Privacy Policy

What we store, why we store it, and who can see it.

Last updated 28 August 2026

This is a plain-language statement of how the system actually behaves. It has not been reviewed by a lawyer and is not a substitute for one. Have it checked before relying on it in a contract.

What is stored

  • Your account: name, email address, phone number, and a hash of your password. The password itself is never stored and cannot be read back by anyone, including us.
  • Your company's records: everything you enter — parties, products, stock, invoices, payments, ledgers, GST returns — and any file you attach to a document.
  • An audit trail: who created, changed or approved each document, and when. This is deliberate and cannot be switched off; a book of accounts without it is not worth much.

What is not stored

Card numbers and bank credentials never touch this system. Online payments, where enabled, are handled by the payment gateway and we receive only the reference and the result.

Who can see it

Each company's data is isolated. A user signed into one company cannot read another's under any circumstances — this is enforced in the database layer, not merely hidden in the interface.

Within your company, what each person sees is decided by the role you give them. An owner or administrator can see everything; a picker sees stock and no prices.

Our own staff do not browse customer data. Access to a live database happens only when you ask us to look at a specific problem.

Where it lives

On servers in India, in a database that is backed up nightly. Backups are kept for thirty days and then deleted.

Sharing

Your records are not sold, rented, or shared with anybody. Data leaves the system only where you make it: filing a GST return with the government portal, generating an e-invoice or e-way bill, or sending an invoice by email to the address you entered.

How long it is kept

Accounting records are kept for as long as your account is open. Indian law requires books to be preserved for eight years, so deleting your account does not immediately erase posted entries — tell us in writing what you want removed and we will explain what can and cannot go.

Your rights

You can export your data at any time from the reports and export screens; nothing is held hostage. To correct or remove personal information, or to ask what is held about you, write to contactus@credohrms.com.

Cookies

One cookie, to keep you signed in. No advertising or tracking cookies are set.