 90 days for crash reports). Account and sync data are kept while your account exists. Website server logs and analytics are kept by Vercel for the periods in its notice. When a retention period ends we delete the data or anonymize it so it can no longer identify you.

We may update this Privacy Policy from time to time. We will notify you of any significant changes by updating the effective date above and, where required, by providing notice within the App. We encourage you to review this policy periodically.

For major update events, we may also share update information by email to the address on your account, or over registered mail to users who have provided a mailing address or are registered with us. This is done solely to keep you informed of important changes that may affect your rights or how your data is handled.

Website update (October 7, 2026): describes the desktop waiting list on the Website (section 1, item l). The App and its version are unchanged.

Version 6 (October 6, 2026): adds ads on iPhone (Google AdMob, with Apple's tracking permission) and updates the advertising and opt-out sections.

What changed in version 5 (October 1, 2026): we now name the legal operator of BusinessX (an individual, not a company) and our Grievance Officer; raised the minimum age to 18; described the Website; added Resend, Vercel, and our support mailbox as service providers; explained the advertising data collected on Android and how to opt out; described which records we keep after account deletion; and added legal-basis, India (DPDP), U.S. state, other-region, sharing/breach, and automated-limit sections (17-22). Because these changes are material, the App asks you to accept the new version.

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us. You may write to us in English.

Grievance redressal: Shrey Jain is our Grievance Officer under India's Information Technology Act rules, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act. We acknowledge every grievance within 48 hours and aim to resolve it within 15 days, and in any case within 30 days. This address is also our single point of contact for regulators and authorities, and for anyone who wants to report content or conduct that is unlawful.

BusinessX is operated from India, and the servers we use for account data, subscription/entitlement sync, consent records, and (for accounts using it) BusinessX Cloud Backup & Sync are located in Google Cloud's asia-south1 (India) region. If you access the App from outside India — including from the European Economic Area, the United Kingdom, Switzerland, the United States, or elsewhere — your information will be transferred to, stored in, and processed in India, and possibly in other countries where our service providers (Google/Firebase, Apple, Lemon Squeezy, Resend, Vercel) operate infrastructure, including the United States. India's DPDP Act allows transfers outside India except to countries the Indian Government restricts.

These providers are contractually bound by their own data processing terms and, where applicable, standard contractual clauses or equivalent safeguards recognized under GDPR and similar frameworks (for example, Google Cloud's and Firebase's published Data Processing Addenda). By using the App, you acknowledge and, where legally required, consent to this transfer, storage, and processing of your information outside your country of residence.

For people in the EEA, UK, and Switzerland: India has not received an “adequacy” decision from the European Commission or the UK Government. You give your data directly to us, and we process it as described in this policy; where we pass it on to providers outside those regions we rely on the Standard Contractual Clauses (and the UK Addendum or Swiss equivalent) in their data-processing terms, or on another safeguard GDPR allows. You can ask us for details of the safeguards at businessxteam@gmail.com.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or the equivalent UK/Swiss regime gives you additional rights and requires us to disclose the following:

Who is responsible for your data: Shrey Jain, trading as BusinessX (contact details above), is the data controller for the account, sync, consent, purchase, and Website data described in Section 1(a), (c), (g)-(l). We have not appointed a Data Protection Officer because we are not required to; our Grievance Officer is the privacy contact. For business data you enter about your own customers or staff (for example, an unpaid sale linked to a customer's name), you are the data controller and BusinessX acts only as a data processor on your instructions — you are responsible for having a lawful basis to collect and store that information about your own customers.

Legal basis for processing: We process account and sync data to perform our contract with you (the Terms of Service you accept), to comply with legal obligations (such as billing records), and, for security/abuse-prevention signals and diagnostics, on the basis of our legitimate interest in keeping the Service reliable and secure. Section 17 sets out, purpose by purpose, what we process and on which basis. Where we ask for your consent separately (Section 16), or where law requires consent for advertising or analytics identifiers, you may withdraw it at any time — by discontinuing use of the App and deleting your account, or (for ad personalization) through your device settings (Section 5). Withdrawal does not affect processing done before it. Providing the account and sync data is necessary to use sign-in, backup, sync, and Premium; without it we cannot provide those features.

