Privacy policy

Last updated 1 October 2026

1. Who this policy covers

It covers pump owners who create an account, the people they add to it (managers and dispensing unit staff), and credit customers who open a statement link sent by a pump.

A pump owner decides what is recorded about their own staff and customers. For that information the pump owner is responsible for having a lawful reason to record it, and we process it on their behalf and on their instructions.

2. What we collect

• Account details: your name, email address, username and password. Passwords are stored only as a salted hash, never as you typed them.
• Google sign-in: if you choose it, the email address and name of your Google account, which Google confirms to us through Firebase Authentication.
• Your pump's records: fuels, tanks, nozzles, meter readings, prices, sales, collections, expenses, stock, deliveries, and the log of corrections made to them.
• People at the pump: the names, phone numbers, roles, pay, shifts and attendance of the staff you add.
• Credit customers: names, phone numbers, contact people, vehicle numbers, credit limits, fuel taken on credit and payments.
• Files you upload: photos of shift slips, and settlement files from UPI providers.
• Billing: your plan and whether it is paid. Card, UPI and bank details are entered on Razorpay's checkout and are held by Razorpay, not by us.
• Technical information: the internet address (IP address) a request comes from, used briefly to stop repeated sign-in attempts; and, if you turn on notifications, the delivery address your browser gives us for them.

3. Why we use it

• To provide the service: working out sales, the daily sales report, stock and accounts, and showing them to the logins you allow.
• To sign you in and keep your account secure.
• To bill your subscription.
• To send the notices you ask for, such as the summary when a business day closes.
• To answer you when you contact us.

We do not sell your information, and we do not use it for advertising.

4. Who we share it with

Only with the companies that run parts of the service for us, and only for that purpose:

• DigitalOcean: the servers and the database, in Bengaluru, India.
• Amazon Web Services: storage of slip photos and of backup copies, in Mumbai, India.
• Google (Firebase Authentication): Google sign-in, if you use it.
• Razorpay: taking payments.
• Your browser's notification service: delivering the notices you turn on.

We may also disclose information when the law requires it, for example in response to a lawful order.

5. Where it is kept

Your records are stored in India.

6. How long we keep it

We keep your records while your account is open, because they are your books. When the pump owner deletes the account, we delete its records straight away, except anything the law requires us to keep, such as the invoices we sent you. Backup copies are overwritten within 90 days.

Deleting your account

The pump owner can delete the account at any time, on the website or in the app:

• Website: sign in, click Your sign-in under your name, and use Delete account.
• App: sign in, tap More, then Delete account.

This deletes the pump, everything entered on it, its slip photos and every login on it, and cancels any subscription. It cannot be undone. If you cannot sign in, write to [email] from the email address on the account and we will delete it for you. If you work at a pump, ask its owner to remove your login.

7. How we protect it

• Every connection to the service is encrypted.
• Passwords are stored as salted hashes.
• Two-step sign-in is available for every login.
• Each login sees only what its role allows.
• The database is backed up every day.

8. Cookies and browser storage

We use one cookie, sid, to keep you signed in. It is needed for the service to work and is not used to track you. The website also remembers whether you chose the light or the dark look, in your browser's own storage. If you sign in with Google, Google's sign-in library keeps its own sign-in state in your browser. We use no advertising or analytics cookies.

9. Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct, complete or update it;
• erase it, where we no longer need it or you withdraw your consent;
• let a person you nominate act for you if you are unable to.

If you work at a pump or buy fuel on credit from one, please ask that pump first, because it decides what is recorded about you. We will help it answer you.

Grievance officer: [name], [email]. We reply within [30] days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

10. Children

IndhanPro is for businesses and is not meant for anyone under 18.

11. Changes to this policy

When we change this policy we will update the date at the top. If a change is significant, we will also tell account owners by email or in the app before it takes effect.

12. Contact

[Company legal name], [registered address]. Email: [contact email].