Privacy Policy

1. Who We Are

Shuunnya Accounting ("Shuunnya", "we", "us", "our") is a cloud-based accounting, inventory, and billing platform operated by Shuunnya Solutions. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website and services at accounting.shuunnya.com.

We are committed to complying with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and all applicable Indian data protection regulations.

2. Information We Collect

2.1 Account Information

When you register, we collect:

• Name and email address
• Password (stored in hashed form; we never store plaintext passwords)
• Business name and business details you provide

2.2 Business Data

When you use the platform, you may enter:

• Customer and vendor information (names, addresses, GSTIN, PAN)
• Invoices, estimates, purchase orders, and payment records
• Inventory items, journal entries, and expense records
• GST and tax-related information

This data belongs to you. We act as a data processor and store it solely to provide the service.

2.3 Automatically Collected Data

• IP address (for security and rate limiting)
• Browser type and device information
• Pages visited and actions taken within the platform

3. How We Use Your Information

We use the collected information to:

• Provide the service — store and process your accounting data, generate invoices, calculate GST, and produce reports
• Authenticate you — manage your login sessions securely using encrypted cookies
• Improve the platform — understand usage patterns to enhance features and performance
• Communicate — send service-related notifications (e.g., security alerts, important updates)
• Comply with law — meet legal and regulatory obligations under Indian law

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Data Storage & Security

4.1 Infrastructure

Shuunnya runs on Cloudflare's global edge network, using:

• Cloudflare D1 databases for data storage
• Cloudflare Workers for server-side processing
• Cloudflare KV for session caching
• Cloudflare R2 for file storage (invoice PDFs, exports)

4.2 Tenant Data Isolation

Each business you create receives its own dedicated, isolated database. Your accounting data, invoices, contacts, and inventory are never co-mingled with data from other businesses or users.

4.3 Security Measures

• All data transmitted over HTTPS (TLS encryption in transit)
• Passwords hashed using industry-standard algorithms
• Session cookies are HttpOnly, Secure, and SameSite=Strict
• Server-side input validation on all write operations
• No sensitive data stored in browser local storage

5. Cookies

We use a minimal set of cookies:

We do not use any third-party tracking cookies, analytics trackers, or advertising pixels.

6. Data Sharing

We do not share your personal or business data except in the following limited circumstances:

• Infrastructure providers — Cloudflare, Inc. processes data as our infrastructure sub-processor under their standard data processing terms
• Legal requirements — if required by court order, government directive, or applicable Indian law
• Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction, with prior notice to you

7. Your Rights

Under the DPDP Act, 2023, you have the right to:

• Access — request a summary of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete personal data
• Erasure — request deletion of your personal data (subject to legal retention requirements)
• Grievance redressal — raise a complaint if you believe your data rights have been violated
• Nominate — nominate another individual to exercise your data rights on your behalf

To exercise any of these rights, contact us at the email provided in Section 11.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the service. If you delete your account:

• Your business databases and all contained data will be permanently deleted within 30 days
• Account credentials are removed from the registry database
• Session data is purged immediately
• Backups containing your data are overwritten within 90 days

We may retain minimal records (account email, deletion timestamp) as required by law or to prevent fraud.

9. Children's Privacy

Shuunnya is a business tool and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we learn that we have inadvertently collected data from a person under 18, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by posting a notice on the platform or via email. The "Last updated" date at the top reflects the most recent revision.

11. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to file a grievance, contact us at: