Privacy Policy

1. Who we are and the two roles we play

DataJewellers means Data Doodles Tech Private Limited, the operator of the DataJewellers service ("we", "us"). Our registered address is Baluwatar, Kathmandu, Nepal. Privacy questions go to support@datadoodlestech.com.

We play two different roles, and the difference matters:

• For platform data, we decide. The accounts of the people who sign in, the business record we hold about each subscribing business, our security logs and our support correspondence exist because we run the platform. We decide what to collect there and why, and this policy explains it.
• For a Business's operational data, the Business decides and we host. Everything a jewellery business enters into its own workspace — its customers, suppliers, karigars, stock, sales and invoices — is the Business's data. We store and process it on that Business's instructions, as described in the Business Data Processing Terms.

So if you are a customer, supplier, employee or karigar of a shop that uses DataJewellers, the shop is the organisation responsible for your information, including having a lawful basis and, where required, your consent under the Privacy Act, 2075 (2018), telling you what it collects, and answering your requests. We hold that data for the shop, and we help the shop respond. Ask the shop first; if you cannot reach it, write to support@datadoodlestech.com and we will point you to the right party.

2. What we collect

Account information

For each person with a sign-in: name, email address and the role assigned to them. At business signup we also collect a contact phone number and the company name of the business being registered. Passwords are never stored — only a bcrypt hash of them.

Business information

For each subscribing business: business name, address, PAN or VAT number, its branches, and the logo image it uploads for its invoices and printed documents.

Operational data entered by the Business

Held on the Business's instructions inside that Business's own workspace:

• Customers — name, phone, email, address (province, district, municipality, ward), country, PAN or VAT number, credit limit, opening balance and notes.
• Suppliers — the same contact and tax-identifier fields, plus contact person and bank name, account and branch.
• Karigars (craftsmen) — name, contact person, phone, address and specialisation.
• Inventory — items, weights, purity, rates, product codes and barcode/tag identifiers, and stock movements.
• Sales, purchases and invoices — line items, amounts, taxes, and the customer or supplier they belong to.
• Payment records as metadata only — the amount, date, method and reference a shop records against an invoice. DataJewellers does not process card or bank payments, does not connect to any payment processor, and never receives or stores card numbers or bank credentials.
• Audit events — who changed what and when inside the workspace, with the IP address and browser user agent of the person who did it.

There are no fields in DataJewellers for government ID numbers, dates of birth, photographs of people, or biometric data. PAN and VAT numbers are business tax identifiers, not personal identity documents.

Technical data

• IP address of requests, recorded on audit and security events.
• User agent — the device and browser string your browser sends.
• Session information — the signed session token in a cookie, its expiry, and the revocation counter that lets us invalidate sessions immediately.
• Security events — sign-ins, failed sign-ins, permission changes, deactivations, impersonation and support sessions, exports, and demo or database-level administrative actions.
• Rate-limit records — a short-lived counter row keyed by IP address and, for sign-in attempts, by the email address being tried, so that guessing attacks are throttled.
• Offline device identifiers — a device id generated on the device, plus a label, platform and application version, so that sales made offline can be attributed to the right device and user when they synchronise.

Desktop and mobile applications

There is a desktop application. No iOS or Android app has been published; the Mobile & Desktop App Terms apply if and when one is. In the applications and in the browser:

• The camera is used only for barcode scanning, and only from the moment you start the scanner (see section 3).
• We record the application version of a registered device, to support offline synchronisation.
• There are no push notification tokens — no push service is used.
• There is no crash or error reporting service today. If we add one we will update this policy first.

Support information

Messages you send us — email, screenshots and anything you attach — are kept as support correspondence. When an operator needs to look inside a workspace to investigate a problem, that access happens through a support session: it needs a stated reason, is time-boxed, and is written into the Business's own audit log, so the Business can see who looked, when and why.

