Privacy Policy

UdyogPortal is run by Mahaparv Technologies LLP ("Mahaparv Technologies", "we"), A/P Kasegaon, Tal-Walwa, Dist-Sangli, Kasegaon, Govt. Colony, Kasegaon Police Station, Miraj, Sangli 416415, Maharashtra, India.

LLP Identification Number (LLPIN): ADA-3156.

For the details of your own account we decide how the data is used (under India's law, we are the Data Fiduciary). For the records you enter about your customers, staff and suppliers, you decide and we only hold and process them for you.

• Account: your mobile number, name, date of birth, gender and PIN. Your date of birth confirms that you are 18 or older, and can be asked again to help you reset a forgotten PIN. The PIN is stored only as a one-way hash, so nobody here can read it. If you enter them: email, address, city, district, PIN code, saved delivery addresses and a profile photo. We also record when, and in which language, you accepted these terms.
• Business data you enter: your business profile (name, owners' names and photos, GST, Udyam and FSSAI numbers if you add them, address and map position, logo, shop photo, signature and stamp, bank or UPI details for receiving money), customers and leads, bills, quotations, receipts and dues, products and stock, suppliers, expenses, bookings, memberships, groups, tasks, forms, and the content of the website you publish.
• Staff records, if you use them: name, contact details, date of birth, gender, address, emergency contact, blood group, role, salary, advances, bank or UPI details, attendance, leave, tasks, notes and performance reviews, and any identity numbers you choose to store, such as PAN, UAN, PF or driving licence. When the check-in rules ask for it, a staff check-in saves a selfie, the precise place and the distance from the shop. The owner can also see when each staff member signed in, from which device, and what they changed. These are sensitive: enter them only if you need them, and only with your staff member's knowledge. Store only the last 4 digits of an Aadhaar number, never the full number.
• Health records, if a doctor, clinic or fitness business uses them: prescriptions with the diagnosis, vitals such as blood pressure and sugar, medicines and tests, and progress readings such as weight. The business enters them and is responsible for them; we hold them for that business. A prescription is shown to the patient only when the doctor shares it. Readings and documents filed under a person's mobile number show in that person's own app.
• Photos and files you upload. In the app, the camera is used only when you take a photo or scan a barcode or QR code, and only after you allow it. A photo from your phone is picked by you through Android's photo picker, and a file through Android's file picker; the app cannot look through your gallery or your files by itself.
• Device (Android app): a push notification token from Firebase Cloud Messaging, the app version and the language you use, so we can send notifications to the right phone in the right language. We also record when the phone last used the app.
• Location: only when a page asks for it and you allow it, and never in the background. It is used when a staff member checks in (the precise place and the distance from the shop are saved), when an owner sets the check-in place, and when an owner takes the shop-front photo while setting up the business, to place the shop on the map. Staff location sharing: if a business turns it on, each of its staff members is asked once and decides; a staff member who says yes has their precise location saved every 5 minutes, only between their check-in and check-out and only while the UdyogPortal app or website is open on their phone, and they can turn it off at any time from My Profile.
• Payments: your plan, its dates and amount. For a plan bought in the Android app we receive the Google Play purchase token and order id. For a plan bought on the website we receive the payment gateway's reply, which can include the UPI ID, email or phone number used to pay. We never receive your card number, CVV or UPI PIN.
• Ads (Android app only): Google Mobile Ads uses your phone's advertising ID and device information to show and measure ads. In India, Google usually shows personalised ads without asking first; where Google's consent form applies, it follows your answer. We do not receive or store the advertising ID ourselves.
• Crash reports (Android app only): if the app crashes, Firebase Crashlytics sends us a report with the phone model, Android version, app version and what the app was doing at that moment. The report carries a random Firebase installation number, but it is not linked to your account, name or mobile number.
• App usage (Android app only): Google Analytics for Firebase counts which screens of the app are opened and for how long, with the phone model, Android version, app version, language and approximate region. It uses a random app installation number, not your name, mobile number or account, and never the advertising ID. It records only which screen opened, never what is on it. We use it to see which parts of the app are used and to improve them. It also records, by itself, app opens and updates, plan purchases made through Google Play (plan and price) and ad views.
• Technical: the IP address and browser or device details of each request, your login times and the IP address of your last login, failed login attempts with the mobile number tried, the record of your consents, and server logs. They are used to keep accounts secure, stop misuse and keep the service working.
• Myra: the messages and photos you send to Myra, and its answers. Photos are deleted after 30 days; conversations stay until you clear them.
• Reviews: when you review a business, your rating, words and photos are published on its website at once, with your name as that business knows you, or the last 4 digits of your mobile number. You can remove your review at any time.
• Data about you that businesses keep: if a business on UdyogPortal adds you as its customer, lead, patient, member, staff member or supplier, it holds your details for its own purpose and is responsible for them. When its record has your mobile number, the bills, dues, bookings, memberships, groups, readings and documents it keeps for you also show in your own UdyogPortal app.
• Visitors to business websites: when you order, book, send an enquiry, join, or fill in a form on a business's website, that business receives what you type (such as your name, mobile number, address and answers) and may add you as its lead or customer. A form also records the IP address and browser of the person who filled it, even when it does not ask for a name. Visits are counted with a one-way code, without storing your IP address, and opening a business in the UdyogPortal app counts as a visit in the same way. To stop spam, when you send a form, order, booking or enquiry, or tap Call or WhatsApp, the website keeps a scrambled code made from your IP address for about an hour, to count how many tries come from one place; it cannot be turned back into your IP address and is then discarded.
• Requests on our website: when you ask for a call, a demo or set-up on udyogportal.com, or to become an advisor or franchise, we collect your name, mobile number, kind of business, town or PIN code, what you asked for and your language, with your consent and its time, to call you back. To reach the person nearest you, the request is passed to the UdyogPortal advisor or franchise for your district (else our own team), who calls or WhatsApps you about UdyogPortal; a request to become an advisor stays with our team. To stop spam the website also keeps a scrambled code made from your IP address, and the name of your browser. Your number is never sold. A request that does not lead to a plan is deleted a year after it was last handled; to have it deleted sooner, write to support@mahaparvtechnologies.com.

