Privacy policy
Last updated: 7 October 2026
EKAM Business OS is software that shops and service businesses use to run their counters, apps, staff and accounts. This policy explains what personal data the software keeps, why, and what you can ask for. When you deal with a shop that uses EKAM, that shop decides why your data is used (it is the data fiduciary under India's Digital Personal Data Protection Act, 2023), and EKAM processes it for the shop.
What we keep
| Who | Data | Why |
|---|---|---|
| Customers | Name, mobile number, email, pickup and delivery addresses and map pin, orders and items, payments (method and amount only, never card numbers), wallet, app sign-ins and the phone's notification token, photos of items taken for damage reports | To take, deliver and bill orders, send order and payment messages, and keep tax records |
| Staff | Name, contact details, role, attendance with location at the store, leave, salary and payslips, sign-in history | To run the store, pay staff and keep the business secure |
| Website visitors who ask for a trial or price | Name, WhatsApp number, business type, number of stores and modules chosen | To contact you about EKAM |
Every sign-in and every change to money, prices or settings is recorded in an audit log with the time, address and device, to protect the business against fraud. Customers are never named in it.
Who else sees it
Only the services needed to run the software, each for that purpose only:
- Hosting and database: Vercel and Supabase, in Mumbai, India.
- Messages: the SMS, WhatsApp and email providers the shop has switched on (for example MSG91 or Gallabox).
- App notifications: Google Firebase Cloud Messaging.
- Maps and routes: OpenStreetMap map tiles and a routing service (addresses are sent as map points, without names).
We do not sell personal data and do not use it for advertising.
How long we keep it
- Orders, invoices, payments, refunds and wallet records: at least 6 years, because tax law requires it.
- Your name, phone, email and addresses: while you are a customer, or until you ask us to delete them.
- Sign-in history: up to 12 months.
- Backups: 30 days.
- Website enquiries: until we have answered and you are no longer interested.
Security
Data travels over HTTPS and is stored in a private database. Passwords are stored only as one-way hashes (Argon2id). Staff accounts can use two-step sign-in, and each person sees only what their role needs. Backups are encrypted.
Your rights
You can ask the shop, or us, to:
- give you a copy of your data,
- correct it,
- delete it (we remove your name, phone, email and addresses; bills stay, shown as "Deleted customer", because tax law requires us to keep them),
- stop messages you no longer want,
- name someone to act for you.
We answer within 30 days. If a breach ever puts your data at risk, we tell you and the Data Protection Board of India as the law requires.
Contact and grievances
Grievance officer: Naresh, naresh@n7c.dev. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.