Privacy Policy

This Privacy Policy applies to SoniERP Technologies (“we”, “us”, “the Company”) and governs all personal data processed through the SoniERP platform — including our web application, mobile app, APIs, and WhatsApp integrations.

We are a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act). You — as our subscriber — are the Data Principal for your own data, and additionally act as a Data Fiduciary for your customers' data that you enter into our platform.

This policy is written in plain English to help you understand your rights. If you have any questions, contact our DPO at dpo@sonierp.in.

We collect information you provide when you create an account or use SoniERP, including:

• · Identity data: owner name, email address, phone number, Aadhaar-based e-KYC (optional)
• · Business data: store name, address, GSTIN, BIS licence number, PAN (for TDS)
• · Transaction data: sales, purchases, HUID records, gold loan (Girvi) records, karigar jobs, ledger entries
• · Usage data: pages visited, features used, session duration, browser type, IP address (hashed)
• · Customer data: your customers' names, phones, purchase history — entered by you as the Data Fiduciary
• · Device data: device model, OS version (mobile app only), for bug diagnostics

Under the DPDP Act 2023, we process personal data on the following lawful bases:

Withdrawing Consent: You may withdraw non-essential consent at any time via Settings → Privacy → Manage Consents, or by emailing dpo@sonierp.in. Note: Withdrawal of consent for core service processing will result in account suspension as the service cannot be provided without it.

We use your data exclusively to:

• · Deliver and maintain the SoniERP service
• · Generate GST invoices, GSTR-1/GSTR-3B reports, and e-Invoice IRN as required under GST Act 2017
• · Verify HUID codes against the BIS registry for hallmarking compliance
• · Send billing notifications and renewal reminders
• · Provide customer support and resolve disputes
• · Improve the product (aggregated, anonymised analytics only — never individual-level profiling)
• · Detect and prevent fraud, unauthorised access, and platform abuse
• · Comply with legal obligations under Indian law

We do not sell your data to third parties. We do not use your business data to train AI models. We do not serve you advertisements based on your business data.

Your data is stored in infrastructure hosted within India. We implement the following protections:

• · AES-256 encryption at rest; TLS 1.3 in transit
• · Role-based access control (RBAC) — SuperAdmin, Admin, Manager, Staff, Viewer tiers
• · Automated backups every 6 hours with 30-day retention
• · ISO 27001-aligned security practices (certification in progress)
• · Quarterly Vulnerability Assessment & Penetration Testing (VAPT)
• · 72-hour breach notification as required by DPDP Act 2023 Section 8

For full security details, visit our Security page.

Limited transfers for service delivery: Certain service components involve international processing:

• · WhatsApp (Meta): Message content may be routed through Meta's global infrastructure. Only message content you explicitly send to customers is transferred.
• · Twilio: SMS delivery may route through international nodes. Only phone numbers and OTP codes are transferred.

These transfers are protected by Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) in compliance with DPDP Act 2023 cross-border provisions. We will not transfer your inventory, GST, HUID, financial, or customer data internationally under any circumstances.

SoniERP processes GSTIN numbers, invoice data, HSN codes, and e-Invoice IRN responses as required under the Central Goods and Services Tax Act, 2017. You remain the data principal for all tax-related data. We act as a data processor on your behalf when submitting to the NIC IRP (Invoice Registration Portal).

We do not store your NIC credentials. API tokens are encrypted and scoped per session.

HUID Data: Hallmark Unique Identification (HUID) codes verified through the BIS registry are processed for compliance only. These are stored encrypted and never shared with third parties beyond the BIS portal itself.

We use cookies and similar technologies on our website and web app. Here is exactly what we use:

You can manage your cookie preferences at any time via the cookie banner or by emailing dpo@sonierp.in.

We integrate with the following third-party services. We have Data Processing Agreements (DPAs) with each:

We retain data only as long as necessary for the stated purpose or as required by law:

* After mandatory retention periods expire, data is securely deleted using NIST SP 800-88 compliant methods.

Under India's Digital Personal Data Protection Act 2023, you have the following rights:

To exercise any right, email our DPO at dpo@sonierp.in with subject line “DPDP Rights Request — [Your Right]”. We will verify your identity and respond within 30 days. No fees are charged for rights requests.

As a Data Fiduciary under DPDP Act 2023, we are obligated to:

• · Collect only personal data that is necessary for the stated purpose (data minimisation)
• · Ensure accuracy of personal data and update it upon request
• · Implement reasonable security safeguards to prevent personal data breaches
• · Notify the Data Protection Board and affected individuals within 72 hours of discovering a breach
• · Erase personal data when it is no longer needed for the stated purpose
• · Appoint a Data Protection Officer and publish their contact details
• · Establish a Grievance Redressal Mechanism accessible to all Data Principals

SoniERP is a B2B business software platform intended exclusively for adults (18+) operating jewellery businesses. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have inadvertently collected data from a minor, please contact dpo@sonierp.in immediately and we will delete it within 7 days of verification.

We will notify you of material changes to this Privacy Policy by email (to your registered address) and in-app notification at least 15 days before the changes take effect. Minor clarifications may be updated without notice. The “Last Updated” date at the top of this page always reflects the current version.

Continued use of SoniERP after the effective date of policy changes constitutes acceptance of the updated policy.