We never read your contact list, call logs, SMS messages, or anything from other apps on your phone. A contact is shared with the app only when you tap "Pick from contacts" and choose one in your phone's own Contacts app; only that contact's name and number are filled in, and they are saved only if you save the record.

• To give you the service: log you in, keep your records, make bills, publish your website, and show your data on each of your devices.
• To send you notifications about your own account and business, such as a new order, booking or bill.
• UdyogPortal may send you service notices and, if you allow it, news and offers about UdyogPortal; turn offers off in Profile → Notifications.
• To check with Google Play or the payment gateway that a plan was really paid for, and to switch your plan on or off.
• To answer you through Myra, only when you use it.
• To show you, in your own app, the bills, bookings and other records that businesses keep for you under your mobile number.
• To keep the service secure, stop misuse, find and fix faults.
• To show ads in the Android app, through Google, within the consent you gave.
• To meet tax, accounting and other legal duties.

We rely on your consent, given when you create an account and use the service, and on the other legitimate uses that the Digital Personal Data Protection Act, 2023 allows. For sensitive information, such as bank details or health records, you give your consent when you choose to enter it.

We do not sell your data. We share it only with the companies that make the service work, and with the people described below:

• Google, Firebase Cloud Messaging: delivers notifications to your phone. Google receives the push token and the text of the notification.
• Google, Firebase Crashlytics: receives crash reports from the Android app.
• Google, Google Analytics for Firebase: receives the app usage counts described above. Its data is not used to personalise ads.
• Google, AdMob (Google Mobile Ads): shows ads in the Android app and runs the consent form. Google collects the advertising ID and device information directly from the phone under its own privacy policy.
• Google Play Billing: handles payment for a plan bought in the Android app. We send Google the purchase token to check the purchase.
• MSG91: receives your mobile number and the one-time password, delivers it to you by SMS, and tells us whether it was delivered. Today we send only one-time passwords by SMS.
• Cloudflare R2: stores the photos and files you upload.
• Google (Gemini) and Anthropic (Claude): only when you use Myra. Your message, the last few messages of the conversation, any photo you send, and the business details needed to answer are sent to Gemini, or to Claude if Gemini is unavailable. We remove phone numbers, email addresses, GST and PAN numbers from the text first; photos are sent as they are.
• OpenAI (moderation service): text, photos and pictures taken from videos that are published on a business website or in the app, reviews, and messages sent to a business are checked automatically for harmful content when they are saved. Only that content is sent, never your account details. OpenAI does not keep it and does not use it to train its models.
• Payment gateway: Cashfree Payments processes payments for a plan made outside the Android app. We do not see or store your card or UPI details.
• Hosting provider: runs our servers and the database.
• Services our pages load: Google Fonts (lettering), cdnjs by Cloudflare (tools to crop photos, show PDFs and draw maps), goQR.me (QR code pictures on business websites), OpenStreetMap (the map pictures on the owner's staff map, which shows where staff who share their location are), and YouTube and Unsplash (pictures). They receive your IP address and browser details when a page loads.
• WhatsApp: when you or a business sends a bill, reminder or message with a WhatsApp button, it goes from that person's own WhatsApp, not from us, under WhatsApp's own terms.
• Other businesses on UdyogPortal: when a business types your mobile number to add you as its customer, lead, staff member or supplier, it sees the name, gender, date of birth, address and photo on your UdyogPortal profile, so it can fill in its record.
