Legal
Privacy Policy
In short: you own your data. We store it only to run LexaBook for you. We do not sell it, do not show ads, do not use tracking or analytics SDKs, never read your SMS, and never upload your address book.
1. Who we are
LexaBook ("LexaBook", "we", "us") is a digital ledger (khata) app for shops and small businesses in India. For any privacy question or request, write to support@lexabook.me.
2. Data we collect
We only collect what you enter or what is needed to sign you in.
| Data | Examples | Why |
|---|---|---|
| Account | Email address, name, password (stored only as a secure hash by our authentication provider); your Google account email and name if you choose "Continue with Google" | To create your account and sign you in on any phone |
| Business profile | Business name, owner name, phone, email, address, category, GSTIN, UPI ID | To show on your bills and statements and to build your payment QR |
| Customers and suppliers you add | Name, mobile number, address, GSTIN, due date, SMS on/off setting | To keep each party's khata and balance |
| Ledger entries | Amount, you gave / you got, date, note, bill photos you attach | To calculate balances and show history and statements |
| Cashbook entries | Money in / out, cash or online, amount, note, date | To show daily totals and cash in hand |
| Saved bill items | Item name and last rate | So you can add items to the next bill in one tap |
| On your phone only | Sign-in session token, selected business, app language | To keep you signed in and remember your settings |
We do not collect your location, your SMS messages, your call log, your full contact list, advertising IDs, or device analytics. LexaBook does not request SMS or call-log permissions.
3. Phone permissions and how they are used
Contacts (read only)
Used only when you tap Pick from contacts while adding a customer. The phone's contact picker opens; we read only the one contact you select and fill in its name and number. Only that name and number are saved, as part of the customer you create. Your address book is never uploaded, copied or scanned. LexaBook does not request permission to change your contacts.
SMS
LexaBook does not have permission to send or read SMS. When you turn on SMS to customer for an entry, or tap an SMS reminder, the app opens your phone's own SMS app with the message (for example the amount, date and total due) already written. You review it and tap Send yourself; it goes from your own SIM, and your carrier's normal SMS charges may apply. LexaBook never reads, stores or uploads SMS messages on your phone. You can turn SMS off per customer and per entry.
Camera and photos
Used only when you attach a photo of a bill to an entry. Only the photos you choose are uploaded, to your private storage described below.
4. Where your data is stored and how it is protected
- Your account and records are stored with Supabase, our database, authentication and file storage provider. Bill photos are kept in a private storage bucket.
- All data travels over encrypted connections (HTTPS/TLS). Our provider encrypts stored data at rest.
- Every record is protected by row-level security: it can be read or changed only by the account that owns the business. Bill photos are only accessible through short-lived links issued to that account.
- Your sign-in session on the phone is kept in the device's secure, encrypted keystore.
5. Things we never do
- We do not sell, rent or trade your data or your customers' data.
- We do not show ads and do not include advertising, tracking or analytics SDKs.
- We do not use your data to profile you or for credit scoring.
- We do not contact your customers. Messages to them are sent only by you, from your phone.
- We do not handle money. UPI payments made by scanning your QR go directly from your customer's UPI app to your UPI ID; LexaBook never sees, holds or processes those payments.
6. Documents you create
Bills, statements and report PDFs are generated on your phone. They are not uploaded to us; they go only where you choose to share them (for example WhatsApp or Google Drive), under that app's own privacy terms.
7. When data is shared
We share data only with:
- Service providers that run LexaBook for us: Supabase (hosting, database, authentication, file storage) and Google (only if you choose Google sign-in). They process data on our instructions and not for their own purposes.
- Authorities, if required by Indian law or a valid legal order.
8. Your customers' data
When you add customers or suppliers, you decide what is recorded about them and you are responsible for having a valid reason to keep it and to message them. We store that data on your behalf, only to provide LexaBook to you, and do not use it for anything else.
9. Keeping and deleting data
- Data is kept while your account is active.
- Deleted customers and entries first move to the in-app Recycle Bin, where you can restore them or delete them permanently.
- You can delete cashbook entries and saved items at any time.
- You can ask us to delete your whole account and all its data. See Delete your account. We complete deletion within 30 days, except where the law requires us to keep something for longer.
10. Your rights
Under India's Digital Personal Data Protection Act, 2023, you can ask to access, correct or erase your personal data, withdraw consent, and raise a grievance. Most data can be viewed and corrected directly in the app. For anything else, email support@lexabook.me from your registered address; we aim to respond within 30 days.
11. Children
LexaBook is meant for business owners and is not directed at anyone under 18. We do not knowingly collect data from children.
12. Changes to this policy
If we change this policy, we will update the effective date above and, for significant changes, tell you in the app before they apply.
13. Contact
Privacy questions, requests and grievances: support@lexabook.me