Last updated: 7 November 2026
This Privacy Policy explains what information Bisro ("Bisro", "we", "us") collects when you use the Bisro Android app (the "App"), the Bisro web app at app.bisro.in, the bisro.in website and the customer khata link pages. It explains why we collect it, where it is kept, how it is protected, who it is shared with, how long we keep it, and your rights.
Bisro is for shops in India. By creating an account or using the App you agree to this Policy and to our Terms & Conditions.
Bisro is in the process of registering as a company in India. Until that is done, Bisro is run by its founder, who is responsible for this Policy. The registered company name and address will be added here as soon as registration is complete.
1. Two kinds of data
Bisro is a tool that shop owners ("you") use to keep their own business records, including details of their own customers and suppliers ("your Customers").
- Your account data: your name, mobile number, email (optional), password, PIN and shop profile. For this data Bisro is responsible to you.
- Your Customers' data: names, mobile numbers, khata entries and balances you enter about the people you deal with. You decide what is entered and why. Bisro keeps it only to run the App for you. You are responsible for having a lawful reason to keep a Customer's details and for answering any request a Customer makes to you about them.
2. What we collect, why, where it is kept and for how long
Account and sign-in
- What: name, mobile number, email (optional), shop name, shop type, language; password and PIN; the device name and time of each sign-in
- Why we need it: To create your account, sign you in, send you one-time codes by SMS, keep your account safe and let you sign out a lost phone
- Where it is kept and how it is protected: Our servers in India. Your password and PIN are stored only as one-way hashes, so nobody can read them. All traffic uses an encrypted connection. Repeated wrong sign-in attempts are limited
- How long: Until you delete your account
Shop profile
- What: address, GST number (optional), UPI ID, shop logo, and the map point of your shop (only if you choose to set it)
- Why we need it: To show your shop on bills and khata links, and to put your shop on the map
- Where it is kept and how it is protected: Our servers and cloud storage in India. Your shop logo can be seen by anyone who opens your customers' khata page
- How long: Until you delete your account
Records you enter
- What: customers and suppliers (names, mobile numbers, notes, balances), khata entries, bills, products and prices, stock, expenses, staff details (names, pay, attendance, advances)
- Why we need it: To run the App for you
- Where it is kept and how it is protected: On your phone while you are offline, saved encrypted; then on our servers in India. Each shop's records are kept separate from every other shop's. Encrypted connection and encrypted storage
- How long: Until you delete them or your account. Deleted entries wait 30 days in the Recycle Bin, then are removed (see section 6)
Photos you add
- What: photos on khata entries, products and shop messages, and your logo
- Why we need it: To show them to you and to the shop you chose
- Where it is kept and how it is protected: Private cloud storage in India. Product pictures can be seen by anyone with the picture's link
- How long: Until you delete them or your account
Chinni (AI assistant)
- What: the messages you type or dictate, and the shop details needed to answer, such as a customer's name and balance
- Why we need it: To prepare Chinni's reply, only when you use Chinni
- Where it is kept and how it is protected: Sent over an encrypted connection to the AI service providers named in section 3. Our servers do not keep the text of your chats. They keep only usage details: the time, which service answered, how long it took and whether it worked
- How long: Chat text stays on your phone for 180 days. Nothing is kept on our servers
Voice (mic button)
- What: what you say
- Why we need it: To turn your speech into text for the message box
- Where it is kept and how it is protected: The App first uses your phone's own speech recognizer, which is provided by your phone's maker or Google. Only if it cannot start, the recording is sent to our speech-to-text provider in India
- How long: Not kept after it is turned into text. The mic works only while you tap it. There is no wake word and no listening in the background
Backups (optional)
- What: a copy of your shop records
- Why we need it: To let you restore your records on a new phone
