nexvia Start a project →
DOC-P · privacy & data

How we handle your data.

A plain-English walk-through of what we collect, why we collect it, who else touches it, and how to ask us to delete it — covering both the Nexvia studio website and the Nexvia Books app (see §02). Compliant with the Digital Personal Data Protection Act 2023 (India).

Effective16 September 2026
Updated15 Jul 2026
Versionv1.1
OperatorNexvia · Harsh Bagrecha
GSTIN36ELJPB8159M1ZI
§01 / WHO WE ARE

Who we are

Nexvia is a sole proprietorship of Harsh Bagrecha, registered in Hyderabad, Telangana, India. We build websites and automations websites and software for small and medium businesses. This Privacy Policy explains how we collect, use, and protect personal data when you visit nexviatech.in or work with us.

Business: Nexvia (Proprietor: Harsh Bagrecha)
GSTIN: 36ELJPB8159M1ZI
Registered address: 5-1-540, Raj Yash Electricals, Troop Bazar, Hyderabad, Telangana 500095, India
Email: bagrecha.harsh07@nexviatech.in
WhatsApp: +91 81850 89740

§02 / NEXVIA BOOKS APP

The Nexvia Books app

Nexvia Books is our accounting-companion app for TallyPrime — a Windows desktop sync companion plus the web, Android and iOS apps at books.nexviatech.in. It mirrors a read-only copy of the TallyPrime data you choose into a private, per-business cloud workspace so you can view your books on any device and send reminders, statements and invoices on WhatsApp. This section summarises how the app handles data; the full, dedicated policy is at nexviatech.in/books-privacy.

What the app collects and processes:

  • Account & identity: your name, email, phone/WhatsApp number, workspace name, a one-way hash of your access PIN, and a device fingerprint used for device-lock security.
  • Mirrored TallyPrime data: a read-only copy of the company data you select — ledgers, stock items, vouchers/invoices, party masters (names, addresses, phone numbers, GSTINs), balances, and the Balance Sheet / P&L / Trial Balance Tally itself produces. This may include personal data of your own customers and suppliers.
  • Billing data: billing name, address and GSTIN (if given) and Razorpay payment / order IDs. We never see or store your card, UPI or bank credentials — those go directly to Razorpay.
  • Messaging data: when you send a reminder, statement or invoice on WhatsApp, the recipient's number and the message / document pass through Meta's WhatsApp Cloud API for delivery.
  • Optional workplace location: attendance and visit check-ins can record location. From app version 1.0.25, eligible Field Force staff can explicitly start a work-location session that continues while the app is minimised or the screen is locked. It has a visible phone indicator and Stop control. Scheduled shifts end at the company’s set time. Authorised admins can also see Start shift / Not now responses; background points and shift responses are removed after 30 days. See the full location disclosure.
  • Usage, device & logs: sync timestamps and status, app / device identifiers, IP address and user-agent — for security, abuse prevention and support.
Read-only, stored in India, never sold. Your original TallyPrime file never leaves your PC — the app mirrors a copy, and only writes back the entries you create in the app. Your account and mirrored data are stored in India (Supabase on AWS Mumbai, ap-south-1), encrypted in transit and at rest, and isolated per workspace. We never sell or rent it, never share it for marketing, and never use it to train AI models. The app's data-processing sub-processors are Supabase, Cloudflare, Razorpay, Resend and Meta WhatsApp.

Delete your account & data: open Settings → Delete account in Nexvia Books (web, Android or iOS). A workspace owner deleting their account permanently deletes the entire workspace — every company, all mirrored books and every user's login; a team member deleting theirs removes only their own login and personal data. Deletion takes effect immediately and residual copies clear within 30 days (GST / tax billing records are retained for 8 years as required by Indian law). You can also email bagrecha.harsh07@nexviatech.in to request deletion.

For the complete Nexvia Books policy — including our Data-Fiduciary vs Data-Processor roles, security and consent-based remote diagnostics, sub-processor detail, the data-breach process, your DPDP rights and the Grievance Officer — see the Nexvia Books Privacy Policy.

§03 / WHAT DATA WE COLLECT

What data we collect

We collect only what we need to respond to enquiries and deliver our services:

  • Contact-form data: name, email, WhatsApp number (optional), service interest, budget range, timeline, project description, and how you heard about us.
  • Calendar booking data: name, email, and phone (optional) when you book a discovery call.
  • Project payment data: name, email, billing address, GSTIN (if applicable), and payment metadata (Razorpay payment ID, order ID) when you pay a project invoice. We do not see or store your card / UPI / bank credentials. Those go directly to Razorpay.
  • Optional analytics: with your permission, page names, broad referral source, device category, approximate country and signup/download clicks associated with a random browser identifier. We do not record full URLs, form text, prompts or session replays in this measurement.
  • Server logs: IP address, user agent, and timestamp for security and abuse prevention. Retained 30 days.
§04 / HOW WE USE IT