• Your employer, for staff location sharing: only the owner of the business you work for sees where you are, only while you share, and only today's places. Other staff members never see it. We act for the business here (it is the Data Fiduciary for its staff records) and use the places for nothing else.
• UdyogPortal advisors and franchise partners: if one of them signed your business up, they see your name, mobile number, business name and town, your plan dates and whether AutoPay is on, so that they can support you.
• Authorities, when the law requires it.
• A bill, quotation, receipt, reminder, order or booking you send carries a secret link. Anyone who has the link and the last 4 digits of the mobile number it was sent to can open that one document; once the right digits are entered, that browser is not asked again for 30 days. A document made without a mobile number opens with the link alone. These links stop working after 180 days (30 days for a quotation and for a staff joining link), and sending the document again gives a new link. Staff ID card and check-in links do not expire.

Anything published on a business's website is public by design: products, offers, photos, blogs, jobs, contact details, opening hours, owners' names and photos, GST, Udyam and FSSAI numbers, and the UPI ID and bank account on its Pay page if the business adds them. Reviews show the reviewer's name, and testimonials show what the business typed. A staff ID card link shows the staff member's name, photo, role and employer to anyone who has it.

• Your login: a session token, kept in the app's private storage and protected with a key in the Android Keystore, so you stay logged in. Logging out removes it.
• Files you save or download (bills, reports) go to your phone's Downloads folder and stay there until you delete them. Uninstalling the app does not remove them.
• Photos taken for an upload and files prepared for sharing are kept in a temporary folder and cleared automatically, usually within a day.
• Permissions the app can ask for: notifications; camera, to take a photo or scan a barcode; location (precise), for staff check-in and, for a staff member who turns it on, sharing where they are with their employer during their shift while the app is open; and nearby devices (Bluetooth), to print a bill on a Bluetooth printer already paired with your phone. All are optional and asked only when needed, and you can change them in your phone's Settings at any time. The app never uses location in the background. The app also declares Google's advertising ID permission, which the ads use.

• Your account and business records are kept in our database, and the files you upload in Cloudflare R2 storage.
• Some of the service providers listed above, such as Google and Cloudflare, may process or store data outside India. We transfer personal data outside India only as the Digital Personal Data Protection Act, 2023 allows, and never to a country the Government of India has restricted.
• While your account is active we keep your data so the service can show it to you.
• A login in the Android app ends by itself after 90 days without use. A login in a browser ends after 24 hours.
• After you ask us to delete your account, we wait 7 days so that you can change your mind, and then delete it. Your personal data is removed within 30 days of the request being confirmed. The name and mobile number you registered with are kept for 180 days after the account is closed, as the IT Rules, 2021 require. Bills and payment records are kept for 8 years, as tax law requires, and then removed.
• When you delete a single record inside the app, such as a customer or a product, it disappears from your view at once. It is erased from our systems with your account, or earlier if you ask us.
• Staff location points: 30 days, then deleted automatically. Turning sharing off stops new points at once.
• Security, login and system logs, and the record of who changed what: one year, as the Digital Personal Data Protection Rules, 2025 require, or longer only while a security incident, a dispute or the law needs them.
• Backups: deleted data is gone from backups within 90 days.

