Privacy Policy

1.About this policy

1. 1.1

   This policy explains how Avantime Consulting India Private Limited (“Avantime”, “we”, “us”), which offers its products under the Vanderline brand, handles personal data in Vanderline Finance (the “Service”): its website, the web application and installable app, and the client and vendor portals.

2. 1.2

   We follow the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Information Technology Act, 2000 and the rules made under them. Words such as “Data Fiduciary”, “Data Processor” and “Data Principal” have the meanings given in the DPDP Act. Other capitalised words have the meanings given in our Terms and Conditions.

2.Our two roles

1. 2.1

   Your books: the Customer decides, we process. Each organization that uses the Service (the “Customer”) keeps its books in its own Workspace: invoices, bills, quotes, purchase orders, payments, the ledger, GST and TDS data, documents and attachments, and the details of its clients and vendors and their contact people (names, email addresses, phone numbers, addresses, GSTIN, PAN and bank details). For this “Customer Data”, and for the personal data of the Customer’s own Users, the Customer is the Data Fiduciary and we act as its Data Processor. We process it only on the Customer’s instructions, to provide the Service.

2. 2.2

   The Customer is responsible for telling its clients, vendors and staff how it uses their data, and for having a lawful basis for it. If you are a client, vendor or employee of a Customer and have a question about your data in that Customer’s books, please contact that Customer first. If you contact us, we will pass your request to the Customer and help it respond.

3. 2.3

   Account, billing, support and website data: we decide. For the data described in section 3, we are the Data Fiduciary.

3.Personal data we collect as Data Fiduciary

1. 3.1

   Account and sign-in. When you sign in through Vanderline One (the Vanderline suite’s shared account service, which we also operate), we receive your name, email address, your company and your role in the Service, and details of the sign-in (such as a session identifier and whether a second factor was used). Where the Service uses its own sign-in, we keep your email address, a one-way hash of your password, your two-step verification settings (the authenticator secret is stored encrypted), hashed recovery codes and short-lived one-time codes sent by email.

2. 3.2

   Security and activity records. IP address, browser and device type, sign-in and session times, and an audit trail of actions in the Workspace (who created, changed, approved or deleted what, and when). These protect your account and your books and help you and your auditors see what happened.

3. 3.3

   Billing. Your organization’s name, address and GSTIN, the billing contact, plan, number of Users, invoices, and the status and reference of each payment. Payments are made through Razorpay; we never receive or store full card or bank account details.

4. 3.4

   Contact form and support. Your name, email address, company (if given) and message when you use the contact form on our website, and what you tell us when you write to us.

5. 3.5

   Notifications. If you allow device notifications, a registration for your browser or device so that we can send them.

4.How we use it

1. 4.1

   We use the data in section 3 to:

   • create and run your account, sign you in and keep you signed in;
   • provide, maintain and support the Service, and fix problems;
   • keep the Service and your books secure, and detect and prevent misuse and fraud;
   • bill you, issue tax invoices and keep accounting records;
   • send you messages about the Service, such as security notices, billing messages and changes to our terms; and
   • comply with the law and respond to lawful requests from authorities.
2. 4.2

   We rely on your consent, or on a legitimate use allowed by section 7 of the DPDP Act (for example, where you have given us data for a specific purpose, such as signing in or asking for support, or where the law requires us to process it). Where we rely on consent, you can withdraw it at any time; this does not affect processing already done, and we may then be unable to provide the part of the Service that needs it.

3. 4.3

   We do not sell personal data, we do not show advertising, and we do not use Customer Data for our own marketing or to build profiles.

5.Auto-fill from uploaded invoices and bills (Google Gemini)

1. 5.1

   The Service can read an uploaded invoice, bill or proforma and fill in the form for you. Where this feature is turned on and you use it, the uploaded document is sent to Google’s Gemini API, which reads it and returns the values it finds. Documents are sent only when the feature is used; nothing else in your books is sent.

2. 5.2

   You check and correct the values before saving; nothing is saved without that step.

3. 5.3

   We use a paid Google API service for this, under which Google does not use the content to train its models. This is our commitment about how we have set up the feature; Google’s own terms govern what Google does. If you would rather not send a document to Google, enter its details by hand.

6.Portals, payment links and emails

1. 6.1

   A Customer can share a client or vendor portal link, which shows that one client or vendor their own documents and balances without signing in. Links expire (by default after 90 days) and can be revoked. We store only a one-way hash of each link and record when it was last used.

2. 6.2

   Payment links on invoices are created through the Customer’s own Razorpay account. The Customer is the merchant; a client who pays gives card, bank or UPI details to Razorpay, not to us. Razorpay tells us the payment’s status, amount and reference, so that the receipt can be recorded in the Customer’s books.

3. 6.3

   Invoices and reminders that a Customer sends from the Service are emailed to the addresses the Customer enters, with the Customer’s own email address (where set) for replies.

7.Who processes data for us

8.Where data is processed

1. 8.1

   Our service providers may process data outside India, for example in Singapore or the United States. We transfer data abroad only as the DPDP Act permits, and not to any country the Government of India has restricted.

9.How long we keep it

1. 9.1

   Customer Data is kept while the Workspace is active, and while it is read-only after a subscription or trial ends, so that the Customer can keep viewing and exporting its records. An administrator can ask us to delete it; we do so within 30 days, and copies in backups roll off within 90 days.

2. 9.2

   Account data is kept while you have access to the Service, and then for as long as needed for the purposes above or as the law requires. Sign-in sessions end after 8 hours without use; one-time email codes expire after 10 minutes.

3. 9.3

   We keep our own invoices and payment records for the period tax law requires, even after a deletion request.

10.Security

1. 10.1

   We use reasonable security practices, including encryption in transit (HTTPS/TLS), encrypted storage of secrets, hashed passwords and session tokens, role-based access controls, audit logs and regular backups. Access by our staff is limited to what is needed to run and support the Service.

2. 10.2

   No system is perfectly secure, and we cannot guarantee absolute security.

3. 10.3

   If a personal data breach occurs, we will notify affected Customers without undue delay, and the Data Protection Board of India and affected people as the DPDP Act requires.

11.Cookies and browser storage

12.Your rights

1. 12.1

   Under the DPDP Act you have the right to:

   • get a summary of your personal data that we process and of the processing, and of the others it has been shared with;
   • have your personal data corrected, completed or updated;
   • have your personal data erased when it is no longer needed for the purpose or you withdraw consent, unless the law requires us to keep it;
   • have your grievances redressed; and
   • nominate another person to exercise your rights if you die or become incapable.
2. 12.2

   To use these rights, write to support@vanderline.com. We may need to confirm your identity first. Requests about data in a Customer’s books (section 2) are passed to, and handled with, that Customer.

3. 12.3

   You can change many of your own details yourself in the Service or in Vanderline One. If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India.

13.Children

1. 13.1

   The Service is for organizations and is not meant for anyone under 18. We do not knowingly process the personal data of children. If you believe a child’s data has been given to us, please contact us and we will delete it.

14.Changes to this policy

1. 14.1

   We may update this policy. For a material change, we will email Customers’ administrators at least 30 days before it takes effect. The date at the top of this page shows when it last changed.

15.Contact and Grievance Officer