- Where it is kept and how it is protected: Encrypted on your phone, then saved to your own Google Drive or Dropbox account if you choose. The key that opens a cloud backup is kept with your account so you can restore it on a new phone. A backup file you save yourself is opened only with the backup password you set; we cannot recover that password
- How long: The backup file stays in your Google Drive or Dropbox until you delete it there. The key stays with your account until you delete your account
Shop network and Messages
- What: the mobile number of a shop you connect with, and the messages, photos and shopping lists you send to it
- Why we need it: So both shops can see what you share
- Where it is kept and how it is protected: Our servers in India. To find out whether a number belongs to another Bisro shop we keep a protected one-way code of that number, never a plain list
- How long: Until either shop deletes them, or the account is deleted
Customer khata link page (your Customers)
- What: a private link; an optional 4-digit PIN; optional Google sign-in (name, email, Google account ID); "I paid" claims (amount, optional UPI reference and mobile number); the time the link was last opened
- Why we need it: To let a Customer see their own statement and tell the shop they paid
- Where it is kept and how it is protected: Our servers in India. Anyone who has the link (and the PIN, if set) can see that statement, so share it only with that Customer. The PIN is stored only as a one-way hash. The shop never sees a Customer's Google account or email
- How long: Until the shop resets the link or deletes the Customer. The Google sign-in link is removed at the same time
Phone and crash details
- What: phone model, Android version, App version, crash reports
- Why we need it: To find and fix problems
- Where it is kept and how it is protected: Sent to our crash-report provider in the European Union. We do not turn on the option that collects personal details
- How long: A limited time, only to fix problems
We do not use advertising IDs, we do not show ads, and we do not use advertising or tracking tools. We do not collect card, bank account or UPI PIN details, and Bisro does not process payments.
Phone permissions. Android asks you before the App can use any of these. You can say no; only the feature that needs it stops working.
| Permission | Used for | When |
|---|---|---|
| Camera | Scanning barcodes, taking photos | Only while you scan or take a photo |
| Microphone | Speaking an entry or a Chinni message | Only while you tap the mic |
| Contacts | Picking one customer's name and number | Only when you tap "pick from contacts". We do not upload your phonebook; only the one contact you pick is used |
| Location | Putting your shop on the map | Only when you choose to set the shop location |
| Fingerprint / face unlock | Unlocking the App | Handled by your phone. Bisro never receives it |
| Start after restart | Sending entries that were waiting on your phone | In the background, after the phone restarts |
| Internet | Talking to Bisro's servers | Always |
| Install apps (bisro.in version only) | Installing Bisro updates you download from bisro.in | Only when you install an update |
3. Who we share data with
We do not sell your data or your Customers' data, and we do not use it for advertising. We share it only with the service providers below, only to run the feature named, and they may not use it for their own purposes.
| Who | Where | What they receive | Why |
|---|---|---|---|
| Cloud hosting and storage provider | India | All account and shop data, stored photos | To run our servers, database and file storage |
| AI service providers | India and the United States | Chinni messages and the shop details needed to answer | Chinni's replies |
| Speech-to-text provider | India | A voice recording, only when your phone's own recognizer cannot start | To turn speech into text |
| Translation provider | India | Text you ask the App to translate | Translation |
| SMS provider | India | Your mobile number and the one-time code | To send sign-in codes |
| Crash-report provider | European Union | Crash reports, phone model, App version | To fix problems |
| Your choice | Google sign-in (for Customers who choose it), the map you see when setting the shop location, and your own Google Drive if you choose Google Drive backup | Only for the feature you use | |
| Dropbox | Your choice | Your encrypted backup, only if you choose Dropbox backup | Backup |
| WhatsApp, on your phone | Your choice | A Customer's number and the reminder text, only when you tap Remind | WhatsApp opens on your phone. Bisro's servers are not involved |
Outside India. Chinni and crash reports are processed outside India. If you prefer your data not to leave India, do not use Chinni. Khata, billing, stock, cashbook and the other features work against our servers in India.
