Gullak Lite Back home

Privacy Policy

Last updated: 30 June 2026

This Privacy Policy explains how Purarama Technologies Pvt Ltd("we", "us", "our") collects, uses, and protects your personal data when you use Gullak Lite (the "Service"). We are committed to handling your data responsibly and in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the rules framed thereunder (the "DPDP Act").

1. Data we collect

We collect the following categories of data:

  • Account data: your name, email address, and password (stored in hashed form).
  • Business & invoicing data: company details, GSTIN, logo, signature, bank/UPI details, clients, invoices, income and expense records, and purchase bills you upload.
  • Payment data: when you subscribe, our payment processor collects payment details. We receive transaction confirmations but do not store your full card or bank credentials.
  • Usage & technical data: log information such as IP address, browser type, and actions within the Service, used for security and to improve the product.

2. How we use your data

  • to provide and operate the Service, including generating invoices and reports;
  • to process subscriptions and payments;
  • to communicate with you about your account, security, and service updates;
  • to maintain the security and integrity of the Service;
  • to comply with legal and regulatory obligations.

We process your personal data on the basis of your consent and to perform our contract with you, in accordance with the DPDP Act. You may withdraw consent by closing your account, subject to data we must retain for legal or accounting purposes.

3. Who we share data with

We do not sell your personal data. We share it only with service providers who help us run Gullak Lite, under appropriate confidentiality and data-protection obligations:

  • Supabase — database, authentication, and file storage;
  • Vercel — frontend hosting;
  • Render — backend/API hosting;
  • Resend — transactional email delivery;
  • Razorpay — payment processing (when you subscribe);
  • Authorities — where required by law or valid legal process.

Your use of these third-party services may also be subject to their own terms and privacy policies. We are not responsible for the data-handling practices of third parties beyond our contractual and legal obligations to safeguard data shared with them.

Your primary account and business data (including invoices, records, and uploaded documents) is stored in India (Mumbai region). Certain ancillary service providers process limited data on servers located outside India — our application hosting (Singapore) and transactional email delivery (Tokyo). The DPDP Act permits such cross-border transfer except to territories restricted by the Government of India (none of the above being restricted). Where data is processed outside India, we take reasonable steps to ensure it remains protected in accordance with the DPDP Act.

4. Data retention

We retain your personal data for as long as your account is active and as needed to provide the Service. After account closure, we may retain certain data where required for legal, tax, or accounting purposes, after which it is deleted or anonymised.

5. Your rights

Under the DPDP Act, subject to its conditions and exemptions, you have the right to:

  • access the personal data we hold about you;
  • request correction or updating of inaccurate or incomplete data;
  • request erasure of your personal data;
  • withdraw consent to processing;
  • nominate another individual to exercise your rights in case of death or incapacity;
  • grievance redressal (see section 8).

To exercise these rights, contact us at hello@purarama.com.

6. Security

We use reasonable technical and organisational measures to protect your data, including encryption in transit, access controls, and per-user data isolation. Purchase bills and similar documents are stored privately and accessed only through short-lived authenticated links. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Cookies

We use essential cookies and similar technologies to keep you logged in and to operate the Service. We do not use them to sell your data. You can control cookies through your browser settings, though disabling essential cookies may affect functionality.

8. Grievance officer

In accordance with the DPDP Act and applicable rules, you may address any grievances regarding the handling of your personal data to:

Grievance Officer
Purarama Technologies Pvt Ltd
Yemalur Main Road, Yemalur, Bengaluru, Karnataka, 560037, India
Email: hello@purarama.com

We will acknowledge and address grievances within the timelines required by law.

9. Children

The Service is not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or through the Service. The "last updated" date above reflects the latest revision.

11. Contact

Purarama Technologies Pvt Ltd
Yemalur Main Road, Yemalur, Bengaluru, Karnataka, 560037, India
Email: hello@purarama.com