Privacy Policy
SCM Software Lab ("we", "us") respects your privacy. This policy explains what personal data we collect through DesiERP and our website, why, who we share it with, and the choices and rights you have under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
1. What we collect
| Data | Examples | Why |
|---|---|---|
| Account details | Name, mobile number, email, business name, GSTIN, PAN, address and PIN code | To create and run your account, verify you, and issue GST tax invoices |
| Business data you enter | Customers, suppliers, products, invoices, payments, employees and payroll | To provide DesiERP to you. You control this data |
| Payment details | Amount, payment reference and status | To credit recharges and keep billing records. Card, UPI and bank details are handled by the payment gateway, not by us |
| Technical data | IP address, browser, device, sign-in times and activity logs | To keep accounts secure, prevent fraud and fix problems |
| Cookies | Session and "remember me" cookies | To keep you signed in. We do not use advertising cookies |
| Website analytics (only if you allow it) | Pages visited, clicks, scrolling, time on page, device, browser and approximate location, collected through Microsoft Clarity and Web-Stat cookies on our public website | To see which pages help, where visitors get stuck and whether a page is broken on some devices. Not used for advertising |
Website analytics run only after you choose Accept all (or switch analytics on) in the "Cookies on this site" banner. If you reject them, they never load. You can change your choice at any time with the Cookie settings link at the bottom of every page of our website; your choice is remembered for 12 months. Analytics are not used inside the DesiERP application.
2. Your business data
The data you enter about your own customers, suppliers and employees belongs to you. For that data, you decide why it is collected and we process it only on your behalf, to provide DesiERP. We do not use it for our own marketing and we do not sell it.
3. Who we share data with
We never sell personal data. We share it only as needed to run the service:
- Payment gateway (Razorpay), to process your payments.
- Messaging providers (SMS, WhatsApp and email), to send the alerts, invoices and one-time PIN-reset links you or your business trigger.
- Analytics providers (Microsoft Clarity and Web-Stat), only on our public website and only if you allow analytics cookies, to understand how the website is used.
- GST Suvidha Provider (GSP), to generate e-invoices (IRN) and e-way bills on the government portals when you use that feature.
- Hosting and backup providers, which store the data on servers in India.
- Your chartered accountant or other people, only if you give them access from within DesiERP.
- Government and law-enforcement authorities, where the law requires it.
4. Where and how we keep it safe
- Data is stored on servers located in India.
- All traffic between your browser and DesiERP is encrypted (HTTPS).
- PINs and passwords are stored only in hashed form; nobody at the Company can read them.
- Access inside your company is controlled by the roles and permissions you set.
- Databases are backed up daily, and backups are encrypted.
5. How long we keep it
We keep your data while your account exists. After an account expires or is closed, we keep it for a reasonable period so you can come back or ask for an export, and longer where the law requires records to be kept (for example, tax and accounting records). After that it is deleted or anonymised. You can ask us to delete your account and data at any time, subject to those legal requirements.
6. Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- ask what personal data we hold about you and how it is used;
- ask us to correct, complete or update it;
- ask us to erase it, or withdraw consent where we rely on consent;
- nominate another person to exercise these rights for you in case of death or incapacity;
- raise a grievance with our Grievance Officer, and then with the Data Protection Board of India.
To use any of these rights, email sales@scmsoftwarelab.com from your registered email, or write to us with your registered mobile number.
7. Children
DesiERP is a business service for people aged 18 and over. We do not knowingly collect data from children.
8. Changes to this policy
We may update this policy from time to time. The date at the top shows the latest version, and we will tell you in the application about important changes.