How we use it

  • To reply to your enquiry within our stated reply window of under 2 hours on weekdays.
  • To deliver the services you've engaged us for and send transactional updates about your project.
  • To issue invoices, GST receipts, and payment confirmations for any project payments.
  • To improve the website experience by understanding which pages and case studies are useful (aggregated, not individual).
  • To meet legal, tax, and accounting obligations under Indian law (GST records, invoice retention).
What we don't do: we don't sell, rent, or share your personal data with third parties for marketing. We don't use your data to train AI models. We don't profile you across other websites.
§05 / SUB-PROCESSORS

Sub-processors we use

We use trusted third-party services to operate the site and deliver our services. Each acts as a sub-processor under their own privacy terms:

  • Cloudflare Pages: website hosting and edge delivery (USA / global, GDPR-compliant).
  • Resend: transactional email delivery (USA).
  • Razorpay: payment processing for project invoices (India, RBI-licensed).
  • Zoho Bookings & Zoho Meeting: meeting scheduling and video calls (India / global).
  • Zoho Mail: our business email inbox (India).
  • Nexvia first-party analytics on Cloudflare: optional aggregate website measurement, enabled only after your choice.
  • Meta WhatsApp Business: when you initiate a chat via the WhatsApp button (Ireland / India).
§06 / COOKIES & STORAGE

Your privacy choices

Choose “Essential only” or “Allow analytics” in the privacy notice. Both choices keep this website usable. “Privacy choices” in the footer lets you change your decision at any time.

Optional first-party analytics stores your choice and a random visitor identifier in this browser’s local storage. It counts page names, broad referral sources, device categories, approximate countries and signup/download clicks. It does not collect form contents or identify anonymous visitors. Collection stops and the local visitor identifier is removed when you withdraw permission. Analytics records are deleted after 90 days at the next scheduled cleanup.

The current website no longer loads Google Analytics or Microsoft Clarity. Older records and cookies from those services may remain under their existing retention settings; you can remove old cookies through your browser. Booking services and linked products have their own essential storage and privacy notices. Choices apply separately on each website origin and browser.

§07 / DATA RETENTION

How long we keep things

  • Contact-form submissions: kept for 24 months after last contact, then deleted.
  • Project records (contracts, invoices, deliverables): kept for 8 years to meet Indian GST and tax obligations.
  • Payment records: kept by Razorpay per their retention policy and by us for accounting (8 years).
  • Optional website analytics: 90 days, with removal at the next scheduled cleanup. Earlier third-party analytics records follow the existing provider settings.
  • Server logs: 30 days.
§08 / YOUR RIGHTS (DPDP 2023)

Your rights under the DPDP Act 2023

You can contact us with the requests below. India’s Digital Personal Data Protection Act, 2023 and final 2025 Rules have phased commencement; statutory rights apply as the relevant provisions take effect. This notice does not claim a compliance certification:

  • Right to access: request a copy of the data we hold on you.
  • Right to correction: ask us to correct inaccurate or outdated data.
  • Right to erasure: ask us to delete your data, subject to legal retention obligations.
  • Right to grievance redressal: raise a complaint about how we handle your data.
  • Right to nominate: designate someone to exercise these rights on your behalf in case of incapacity.

To exercise any of these rights, email bagrecha.harsh07@nexviatech.in with the subject line DPDP request. We acknowledge within 1 business day and respond within 30 days.

§09 / GRIEVANCE OFFICER

Grievance Officer

For privacy concerns or DPDP grievances, contact:

Harsh Bagrecha (Proprietor & Grievance Officer)
Email: bagrecha.harsh07@nexviatech.in
WhatsApp: +91 81850 89740
Phone (callable): +91 81850 89740
Hours: Mon–Sat, 10:00–19:00 IST

§10 / CHILDREN

Children

Our services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently received such data, please contact us and we will delete it.

§11 / SECURITY

Security

We use industry-standard practices to protect your data: HTTPS encryption sitewide, payment data handled exclusively by PCI-DSS-compliant Razorpay (we never see card / UPI credentials), server-side secrets stored in encrypted environment variables, and least-privilege access for all third-party integrations. No system is perfectly secure, but we treat client data as if it were our own.

§12 / INTERNATIONAL TRANSFERS

International transfers

Some service providers, including Cloudflare and Resend, may process data outside India. Provider locations and applicable safeguards depend on the service. We assess restrictions under applicable law and do not claim that Indian regulators have approved every destination. Contact us for information about a specific service.

§13 / CHANGES

Changes to this policy

We may update this Privacy Policy as our services evolve or laws change. Material changes will be communicated via email to existing clients. The Effective date at the top will reflect the latest revision.

§14 / CONTACT

Questions?

Email bagrecha.harsh07@nexviatech.in or message +91 81850 89740 on WhatsApp with subject Privacy question.

← Back to nexviatech.in
Privacy Terms Refund

Orbit accounts, workspace and Voice

Orbit account, payment, linked-computer and support records are covered by the Orbit privacy notice. Project notes and provider credentials stay on the linked computer; remote workspace traffic passes through the Orbit relay. Dictation audio is sent to Soniox after recording stops. Orbit’s account page provides an account-data export and privacy request form. Orbit also checks known disposable-email domains, repeated computer signups and first-price use on a different computer. Blocked actions and review signals are retained for 90 days and can be reviewed by support; these signals alone do not prove fraud. Website visitor totals are aggregate; the private owner console separately shows named signup and verified payment records.