workwisebillingPrivacy Notice
Version 2026-10-06
This notice explains what personal data NerdTech Softwares LLC ("we", "us") processes when you use Workwise Billing, why, how long we keep it, and how to use your rights under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). We do not sell personal data, we do not use it for advertising, and our pages load no trackers, analytics or third-party scripts.
1. Two roles
- Your account (you as a user of Workwise Billing): we are the Data Fiduciary. This notice covers that data.
- Records a business keeps in its workspace (its customers, vendors and their contact people): the business is the Data Fiduciary and we are its Data Processor. We process that data only on the business's instructions, to run the service, as set out in our Terms of Service. If you are one of its customers, contact that business first; we will help it answer you.
2. What we collect and why
| Personal data | Purpose |
|---|---|
| Name, work email, password (stored only as a salted hash), role in the workspace | Creating and securing your account, signing you in, letting admins manage their team |
| Company profile: name, address, GSTIN, phone, billing email, logo | Printing them on the business's quotations and invoices |
| Contacts, products, quotations, invoices, bills and payments entered by the business | Providing the service (as Data Processor, see section 1) |
| The business's own mail server and Razorpay keys, if added (stored encrypted) | Sending its emails and taking its online payments |
| When a customer opens a document link: the time and how many times (not their IP address) | Showing the business that its invoice was seen |
| Plan payments: amount, date and the Razorpay payment reference | Billing and our accounting and tax records. Card, UPI and bank details are collected by Razorpay, never by us |
| Your IP address, briefly, in memory | Limiting repeated sign-in, sign-up and password-reset attempts |
| Date and version of the Terms and this notice you accepted; a log of actions in the workspace | Proving consent, and security and accountability inside the workspace |
We only use cookies that the service needs to work: one keeps you signed in, one protects forms against forgery. There are no advertising or tracking cookies.
3. Consent and how to withdraw it
We process your account data on the basis of the consent you give when you sign up or accept an invitation, and to meet legal obligations (for example tax records). You can withdraw consent at any time, as easily as you gave it: an admin can close the workspace in Settings > Plan > Close workspace, a team member can ask their admin to remove them, or anyone can write to us (section 8). Withdrawing does not affect processing that already happened, and ends the service for that account.
4. Who receives it
People in your workspace see what your role allows. Our staff look at an account only to keep the service running, to keep it secure, or when you ask for help. We use these processors, bound to protect the data and use it only for us:
- Hosting provider: runs our servers and database, located in India. Data may therefore be stored outside India, which the DPDP Act allows except for countries the Government restricts.
- Email delivery: sends sign-in, invitation and notification emails, and the business's invoices unless it uses its own mail server.
- Razorpay: processes plan payments, and a business's customer payments if the business turns it on.
We disclose personal data to authorities only where Indian law requires it.
5. How long we keep it
- Account and workspace data: while the workspace is open. When it is closed it is erased from our live systems at once, and from backups as they are overwritten, within 30 days.
- A trial that ends is not erased: the workspace stays read-only so the business can export or choose a plan. A workspace inactive for a long time may be erased after we warn its admins by email at least 48 hours before.
- Records of payments made to us are kept for as long as Indian tax and accounting law requires (currently up to 8 years), even after a workspace is closed.
6. How we protect it
All traffic uses HTTPS. Passwords are hashed, and mail-server passwords and payment keys are encrypted at rest. Workspaces are isolated from each other, roles limit what each person can do, and actions are logged. Sign-in and password-reset attempts are rate limited.
If a personal data breach happens, we will inform the people affected without delay, with what happened, the likely impact and what they can do, and report it to the Data Protection Board of India as the DPDP Rules require (within 72 hours).
7. Your rights
Under the DPDP Act you can ask us for:
- a summary of your personal data we process, what we do with it, and who we have shared it with;
- correction, completion or updating of inaccurate or incomplete data;
- erasure of data we no longer need, unless the law requires us to keep it;
- a way to resolve a complaint (section 8);
- the right to nominate someone to exercise these rights if you die or become unable to.
Much of this you can do yourself: admins can edit the company profile, export every list as CSV, and close the workspace. For anything else, write to the Grievance Officer. We will reply within 30 days, and in any case within the 90 days the DPDP Rules allow. We may need to confirm who you are first.
8. Grievance Officer and complaints
Grievance Officer, NerdTech Softwares LLC, Nashik, Maharashtra, India. Email contact@nerdtech.in.
If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
9. Children
Workwise Billing is for businesses. It is not meant for anyone under 18, and we do not knowingly process children's personal data.
10. Changes
When we change this notice we update the version above and ask everyone to accept the new version the next time they sign in.