Legal requests. We may disclose data if the law, a court order or a lawful government request requires it, or to protect the safety of our users or the public.
If Bisro changes hands. If Bisro is merged with, bought by, or transfers its business to another company, your data may move to that company. It will stay bound by this Policy, and we will tell you before it becomes subject to a different privacy policy.
4. How we protect your data
- All traffic between the App, the web app, the khata link pages and our servers uses an encrypted connection.
- Passwords and PINs are never stored in a form anyone can read.
- Each shop's records are kept separate from every other shop's, inside the database itself, not only in the App.
- Records waiting on your phone to be sent, and your cloud backups, are stored encrypted.
- Only authorised Bisro people can reach our systems.
- You can sign out a lost phone from the web app (Devices), and you can lock the App with a PIN or your fingerprint.
- Repeated wrong sign-in attempts are limited.
- If a breach affects your personal data, we will tell you and, where the law requires, the Data Protection Board of India, without undue delay.
No system is 100% secure, so we cannot promise that nothing will ever go wrong. Please keep your phone locked and your PIN private.
5. Your rights
You can:
- See and take a copy of your data. Sign in at app.bisro.in and choose Download my data (CSV files). For a copy of everything we hold about your account, write to privacy@bisro.in.
- Correct your details in the App (Settings → Shop & Profile Details) or by writing to us.
- Withdraw consent or stop using a feature. Optional features, such as Chinni or voice, can be left alone at any time; the rest of the App keeps working.
- Delete your account and its data (section 6).
- Name someone to use these rights for you if you die or cannot act.
- Make a complaint. Write to our Grievance Officer (section 8). If you are not satisfied with the answer, you can complain to the Data Protection Board of India.
If your request is about a Customer's details that a shop entered, please ask that shop. If a Customer writes to us, we will point them to the shop and help the shop answer.
6. Deleting data, and your account
Deleting records. When you delete a khata entry, cashbook entry, staff payment or customer, it goes to the Recycle Bin for 30 days, where you can restore it. After 30 days it is removed for good, with its photos. For a deleted customer, only the final figures (name, number, totals, last balance and dates) stay in your read-only Activity log until your account is deleted.
Deleting your account.
- In the App: Settings → Delete Account. Or, if you no longer have the App, go to bisro.in/delete-account.
- Your account is scheduled for deletion in 7 days. If you sign in during those 7 days, the App asks whether to keep your account, and choosing keep cancels the deletion.
- After the 7 days we erase your shop's records: customers, suppliers, khata and cashbook entries, bills, products, staff details, photos, messages, cloud backup connections, Chinni usage details, notifications and your sign-in details. Your name, mobile number, email, password and PIN are removed. Messages you sent to another shop are removed for that shop too.
- Copies in our own system backups disappear as those backups expire, within 30 days.
What we keep after deletion, and why.
- A record that you agreed to our Terms and Privacy Policy, and a record of your deletion request, to show we followed the law.
- Bills Bisro has issued to you, if you ever pay for a plan, because tax law requires us to keep them.
None of this can be undone after the 7 days. Download your data first if you want a copy. We cannot remove copies that other people already made, for example messages you sent on WhatsApp.
7. Children
The App is for business use by adults (18 and over). We do not knowingly collect children's data. If you think a child's data has reached us, write to privacy@bisro.in and we will remove it.
8. Contact and Grievance Officer
- In the App: Settings → Help Center, or Report a Problem.
- Email: privacy@bisro.in
- Grievance Officer: the Bisro founder, until the company is registered. The registered company name, address and named Grievance Officer will be published here once registration is complete.
We will confirm we have received your complaint within 24 hours and resolve it within 15 days.
9. Cookies on the website
The bisro.in website does not use advertising or analytics cookies. If you sign in to the web app at app.bisro.in, a cookie keeps you signed in.
10. Changes to this Policy
We will update the date at the top when this Policy changes. For important changes we will tell you in the App before they take effect.