Privacy Policy

For Indian data protection purposes, Sabrixa acts as the data fiduciary for personal data processed to operate Zetabooks, unless a written agreement says otherwise (for example, if we process data only as a processor for a larger enterprise).

Product: Zetabooks. Parent / operator: Sabrixa.

Contact for privacy requests: contact@sabrixa.com. Website: https://www.sabrixa.com.

If you need a postal address for notices, email us and we will provide the registered correspondence address on record for Sabrixa.

This Policy applies worldwide to the extent you access the Service. Primary production hosting is in India (see Hosting).

• Business owners, staff, and invited team members who create or use a workspace
• People who visit our marketing website or contact us
• Customers who open payment or invoice links you send (limited data needed to show the invoice / payment page)
• Mobile app users (camera / photo library only when you choose to scan or upload)

You stay in control of what statements and bills enter the Service by uploading or forwarding them.

• Live bank login credentials, netbanking passwords, or UPI PINs
• Direct API access to your bank account via account aggregators (unless we clearly introduce such a feature later and update this Policy)
• Your contacts list, SMS inbox, or call logs
• Precise GPS location for advertising

We do not sell your financial books or statement contents to data brokers or advertisers.

• Provide bookkeeping, invoicing, reconciliation, reports, and related features you request
• Authenticate users, secure accounts, and enforce roles / permissions in your workspace
• Parse statements and bills (including with optional AI — see section 7)
• Send transactional messages (security alerts, invites, payment or reminder emails you enable)
• Process subscription payments and prevent fraud / abuse
• Improve reliability, debug errors, and understand feature usage in aggregate
• Comply with law, respond to lawful requests, and enforce our Terms
• Communicate product updates or support replies you initiate

Depending on context, we rely on one or more of: your consent (for example optional AI features, marketing cookies where required); performance of a contract (providing the Service you signed up for); legitimate uses permitted under applicable law for security, fraud prevention, and service improvement; and compliance with legal obligations.

Where India’s Digital Personal Data Protection Act, 2023 (DPDP) applies, we process personal data for the purposes described in this Policy and honour applicable rights of individuals (see Your rights).

Zetabooks may use machine-learning / large-language-model services to help with tasks such as: reading bank statement text or scanned statement images when local parsing is insufficient; extracting fields from vendor bills; answering questions in AI Coach / Ask using context from your live books; reading contractor paper slips from photos; and assisting with certain GST PDF comparisons or purchase-order match explanations.

When cloud AI is enabled for your workspace (via our environment configuration and/or your workspace AI settings), relevant excerpts — which may include transaction narrations, amounts, dates, GSTINs, vendor names, and, for vision features, page images — are sent to the AI provider solely to return structured results or answers for that request.

AI providers we may use include OpenAI, Google (Gemini), Anthropic, and/or a self-hosted/local model (for example Ollama) depending on configuration. Those providers process data as our processors / service providers under their terms and data-processing terms.

Cloud AI is not required for all features. Many statement formats parse locally. You can keep cloud AI off by not enabling API keys / turning AI settings off. When AI is off, AI-dependent extraction or Coach features will be limited or unavailable.

We do not use your books to train a public model for unrelated customers. Provider training/retention practices are governed by the provider’s API / enterprise terms in force at the time of processing — we recommend paid API usage with training opt-outs where available.

You should not upload data you are not allowed to process. AI output can be wrong — you remain responsible for reviewing books before filing taxes or paying vendors.

We share data only as needed to run the Service:

• Hosting & infrastructure — cloud hosting and CDN / DNS providers (currently Fly.io, with application data hosted in India; Cloudflare where configured)
• Database & file storage — managed storage providers we use to run the Service; we will update this Policy if the provider materially changes
• Payment processors — Razorpay (and banks/UPI rails they use) for subscription or customer payment links you enable
• Email delivery — SMTP / email providers you or we configure for transactional mail
• AI providers — only when AI features are enabled (see section 7)
• Optional integrations you connect — e.g. Gmail import if you explicitly enable it (read-only access scoped to that feature; OAuth tokens stored encrypted)
• Professional advisers or authorities — only when required by law or to protect rights, safety, and security
• Business transfers — if Sabrixa merges, sells, or reorganises, data may transfer under continued confidentiality obligations
• Team members you invite — according to the roles you assign (you control invites and revocation)

Production runs on cloud infrastructure in India with encrypted transport (HTTPS). Data at rest is protected using platform-level disk encryption and application controls (hashed passwords, encrypted secrets for items such as statement PDF passwords and OAuth tokens where implemented).

No method of transmission or storage is 100% secure. We apply reasonable technical and organisational measures appropriate to a cloud bookkeeping product, including access controls, secrets management, and role-based permissions inside workspaces.

If you enable cloud AI or certain processors, data for that request may be processed in other countries (for example the United States) by that vendor. By enabling those features you instruct us to make that transfer for the stated purpose. We select reputable vendors and rely on appropriate contractual / legal mechanisms available under applicable law.

We keep account and bookkeeping data for as long as your workspace is active and as needed to provide the Service, resolve disputes, enforce agreements, and meet legal / tax record expectations you or we may have.

If you delete your business / account using in-product controls (where available) or submit a verified deletion request, we will delete or anonymise personal data within a reasonable period, except where we must retain information for legal compliance, fraud prevention, security, or backup integrity (backups are purged on a rolling schedule).

Uploaded statement files and derived transactions remain until you delete them or delete the workspace, subject to the same exceptions.

Subject to applicable law (including DPDP where it applies), you may request:

• Access to personal data we hold about you
• Correction of inaccurate personal data
• Deletion / erasure of personal data (with legal exceptions)
• Export / portability of your books where the product provides export tools
• Withdrawal of consent for optional processing (for example turning off AI or disconnecting Gmail)
• Grievance redressal via the contact below

The Service is for business use and is not directed to children under 18. We do not knowingly create accounts for children. If you believe a child has provided personal data, contact us and we will take appropriate steps.

We use necessary cookies / local storage for login sessions, security, language, theme, and similar essentials. We may use limited analytics or referral cookies to understand marketing effectiveness. You can control cookies through your browser; disabling essentials may break login.

The Service may link to third-party sites (banks, GST portal, Play Store, payment pages). Their privacy practices are their own. When your customer opens an invoice or payment link, they may see your business details and amounts you chose to share; payment card data is handled by the payment provider, not stored as full PAN on our servers.

• Upload only data you are allowed to process
• Configure team roles carefully; revoke access when staff leave
• Review AI-extracted or auto-matched data before relying on it for tax or payments
• Keep your password safe and enable organisational hygiene (unique emails per user)
• Provide your own privacy notice to your customers/employees where required

We may update this Policy. The “Last updated” date at the top will change. Material changes may also be notified in-app or by email where appropriate. Continued use after the effective date means you accept the updated Policy, except where applicable law requires fresh consent.

Privacy / data requests: contact@sabrixa.com

General support: contact@sabrixa.com or WhatsApp via the contact details on https://www.sabrixa.com

Please allow a reasonable time for a response. If you are unsatisfied, you may also have rights to approach the Data Protection Board of India or other authorities under applicable law once those mechanisms are available for your case.

This same Policy applies to the Zetabooks Android / iOS apps. The apps are primarily a client to our Service (including WebView-based experiences where used). Data practices for uploads, camera, and AI are as described above.

Play Store data-safety answers should be filled to match this Policy: financial info and personal info are collected for app functionality; data is encrypted in transit; optional cloud AI may process document contents when enabled; we do not sell user data.