Privacy Policy

Last updated: 25 August 2026

This Privacy Policy explains how Tovan ("we", "us") collects, uses, and protects your information when you use the Tovan app at app.gettovan.com and this website.

Information we collect

• Account information: your mobile number, used to sign you in via one-time password (OTP)
• Business data: the business names, income and expense entries, categories, notes, and team-member associations you create in the app
• Documents: bills, receipts, and photos you choose to attach to entries
• Payment information: payments are processed by Razorpay; we receive payment status and reference details, never your full card or bank credentials
• Technical data: device and log information (such as IP address, browser type, and error reports) used to keep the service secure and reliable

How we use your information

• To provide the service: storing your entries, syncing across devices, and sharing data with the team members you invite
• To process subscription payments and send service notifications (such as subscription reminders)
• To secure the service, prevent abuse, and fix problems
• To respond when you contact support

We do not sell your personal data or your business data to anyone.

Where your data is stored

Your account and business records (the database) are stored on servers located in India. Documents you upload (bills, receipts, photos) are stored in Cloudflare's object storage, pinned to the Asia-Pacific region. Data is encrypted in transit (HTTPS/TLS), and the database is backed up daily with encrypted backups.

Data isolation

Each business's data is isolated at the database level using row-level security policies. Only you and the team members you invite to a business can access that business's data.

Third-party services we rely on

• Meta (WhatsApp Business Platform) and MSG91 — deliver the one-time password (OTP) used to sign you in
• Firebase Cloud Messaging (Google) — push notifications only (Firebase is not used for sign-in)
• Razorpay — payment processing
• Cloudflare — content delivery, security (including the Turnstile bot-check shown occasionally at sign-in), document storage, and cookieless, aggregated web analytics for this website
• Sentry — error monitoring, so we can detect and fix problems; error reports are scrubbed of phone numbers and amounts before being sent

Each processes data under its own privacy policy.

Data retention and deletion

We keep your data while your account is active. You can request deletion of your account and all associated data at any time — see Delete Account. Backups are purged on a rolling schedule after deletion.

Your rights

You may request access to, correction of, or deletion of your personal data by emailing support@gettovan.com. We respond within a reasonable time as required by applicable Indian law, including the Digital Personal Data Protection Act, 2023.

Children

Tovan is a business tool and is not directed at children under 18.

Changes

We may update this policy. Material changes will be announced in the app or by notification. Continued use after changes means you accept the updated policy.

Contact

Questions about privacy: support@gettovan.com