Privacy policy

Byapar eKhata (“Byapar eKhata”, “we”, “us”) provides accounting, billing and bookkeeping software for businesses in Nepal. We are the data controller for the personal information described in this policy.

This policy covers our mobile applications, our web application, and this website. It does not cover third-party services you reach from our product, such as your bank or a payment wallet, which have their own policies.

If you have questions about this policy or want to exercise a right described below, contact us at hello@byaparekhata.com or at Putalisadak, Kathmandu 44600, Nepal.

Account information

Your mobile number, which is used to sign in; your name; your preferred language; your email address if you choose to provide one; and records of your sign-ins and devices.

Business and financial records you enter

The information you put into the product: business names and addresses, PAN and VAT numbers, customer and supplier details, products and prices, invoices, purchases, payments, expenses, income, cash and bank entries, and the resulting ledgers and reports. This information belongs to you. We process it to provide the service to you.

Payment information

When you buy a subscription, the payment is handled by a licensed payment provider (for example eSewa, Khalti or Fonepay). We receive a reference, the amount, the status and the plan purchased. We do not receive or store your full wallet credentials or bank details.

Device, technical and usage information

Device model, operating system version, app version, language, time zone, IP address, crash and diagnostic logs, and information about how features are used. We also store push notification tokens so we can deliver notifications to your devices.

Communications

Messages you send to our support team, and records of the reminders and notifications the system sends on your behalf, including delivery status. Where you use SMS features, we store the content of messages sent through the service and their delivery outcome.

• To create and secure your account, and to verify you when you sign in.
• To provide the service: storing your records, generating reports, syncing across your devices.
• To send reminders and notifications that you have configured, on your instruction.
• To process subscription payments and manage your plan.
• To provide support and respond to your requests.
• To keep the service secure, detect abuse and prevent fraud.
• To operate the referral and marketer programme, including crediting commission.
• To understand how the product is used so we can improve it.
• To meet legal, tax and accounting obligations that apply to us.

We do not sell your personal information. We do not use the contents of your business records for advertising, and we do not train advertising models on them.

We process your information because it is necessary to provide the service you have asked for, because we have a legitimate interest in operating and securing the service, because you have given consent (for example, for SMS reminders or marketing messages), or because the law requires it. Where processing relies on consent, you may withdraw it at any time without affecting the service you have already received.

We share information only where it is needed, and only with parties who are bound to protect it.

We may share aggregated, non-identifying statistics — for example, the number of businesses using a feature — but never your individual records.

If you join the referral programme or become a marketer, we process the details you give us (such as your contact details and payout information), the referrals attributed to you, and the commission and payouts generated. Where a referral credits a marketer, the new business is shown that they signed up through a referral link; we do not share the referred business’s financial records with the marketer.

We keep your account and business records for as long as your account is open. If you delete your account, we delete or anonymise your personal information and your business records within a reasonable period, except where we must keep records longer to satisfy tax, accounting or legal obligations, or to resolve a dispute.

Backups are retained on a rolling cycle and are overwritten as part of normal operation. Records in backups are not used for any other purpose.

Data is encrypted in transit and at rest. Access to your business data is scoped to the business you are signed into and enforced on the server for every request, not merely hidden in the interface. Sign-in on a new device requires a one-time code sent to your mobile number, and sessions use rotating tokens.

We maintain activity logs that record who created, changed or deleted records, use soft deletion so mistakes can be recovered, apply rate limiting on sensitive endpoints, and track requests so that support can trace an issue precisely.

No system is perfectly secure. Keep your device locked, do not share one-time codes, and tell us promptly if you suspect unauthorised access to your account.

Byapar eKhata is designed to work without an internet connection. While you are offline, your records are stored on your device, and any changes you make are held in a local queue until they can be uploaded. This data remains on your device until it syncs, and may remain in the app’s local storage afterwards as a cache. Clearing the app’s data or uninstalling the app removes the local copy; your synced records remain in your account.

Our website uses only the cookies and local storage needed to make the site work and to understand, in aggregate, which pages are useful. We do not use advertising cookies and we do not sell audience data. You can block cookies in your browser, though parts of the site may then behave differently.

• Access. Ask us what personal information we hold about you.
• Correction. Correct inaccurate details, or edit them yourself in the app.
• Export. Export your reports to PDF or Excel at any time, or request a full export of your data.
• Deletion. Request deletion of your account and the records in it, subject to the retention obligations described above.
• Withdraw consent. Turn off SMS or marketing messages at any time in the app, or by writing to us.
• Object or restrict. Ask us to stop or limit a particular use of your information.

Write to hello@byaparekhata.com to make a request. We will respond within 30 days. If you are not satisfied with our response, you may raise the matter with the relevant authority in Nepal.

Byapar eKhata is a business tool and is not intended for children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, contact us and we will remove it.

Your data is stored on infrastructure that may be located outside Nepal, including with cloud providers. Where information is transferred abroad, we require the recipients to protect it to a standard consistent with this policy and with applicable law.

We may update this policy as the service evolves or the law changes. When we make a material change we will notify you in the app or by email before it takes effect. The date at the top of this page always shows the current version.

This policy should be read with our terms & conditions.

For any question about this policy or your information:

Byapar eKhata
Putalisadak, Kathmandu 44600, Nepal
Email: hello@byaparekhata.com
Support: support@byaparekhata.com
Phone: +977 9800 000 000