Privacy policy

This policy explains what Zelrion Technologies Pvt Ltd (“we”) collects through LekhSahay, why, where it is kept, and the rights you have under India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

Two kinds of data, two roles

Your account data — the names, emails and sign-in records of the people at your firm — we decide how to use, so for it we are the data fiduciary.

Your clients’ data — their books, invoices, GSTINs, PANs, payroll and filings — is yours. You decide what goes in and why; we process it only to provide the service to you, as your processor. We do not sell it, use it to advertise, or use it to train AI models.

What we collect

• Account: firm name, your team’s names, emails, roles, and an Argon2 hash of each password (never the password itself).
• Usage: sign-in times, IP address and device for security, and an audit trail of actions in the console.
• Content you add: client records, ledgers, documents and files you upload, and messages exchanged through the WhatsApp follow-up feature.
• Billing: plan and payment status. Card and bank details are handled by Razorpay; we never see or store them.

How it is protected

• Each firm’s records are isolated at the database level (row-level security), not only in application code.
• Uploaded documents are encrypted at rest with AES-256-GCM under a key unique to your firm.
• Every change is written to an append-only audit trail that cannot be edited or deleted.
• Connections are encrypted in transit (TLS).

Who else processes it

We use a small number of service providers, each only for what is listed:

• Hosting and database — Vercel (website), and our application and database host. Servers are currently outside India (European Union and/or Singapore).
• Anthropic — when you ask the AI to read a scanned or photographed document, that document is sent to Anthropic’s API to be read. Anthropic does not train on API data.
• Razorpay — subscription payments.
• WhatsApp — if you link a WhatsApp number for client follow-ups, messages pass through WhatsApp and the number you linked.
• Email delivery — password reset and account emails.

How long we keep it

For as long as your firm has an account. If you close it, we delete your firm’s data within 30 days, except records we must keep by law (for example, invoices we issued to you). Backups roll off on their own schedule. You can download a complete export of your data at any time from Plan & billing.

Your rights

You can ask to access, correct or erase your personal data, withdraw consent, or nominate someone to act for you. Write to zelriontech@gmail.com. If your request is about a client’s data, we will act on your firm’s instructions, since your firm controls that data.

Grievance officer

Devashish Biswas, Zelrion Technologies Pvt Ltd — zelriontech@gmail.com. We acknowledge complaints within 72 hours and resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.

Changes

If we change this policy in a way that matters, we will tell account owners by email before it takes effect.