Under India's Digital Personal Data Protection Act, 2023, you can:

• Access: ask what personal data we hold about you and how it is used.
• Correction: ask us to correct or update it. Most of it you can edit yourself in the app.
• Erasure: ask us to delete your account and the personal data in it.
• Grievance: complain to our Grievance Officer first. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
• Nominate: name another person who can use these rights for you if you die or are unable to.
• Withdraw consent: at any time, as easily as you gave it: delete your account from the app or the Delete your account page, write to us, or for ads use Ad choices. Withdrawing does not undo what was done before, and the parts of the service that need the data stop working.
• Your duties: give true information, do not pretend to be someone else, and do not make false or frivolous complaints, as section 15 of the Act asks.

To use any of these rights, write to us at the address below. We answer within 30 days.

• Ads: where Google's consent form applies to you, you can change your answer at any time in the app under Profile, Ad choices (the row shows only where it applies). You can also reset or delete your advertising ID in your phone's Settings, under Google, Ads.
• Notifications: allow or block them in your phone's Settings, or simply answer "Not now" when the app asks. Logging out stops notifications to that phone.
• Location: allow it only when you check in, or refuse. Without it, the staff check-in cannot record a place.

You can ask us to delete your account and its data from a web page, without the app and without logging in. That page also explains what is deleted and what we must keep.

UdyogPortal accounts are only for people 18 or older, and the ads in the app are not directed at children. Some businesses, such as schools, coaching classes, day-care centres, school vans and dance or swimming classes, keep records of children who are their customers. Such a business must have the verifiable consent of a parent or guardian before it records a child's data, as section 9 of the Digital Personal Data Protection Act, 2023 requires, and must not track children or target ads at them. If you believe a child's data is here without that consent, write to us and we will act on it.

• Everything travels over HTTPS.
• You log in with your mobile number and PIN; a one-time password by SMS is asked when you sign up and when you reset your PIN. The PIN and one-time passwords are stored hashed, and our servers keep only a hash of each login token. After 3 wrong tries the account is locked for a while.
• Resetting your PIN logs you out of every device. Logging out ends the login on that device and stops its notifications.
• Each business's data is kept separate, so one account cannot read another's.
• Private files, such as ID proofs and prescriptions, are kept in private storage and opened through signed links that expire within one hour. Hidden location and camera details are removed from photos you upload.
• Staff identity numbers (Aadhaar, PAN, passport, driving licence, UAN, PF) and bank account numbers are stored encrypted, and shown masked, such as XXXX XXXX 1234. The whole number is shown only when an owner or permitted staff member taps Show, and each time that is recorded.

No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

When you add a customer, a lead or a staff member, you are responsible for that data. Collect only what you need, tell people why you hold it, and delete what you no longer need.

We use a few cookies, only to keep you logged in, remember your language and portal, and protect pages and forms, including on business websites. Your browser also keeps some details on your own phone, such as a cart or the delivery address you typed on a business website. We do not use advertising, analytics or cross-site tracking cookies on the website. The Android app shows the same website inside it, so the same cookies apply there. The Cookie Policy lists each one.

If we change how we use your data, we will update this page and the date at the top. If the change is important, we will tell you in the app before it takes effect.

Postal address: the registered office above. Phone: +91 7410074195

Complaints about your personal data, or about anything on UdyogPortal, can be sent to our Grievance Officer, Dhiraj Kulkarni, Designated Partner, at support@mahaparvtechnologies.com or by post to the registered office above. We acknowledge a complaint within 24 hours and resolve it within 15 days.

This policy is governed by the laws of India. Courts at Sangli have jurisdiction.