Your rights: in addition to Section 8, you have the right to restrict processing, to data portability (receive your account data in a structured, machine-readable format), and to object to processing based on legitimate interest. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (see Section 20 for the automated safety limits we do apply). You also have the right to lodge a complaint with your local data protection supervisory authority at any time — this is in addition to, not instead of, contacting us directly at businessxteam@gmail.com.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to: know what personal information we collect, use, and disclose about you; request deletion of your personal information; request correction of inaccurate personal information; opt out of the sale or sharing of your personal information; and not be discriminated against for exercising any of these rights (we will not deny you the App, charge you a different price, or provide a lower quality of service because you exercised a CCPA/CPRA right). Residents of other U.S. states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, Texas, and Oregon) have similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. We extend the rights in this section to all U.S. residents, whether or not a state law technically applies to us.

Categories collected in the last 12 months (see Section 17 for the purposes): identifiers (email address, name, user ID, device and advertising identifiers, IP address); commercial information (subscription status, purchase and redeem-code records); internet or app activity (analytics and crash data); approximate location (derived from IP address); user-provided content (shop data and item photos you store in BusinessX Cloud); and business information (shop name). We do not intentionally collect sensitive personal information, except that sign-in credentials are used only to sign you in. We collect it from you, from your device, and from Google, Apple, and Lemon Squeezy (purchase status). We disclose it only to the service providers in Section 4, for the business purposes in Section 2.

We do not sell your personal information. On the App for users without Premium, Google AdMob collects identifiers and ad-interaction data to personalize advertising; some state laws treat this as “sharing” for cross-context behavioral advertising or “targeted advertising”. You can opt out at any time through the device settings described in Section 5, or by subscribing to Premium, which removes ads. We do not knowingly sell or share the personal information of anyone under 18. We do not use or disclose sensitive personal information for purposes beyond what is necessary to provide the App.

To exercise any California privacy right, contact us at businessxteam@gmail.com or use our data deletion page. We will verify your request using the email address associated with your account before acting on it, and respond within 45 days. If we decline a request you may appeal as described in Section 8; if you are still unsatisfied, you may contact your state Attorney General.

BusinessX Premium lets a shop owner (“Owner”) invite another BusinessX account (a “Guest”) to access one shop's data in real time — for example, so a staff member can record sales alongside the owner. This section explains what that means for your data.

What is shared: once an invitation is accepted, the shop's inventory, sales, expenses, and item photos become visible to the Guest. Every Guest can record sales, expenses, returns and payment changes in that shop; only a Guest the Owner allows to “Edit stock” can change its stock list. The Guest's email address becomes visible to the Owner as the person they invited. If the Guest declines the invitation, the Owner sees that it was declined and when (with the name and email from the invitation) until the Owner removes that record or invites them again. This is visibility between two BusinessX users inside a feature the Owner chose to activate, not disclosure of your data to a third party outside BusinessX.

Owner responsibility: the Owner controls who is invited and what access they have, and can remove a Guest's access at any time. BusinessX is not responsible for a Guest misusing access the Owner granted; we recommend only inviting people you trust with your business data, and reviewing access periodically.

When access is removed: a removed Guest's device deletes its local copy of that shop's data once it can confirm the removal, and the Guest loses the ability to view or edit that shop going forward. Data already backed up under the Owner's account is unaffected.

When the Owner's Premium ends: the shop's backup and sync pause for everyone in it; Guests can keep working on their device, but new changes are saved only there. If the Owner does not renew within 6 months, the shop's cloud data is deleted (Section 9), every Guest loses access, and each Guest's device deletes its copy of that shop.

Roles: for the shop's business data, the Owner decides what is stored and who sees it and is the controller; we act as the Owner's processor under the data processing terms in our Terms of Service (Section 17). A Guest's own account data (email, display name) remains our responsibility as controller. Owners should tell the people they invite, and any customers whose details they enter, how that data is used.

You must review and accept this Privacy Policy and our Terms of Service before you can use the App — this applies whether you are installing the App for the first time or have used an earlier version of the App before this requirement was introduced, and on both Android and iOS. You cannot skip or dismiss this requirement and continue using the App; if you do not accept, the App will close.

When you accept, we record the date and time of your acceptance, the version of this Policy and the Terms of Service you accepted, and your app platform and version, as described in Section 1(k). If we make a material change to this Policy or the Terms, we will ask you to review and accept the updated version again before you can continue using the App, even if you accepted an earlier version.

