Privacy Policy

1. Introduction

Welcome to Credwik. This service is operated by ADF DesignTech Private Limited (CIN: U62011HR2026PTC146319), registered at 956/7, HB529, Bahadurgarh, Jhajjar – 124507, Haryana, India ("we", "our", or "us"). We are committed to protecting your personal information and your right to privacy.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at credwik.com and our mobile applications (collectively, the "Service"). We comply with the Digital Personal Data Protection Act 2023 (DPDP Act), IT Act 2000, GDPR for EU/EEA users, UK GDPR for UK users, and CCPA/CPRA for California residents.

Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

2. Information We Collect

Information you provide directly

• Account information: Name, email address, phone number, and business name when you register.
• Business data: Invoices, customer and vendor details, inventory records, and transaction data that you enter into Credwik.
• GST information: Your GSTIN and related tax data required for GST compliance features.
• Communications: Messages you send us via contact forms, email, or support channels.

Information collected automatically

• Usage data: Pages visited, features used, time spent, and actions taken within the Service.
• Device data: Device type, operating system, browser type, and IP address.
• Cookies and similar technologies: Session cookies for authentication; analytics cookies to understand how the Service is used. You can disable cookies in your browser, but some features may not function correctly.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your transactions and invoices
• Enable GST filing and compliance features
• Send you transactional notifications (invoice confirmations, sync alerts)
• Respond to your support requests
• Improve and develop new features based on usage patterns
• Detect and prevent fraud, abuse, or security incidents
• Comply with applicable laws and regulations

We do not sell your personal data to third parties. We do not use your business data for advertising purposes.

4. How We Share Your Information

We share your information only in the following circumstances:

• Service providers: We use trusted third-party providers (cloud hosting, payment processors, analytics) who are contractually bound to protect your data and may not use it for their own purposes.
• CA/Accountant access: If you grant CA read-only access, that user can view your data as configured by you. You control and can revoke this access at any time.
• Legal requirements: If required by law, court order, or governmental authority (including GSTN, MCA, RBI, or Income Tax Department), we may disclose information as necessary.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will provide at least 30 days' notice before your data is subject to a different privacy policy.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Financial / accounting records: 7 years — per Section 36 CGST Act 2017 and Rule 56 CGST Rules 2017
• Payroll data: 8 years — per applicable labour laws
• Support communications: 3 years
• Server logs: up to 12 months

You may request deletion of your account and personal data at any time by contacting us. Your data will be anonymised or deleted within 30 days, except where retention is required by law.

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit using TLS 1.2/1.3
• AES-256 encryption for data at rest
• Row-level security ensuring your data is isolated from other users
• Role-based access controls for our internal team
• Regular security audits and penetration testing
• Daily encrypted backups

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours under GDPR, and report to the Data Protection Board of India per the DPDP Act 2023. We will notify affected users without undue delay where the breach poses high risk.

7. Your Rights

All users (India — IT Rules & DPDP Act): Right to access your data; right to correct inaccurate data; right to withdraw consent; right to nominate another individual to exercise your rights; right to grievance redressal.

EU/EEA & UK users (GDPR / UK GDPR): Right of access; right to rectification; right to erasure; right to restriction of processing; right to data portability; right to object; right to lodge a complaint with your supervisory authority.

California residents (CCPA/CPRA): Right to know; right to delete; right to opt out of sale (we do not sell personal information); right to correct; right to non-discrimination.

To exercise any of these rights, contact us at support@credwik.com. We will respond within 30 days.

8. Children's Privacy

Credwik is a business tool intended for adults (18 years and older). We do not knowingly collect personal information from anyone under 18. If we discover we have collected data from a minor, we will promptly delete it.

9. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the app or sending you an email at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Grievance Officer (India)

As required under the Information Technology (Reasonable Security Practices and SPDI) Rules 2011 and the Digital Personal Data Protection Act 2023, we have appointed a Grievance Officer:

Grievance Officer: Dinesh Kataria
Email: grievance@credwik.com
Address: ADF DesignTech Private Limited, 956/7, HB529, Bahadurgarh, Jhajjar – 124507, Haryana
Response Time: Within 30 days of receipt of grievance

12. Contact Us

Data Controller: ADF DesignTech Private Limited
CIN: U62011HR2026PTC146319
Email: support@credwik.com
Legal: legal@credwik.com
Registered Office: 956/7, HB529, Bahadurgarh, Jhajjar – 124507, Haryana, India

If you have questions about this Privacy Policy or wish to exercise your rights, please reach out via our Contact page or email support@credwik.com. We will respond within 5 business days.