Privacy policy — Roha Books

This policy covers the Roha Books website (rohabooks.com), the Roha Books web application at your company's address (yourname.rohabooks.com), and the Roha Books Android app. "We" means Roha Books; "you" means the business that uses Roha Books and the people it gives access to. The free trial has its own short trial terms; this policy applies to the trial as well.

1. Two kinds of data

Your business data — the books, vouchers, masters, stock, payroll, attendance, documents and files you or your users put into your company. This belongs to you. We hold it to run the service for you and act on your instructions.
Account details — what we need to run your account: names, mobile numbers, email addresses and roles of your users, your company and contact details, and the details given when you sign up for a trial or ask for a demo.

2. What we collect and why

Sign-in and security: mobile number, PIN (stored only as a one-way hash — we cannot read it), one-time codes, sign-in history, IP address, browser and device type. Used to let the right people in, keep others out, and show you your own activity and login logs.
Contact details: email address and mobile number, used to send you service messages — sign-in codes, trial and subscription notices, and the reports and reminders you schedule.
Mobile app: if you allow it, a push-notification token, location at the moment of an attendance punch or customer visit, and fingerprint / face lock (checked by your phone — the biometric itself never reaches us).
Support: what you tell us when you call or write, and, only when you ask us to help, the part of your company we need to look at.

We do not sell your data, we do not use it for advertising, and there are no third-party advertising trackers on our website or in the application.

3. Where your data is kept

Roha Books companies run on servers in India (Amazon Web Services, Mumbai region). Each company has its own databases.
Connections to the website, the application and the Android app are encrypted (HTTPS).
We take regular backups of every company so it can be recovered after a fault. Backups stay on infrastructure we control and are readable only by our administrators.
Passwords you save for government portals (for example TRACES, EPFO or ESIC) are stored encrypted and used only to run the automation you start.

4. Services we use on your behalf

Some features only work by sending data to another service. They are used only when the feature is used, and only with the data that feature needs:

Email delivery — our email provider sends the emails you and Roha Books send (codes, reports, reminders).
GST suvidha providers (GSPs) — invoice and return data is sent to a GSP when you generate an e-invoice or e-way bill, or download / file GST data with the GST portal.
Government portals — TDS, EPFO, ESIC, Vahan and similar portals receive what you upload through the portal automation, as they would if you entered it yourself.
WhatsApp — messages you send through Roha Books go from your own WhatsApp number, which you link by scanning a QR code, and are subject to WhatsApp's own terms.
AI tools — when you use an AI feature (such as the purchase-invoice, expense-bill or bank-statement scanner, or asking questions of your books), the document or question is sent to Google's Gemini service to produce the result. It is not used by us to train any model, and every use is recorded in your AI activity log.
Push notifications — delivered to the Android app through Expo and Google Firebase Cloud Messaging.
Google Drive backup — only if you connect it; see section 5.

We may also disclose data if Indian law requires it, for example to comply with a lawful order. Otherwise we share it with no one.

5. Google Drive backup

You can choose to keep an off-site copy of your company backups in your own Google Drive. When you connect it, Roha Books asks Google for two permissions:

drive.file — access only to files and folders that Roha Books itself creates in your Drive. Roha Books cannot see, open or change any other file in your Drive.
userinfo.email — your Google email address, only to show which account is connected.

With that access Roha Books creates one backup folder, uploads backup archives of your company into it, lists that folder to replace a file of the same name, and deletes backups in it that are older than the retention period you set. Nothing else.

The access token is stored on our server for your company only, never sent to a browser, and never shared.
Data obtained through Google APIs is not sold, not used for advertising, not used to train AI models, and not transferred to anyone, except as needed to provide this backup feature or as required by law.
Roha Books' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect at any time from the backup settings in Roha Books, or from myaccount.google.com/permissions. Uploads stop immediately; files already in your Drive stay there and remain yours.

6. How long we keep data

Your business data is kept while your subscription is active, so your books are there when you need them.
When a subscription ends, we give you time to take an export or backup, then delete the company's databases and files. A final backup may be kept, readable only by our administrators, for up to 30 more days for recovery, then deleted.
Free trials follow the deletion schedule in the trial terms.
Sign-in and security logs are kept as long as they are useful for security, and are deleted with the company.
Where tax or company law requires a record to be kept longer, we keep only that record, for only as long as required.

7. Your choices

Your company owner and administrators decide who has access and what each user can see, and can export reports and take backups at any time.
You can ask us what personal data we hold about you, to correct it, or to delete it. Where the data belongs to a business that uses Roha Books (for example, your employer), we will pass your request to them, because they control it.
You can stop service emails that are not essential to your account at any time.

We handle personal data in line with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. For any privacy question or request, write to info@rohabooks.com — we reply within 30 days.

8. Children

Roha Books is business software and is not meant for anyone under 18.

9. Changes and contact

If we change this policy, we update the date at the top of this page, and for an important change we tell account owners by email before it applies. Questions: info@rohabooks.com · +91 96776 01555.