Privacy Policy
How we collect, use and protect your data.
Last updated: 12 July 2026
1. Who we are
Khata is operated by BWE Suite ("we", "us"). We are the data fiduciary for personal data you provide to us under the Digital Personal Data Protection Act, 2023 (DPDP).
2. Data we collect
- Account: email, phone number, business name.
- Business: GSTIN, PAN, CIN, legal name, state, business type.
- Financial: invoices, bills and transaction data you forward on WhatsApp or upload in-app.
- Technical: IP address, device, and log data required to operate the service.
3. How we use it
To extract, book and file your transactions; to send you filing reminders; to detect fraud and abuse; to comply with law.
4. Sub-processors
Supabase (database, auth, storage), Cloudflare (edge compute), WABOS.my (WhatsApp Business gateway), Google Gemini via Lovable AI Gateway (document extraction).
5. Sharing with BWE Suite apps
When you connect Orbit, Sentinel or Kosh in Integrations, verified ledger events are shared with those subscribers over signed webhooks. You control the connection and can revoke it at any time.
6. Retention
Financial records are retained for 8 years to satisfy the Income-tax Act and CGST Act statutory retention periods. You may request earlier deletion — see section 8.
7. Security
Encryption in transit (TLS 1.2+), encryption at rest for storage buckets and databases, row-level security policies scoping every read to the owning user, HMAC-signed subscriber webhooks.
8. Your rights (DPDP)
You have the right to access, correct, erase and port your data, and to grieve. Write to privacy@bwekhata.lovable.app.
9. Grievance officer
Grievance Officer, BWE Suite — grievance@bwekhata.lovable.app. We respond within 15 days.