This table summarizes Sections 1-3 and 9 in one place. “Legal basis” is the GDPR/UK GDPR ground; the same facts serve as the itemized notice under India's DPDP Act and the notice at collection under U.S. state laws.

We process personal data in line with India's Digital Personal Data Protection Act, 2023 and the rules made under it, as they come into force, and with the Information Technology Act, 2000. For the DPDP Act, Shrey Jain is the Data Fiduciary and you are the Data Principal. The personal data we process and the purposes are listed in Sections 1, 2, and 17.

Your rights: to get a summary of the personal data we process and how we process it, and who we share it with; to have it corrected, completed, or updated; to have it erased (unless we must keep it by law, as in Section 9); to have your grievance redressed; and to nominate another person to exercise these rights for you if you die or become unable to. Use the contacts in Section 11 or our data deletion page.

Consent: where we rely on your consent it is given by accepting these documents (Section 16) or by turning on a feature. You can withdraw it at any time, as easily as you gave it, by deleting your account in the App or emailing us; withdrawal does not affect what we did before, and some features (such as sync) cannot work without the data they need. We may also process data without consent where the DPDP Act permits “legitimate uses”, such as to comply with law. This notice is available in English; write to us if you would like it in Hindi or another language listed in the Eighth Schedule to the Constitution.

Children: the DPDP Act treats anyone under 18 as a child. BusinessX is for adults and we do not knowingly process children's data; we do not track or behaviorally monitor children or direct advertising at them (Section 7).

Complaints: write to our Grievance Officer first (Shrey Jain, businessxteam@gmail.com). If you are not satisfied with our response, you may complain to the Data Protection Board of India, as the Act provides.

Who we share with: only the service providers in Section 4, other BusinessX users you choose to share a shop with (Section 15), and the recipients described here.

Legal requests: we may disclose personal data where the law requires it, for example in response to a valid order or request from a court or from a government or law enforcement agency that is authorized by law, or where needed to establish, exercise, or defend legal claims, to enforce our Terms, or to prevent fraud, abuse, or harm to people. Where the law allows, we will tell you first.

Business transfers: if BusinessX is transferred to someone else, for example if Shrey Jain incorporates the business or assigns it to a company, or it is merged or sold, your personal data and this policy will pass to the new operator, who must honor this policy and any choices you have made. We will notify you in the App or by email before the change, and you may delete your account.

Personal data breaches: if a breach of personal data is likely to put you at risk, we will notify you without undue delay, and notify the data protection authorities where the law requires (for example, the supervisory authority within 72 hours under GDPR, and the Data Protection Board of India and affected people under the DPDP Act), describing what happened and what you can do.

We do not use automated processing to make decisions that have legal or similarly significant effects on you, and we do not profile you for that purpose. We do apply automated abuse prevention: if a shop's cloud sync goes over a daily safety limit, or an account goes over its photo-storage limit, cloud sync for that shop or account pauses automatically. Selling and stock tracking on your phone carry on, changes queue on the device, and most pauses lift by themselves after 24 hours. A shop paused repeatedly is reviewed by a person. If you think a pause is a mistake, email us and a person will look at it.

This policy also covers mybusinessx.com. The Website does not require an account and does not use advertising or tracking cookies. Its pages are served by Vercel, which receives your IP address and request data; Vercel Web Analytics and Speed Insights measure aggregate page views and performance without cookies and without tracking you across sites. The Support and Delete forms collect what you type in them (Section 1(l)). The Website links to other sites (for example Google Play, the App Store, and Lemon Squeezy's checkout) that have their own privacy policies.

We apply the rights in Section 8 to everyone, wherever you live. Where your own country gives you further rights or protections, we honor them to the extent they apply to us. These include, for example: Brazil's LGPD; Canada's PIPEDA and Quebec's Law 25; Australia's Privacy Act 1988; Singapore's and Malaysia's Personal Data Protection Acts; the Philippines' Data Privacy Act 2012; Sri Lanka's Personal Data Protection Act; Japan's APPI; South Korea's PIPA; Thailand's PDPA; Nigeria's Data Protection Act 2023; Kenya's Data Protection Act 2019; South Africa's POPIA; the United Arab Emirates' and Saudi Arabia's personal data protection laws; and Turkey's KVKK.

To use a right, contact us as in Section 8; we will follow the procedure and time limits your local law requires. You may also complain to your national data protection or consumer authority. If any law prohibits or restricts use of the App or the transfer of data in your country, please do not use the App.