Privacy Policy
We collect only the data needed to run Collectay, we do not sell personal data, and you can export or delete your data from Settings. This policy is written in line with the Information Technology Act, 2000, the SPDI Rules, 2011 and the Digital Personal Data Protection Act, 2023.
1. Who we are and scope
Collectay (“we”, “us”) provides an AI-assisted cashflow and collections platform for businesses (the “Service”). This policy applies to the Collectay website and application. It covers two groups of people: (a) our users - business owners and team members who hold an account - for whom we are the data fiduciary; and (b) our users’ customers - people whose details a user adds to the Service - for whom the user is the data fiduciary and Collectay is a processor acting on the user’s instructions (see section 4).
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, mobile number, hashed password, sign-in method, OTP verification events | You, or Google sign-in if you choose it |
| Business profile | Business name, address, GSTIN, PAN, email, website, logo, invoice and reminder settings | You |
| Customer and invoice data | Customer names, phone numbers, emails, invoice and payment records, notes, imported files | You (typed, uploaded or imported) |
| Communication data | Messages, templates, greeting cards and media, delivery status, reminder and workflow history | You and the Service |
| Usage and device data | IP address, browser and device type, pages and actions, sign-in history, error logs, session identifiers | Collected automatically |
| Support data | Messages you send to support, and questions you ask the in-app assistant | You |
We do not intentionally collect card numbers, bank passwords, or government ID numbers other than the GSTIN/PAN of your business, and we ask you not to enter them into free-text fields. Sensitive personal data such as health or biometric data is not required to use the Service.
3. How and why we use data
- Provide the Service - create your account, store invoices, send the reminders and greetings you configure, show reports. Basis: performance of our agreement with you.
- Authenticate and secure - send OTPs, detect abuse, keep sign-in and security logs, prevent fraud. Basis: legitimate use and security obligations.
- AI features - generate insights, forecasts, summaries, message and greeting text on your request. Basis: your request.
- Communicate with you - service notices, security alerts, optional product updates and the weekly summary report if enabled. You can opt out of non-essential messages.
- Improve the product - fix errors and measure feature usage using aggregated or de-identified data. We do not use your customers’ personal data to train models offered to others.
- Comply with law - respond to lawful requests, enforce our Terms, maintain records required by law.
4. Your customers’ data
If you add customer data to Collectay, you are responsible for having notice, consent or another lawful basis for sharing it with us and for contacting those people. We process this data only to deliver the features you use (for example, sending the reminder you scheduled), and we do not use it for our own marketing. Customers who want access, correction or erasure of their data, or who want to stop receiving messages, should first contact the business that messaged them; they may also write to our Grievance Officer below and we will help route the request.
5. Who we share data with
We do not sell personal data. We share it only with service providers that help us operate the Service, under confidentiality and data-protection commitments, and only as needed:
| Provider type | Purpose | Data involved |
|---|---|---|
| Cloud hosting and storage | Hosting, database, backups, media storage | All Service data (encrypted in transit) |
| WhatsApp (Meta) and messaging gateways | Delivering WhatsApp, SMS, email and voice messages you send | Recipient number or email, message content, delivery status |
| AI model providers (e.g. OpenAI) | Insights, summaries, assistant replies, text generation | Only the context needed for the request, such as aggregated figures or the text you submit |
| Google (sign-in) | Optional “Continue with Google” | Name and email you authorise |
| Email delivery | OTP, alerts and reports | Email address and message content |
We may also disclose data when required by law, court order or a government authority, to protect rights, safety and security, or in connection with a merger, acquisition or sale of assets, in which case it will remain protected under this policy.
6. Cookies and similar technologies
We use a small number of cookies and browser storage that are strictly necessary: a session cookie to keep you signed in and protect forms, and local or session storage for preferences such as dismissed tips and the in-app assistant conversation. We do not use third-party advertising cookies in the application. You can clear or block cookies in your browser, but the Service will not work without the session cookie.
7. Retention and deletion
- We keep account and business data while your account is active.
- You can export your data and delete your account from Settings. On deletion we remove or irreversibly de-identify your account, business and customer data from live systems promptly; copies in encrypted backups are overwritten on our normal backup cycle.
- We may retain limited records for longer where the law requires (for example tax and billing records, security logs and records needed to resolve disputes).
- Sign-in and security logs are kept for a limited period for fraud prevention and audit.
8. Security
We use reasonable security practices appropriate to the data, including encrypted connections (HTTPS), hashed passwords, OTP verification, session controls, access restrictions, logging and regular backups. No system is perfectly secure; if a personal data breach affects you, we will notify you and the relevant authority as required by law. Please protect your password and sign out on shared devices.
9. Your rights and choices
Subject to applicable law, you may:
- access a summary of the personal data we hold about you;
- correct or update inaccurate or incomplete data (most of it directly in Settings);
- request erasure of your data and delete your account;
- withdraw consent where processing is based on consent, and opt out of non-essential communications;
- nominate another person to exercise your rights in case of death or incapacity; and
- make a grievance, and complain to the Data Protection Board of India once it is operational if you are not satisfied with our response.
To exercise a right, use the in-app controls or write to the contact below. We may verify your identity first and will respond within the time required by law.
10. Where data is processed
Our infrastructure and providers may be located in India or other countries. Where data is transferred outside India, we do so only as permitted by Indian law and with appropriate safeguards with the provider.
11. Children
The Service is a business tool for adults and is not directed to anyone under 18. We do not knowingly collect personal data of children. If you believe a child has provided data to us, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date and, for material changes, notify you in the Service or by email before they take effect.
13. Contact and Grievance Officer
In accordance with the Information Technology Act, 2000 and the rules made under it, you can contact our Grievance Officer for any concern about your personal data or this policy:
- Grievance Officer: Collectay Grievance Officer
- Email: grievance@collectay.com
- Privacy and data requests: privacy@collectay.com
- Response time: we acknowledge grievances within 48 hours and aim to resolve them within 30 days.
See also our Terms of Service.