Privacy Policy

1. Who we are

Hakkiloo Digital Agency is a digital services company based in Bengaluru, Karnataka, India. We operate Shark Invoice, a WhatsApp-first GST invoicing platform for Indian small and medium businesses.

For any questions about this Privacy Policy or how we handle your data, contact us at info.sharkinvoice@gmail.com.

2. Information we collect

Information you provide

• Account information: Full name, email address, WhatsApp phone number (in international E.164 format).
• Business information: Legal business name, display name, GSTIN (if applicable), business state, business address, UPI ID, bank account details (account name, number, IFSC), business logo.
• Customer information you upload: Names, contact numbers, email addresses, GSTINs, state codes, and addresses of YOUR customers/clients (the third parties you invoice). You are responsible for ensuring you have appropriate consent from these third parties before adding their data to Shark Invoice.
• Invoice and quote data: All content you create, including line items, descriptions, prices, GST rates, and payment records.

Information collected automatically

• Usage analytics: Page views, feature usage, click behavior — collected via Google Tag Manager.
• Device and browser information: IP address, user agent, device type, browser type.
• Cookies: First-party cookies for authentication and session management; third-party cookies via Google Tag Manager for analytics.

Information from third parties

If you sign in using Google Sign-In, we receive your name and email address from Google.

3. How we use your information

We use your information to:

• Provide and operate the Service (create invoices, send via WhatsApp, generate PDFs)
• Process subscription payments via Razorpay
• Send transactional emails (sign-in links, payment receipts, account notifications)
• Improve product features and user experience
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations under Indian law

We do NOT:

• Sell your personal information or your customers' data to anyone
• Use your data for marketing without your consent
• Share invoice contents with third parties (other than the data processors listed below)

4. Data processors and third-party services

We share data with the following third parties strictly as necessary to operate the Service:

All processors are bound by their own privacy practices and contractual obligations. Data stored in Supabase is hosted in the Mumbai (ap-south-1) region; primary storage of your invoice data is in India.

5. Data retention

• Active accounts: We retain your data while your account is active.
• Account deletion: Upon account deletion request (sent to info.sharkinvoice@gmail.com), we delete your personal data and business data within 30 days, per IT Rules 2011. Some data may be retained longer if required by law (e.g., financial records for tax purposes, typically 7 years).
• Backups: Data may persist in encrypted backups for up to 90 days after deletion, after which backups are purged.

6. Your rights

Under the Information Technology Act 2000, IT Rules 2011, and the Digital Personal Data Protection Act 2023, you have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Withdraw consent: Withdraw consent for data processing at any time (note: this may limit your ability to use the Service)
• Grievance redressal: Lodge a complaint with our Grievance Officer

To exercise these rights, email info.sharkinvoice@gmail.com.

7. Grievance Officer

In accordance with the Information Technology Act 2000 and IT Rules 2011:

8. Cookies

We use cookies for:

• Essential cookies: Required for authentication and Service operation. You cannot disable these.
• Analytics cookies: Google Tag Manager loads analytics scripts. You can disable these via your browser settings or browser extensions like uBlock Origin.

9. Security

We implement industry-standard security measures including:

• TLS encryption for all data in transit
• Encryption at rest for sensitive data in Supabase
• Row-level security (RLS) on all database tables
• Regular security audits
• Access controls and authentication

However, no system is completely secure. You are responsible for keeping your account credentials safe.

10. International data transfers

Some of our processors (Vercel, Razorpay, Meta, Anthropic, Google) are based outside India. By using Shark Invoice, you consent to your data being transferred to and processed in these countries. We ensure all transfers comply with applicable Indian data protection laws.

11. Children's privacy

Shark Invoice is intended for business use by adults aged 18 and over. We do not knowingly collect data from children under 18. If you believe we have collected data from a child, contact us immediately.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or by posting the updated policy on this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact

For questions about this Privacy Policy: info.sharkinvoice@gmail.com