DPDP compliance
The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified in November 2025 and coming into force in phases) set how personal data may be collected and used in India. This page sets out how MiyeeBooks meets each duty. It will be updated as the rules come into force.
1. Roles
| Data | Data Fiduciary (decides why and how) | Data Processor |
|---|---|---|
| Your account and sign-in | Miyee Tech Labs | Google Firebase |
| Customers, suppliers and employees recorded in your books | Your business | Miyee Tech Labs (and our providers) |
| Bank papers you share on MiyeeCredit | Your business, and the lender once it receives them | Miyee Tech Labs |
| Lender profiles on MiyeeCredit | Miyee Tech Labs | Google Firebase |
2. How we meet each duty
| Duty under the Act | What MiyeeBooks does |
|---|---|
| Notice in clear language | Our Privacy Policy lists what we collect, why, and your rights, in plain English. Screens that share data (AI features, MiyeeCredit) say what will be sent before you agree. |
| Consent: free, specific, informed, unambiguous | Separate, explicit choices for each purpose: the AI bill reader needs your own key and a scan you start; the AI review runs when you ask for it; every lender share needs its own tick-box consent, never pre-ticked. |
| Withdrawing consent as easily as giving it | AI features run only when you use them. Withdraw under Shared with lenders removes the papers from the lender's view at once. |
| Purpose limitation and data minimisation | Lenders receive figures, not ledgers, entries or contact details of your customers. The AI review receives a name-free summary. Each consent to a lender covers one application and lasts 90 days. |
| Accuracy | You can correct any detail in the app; the CA review queue and data audit flag inconsistent books. |
| Security safeguards | Encryption in transit and at rest, server-side access rules by role, an append-only audit trail, period lock, and verification of every lender before access. |
| Breach notification | A personal data breach will be reported to the Data Protection Board of India and to affected users as the Rules require, with what happened, its likely effect and what we are doing about it. |
| Erasure when the purpose is over | Account and books deleted within 30 days of a request unless the law requires us to keep them; the lender's view of a share closes after 90 days. |
| Rights of the Data Principal | Access and export (Data Management → Backup & export), correction, erasure, grievance redressal and nomination: see below. |
| Grievance redressal | A named Grievance Officer with an email address (see Contact). We acknowledge within 2 working days and aim to resolve within 30 days. |
| Children's data | MiyeeBooks is for businesses and adults. We do not knowingly process children's data or track or target anyone. |
| Processors | We use established providers (Google Firebase, Cloudflare, Anthropic for optional AI) under their data-protection terms, and only for the purposes above. |
| Transfers outside India | Some providers may process data outside India; we will follow any restriction the Government notifies. |
| Consent Managers | When registered Consent Managers are available, we intend to support them for lender shares. |
3. Your rights, and how to use them
Know and access
See every entry in the app, and export all your books from Data Management → Backup & export.
Correct and complete
Edit any detail in the app, or write to us to correct account details.
Erase
Reset a company's books in Data Management, or write to us to delete your whole account.
Withdraw consent
Stop using an AI feature at any time, or withdraw a lender share under Bank & Credit → Shared with lenders.
Grievance
Write to our Grievance Officer. If you are not satisfied, you can complain to the Data Protection Board of India.
Nominate
Name someone to act for you if you die or cannot act, by writing to us.
4. If your business uses MiyeeBooks
For the people in your books, you are the Data Fiduciary. In practice: record only what you need for the business and the law; tell employees what you keep about them; share books only with people who need them; and use the period lock and roles to protect closed months and salaries.
5. Lenders on MiyeeCredit
A bank or NBFC that receives papers becomes responsible for them under the DPDP Act and RBI's rules. It must use them only for the application they were shared for and stop using them when the business withdraws consent or the 90 days end.
This page describes our practices; it is not legal advice. It will be reviewed as the DPDP Rules come into force and as MiyeeCredit partners with lenders under RBI's Digital Lending Directions.