Demo environment

The demo at demo.datajewellers.com contains sample data only and is reset periodically. Do not enter real customer, supplier, employee or financial data into the demo. The Demo Environment Terms apply.

3. Barcode scanning and your camera

Barcode scanning happens on your device:

• The camera is used only when you start the scanner — nothing starts a camera automatically, and the browser asks your permission first.
• Video frames are decoded on the device by the browser's own barcode detection. Only the decoded code — a short string of characters — is used by the application.
• No image or video is ever uploaded to us or to anyone else. There is no code in DataJewellers that captures, encodes or transmits a frame.
• The camera stops when the scanner is closed or the screen is left.
• Where a browser does not support on-device barcode detection, the scanner is unavailable and codes are typed in manually instead.

4. Why we use this information

We use personal information to:

1. Provide the service — run each workspace, its stock, sales, purchase, invoicing and reporting functions.
2. Authenticate the people signing in, and authorise what each of them may see and do through roles and permissions.
3. Keep workspaces isolated, so that one business's records are never reachable from another's.
4. Operate inventory and point of sale, including offline sales and their synchronisation.
5. Produce invoices and tax documents the Business configures and issues.
6. Provide support when you ask for it.
7. Protect the service — detect and investigate unauthorised access, credential-guessing, abuse and fraud, and keep an audit trail.
8. Maintain and improve the platform — diagnose faults, migrate data and test that changes work.
9. Communicate with you about your account: verification, password reset and setup links, service and billing notices. Email is only delivered where an email service has been configured for the deployment.
10. Meet legal obligations, including keeping records the tax law requires.
11. Back up and recover data.

We use no analytics service. There is no Google Analytics, no Plausible, no PostHog, no Segment, no Mixpanel and no equivalent anywhere in the product, and no third-party script or font is loaded at all. We do not advertise to you, we run no advertising network code, and we do not sell personal information or share it for anyone else's marketing.

5. Who we share it with

• Vercel — application hosting and content delivery, in the Singapore (sin1) region. Handles requests to the service.
• Neon — the managed PostgreSQL database, in Singapore, where the data is stored.
• An SMTP email service, where the operator has configured one, to deliver transactional email such as verification, password reset and setup links.
• FENEGOSIDA's public rates API — we fetch published daily gold and silver rates once a day. No personal data is sent to it; it is a read-only request for public prices.
• The Inland Revenue Department's CBMS, only if a Business enables e-billing and supplies its own IRD-issued credentials. In that case invoice data — including the buyer's PAN where recorded — is transmitted to the IRD as the Business instructs, because that is what electronic billing does. The adapter is off unless the Business switches it on. DataJewellers is not IRD certified, IRD approved or listed by the IRD.
• Professional advisers — our lawyers, accountants or auditors, where they need it and under a duty of confidence.
• Authorities, courts and regulators, where we are legally required to disclose, or where disclosure is permitted by law to investigate a crime.

We share personal information with no other third parties. There is no data broker, no advertising partner, no analytics processor and no third-party sign-in provider in this product.

If DataJewellers were ever reorganised or its business transferred, we would tell affected Businesses beforehand and the recipient would be bound by terms no weaker than these.

6. Where the data is hosted

The service runs on infrastructure located in Singapore (Vercel's sin1 region and a Neon database), so personal information entered in Nepal is stored and processed outside Nepal.

The Privacy Act, 2075 (2018), as we have verified its text, contains no explicit cross-border transfer or data-localisation rule for ordinary personal information. Where applicable, DataJewellers will handle personal information in accordance with applicable law. If a rule requiring local storage is introduced and applies to us, we will publish what we are doing about it before it takes effect.

7. How we protect it

• Passwords are hashed with bcrypt (cost 12) and never stored or logged in readable form. The enforced policy is at least 12 characters with upper and lower case letters and a number.
• Sessions are signed tokens in httpOnly, same-site cookies, marked secure on deployed environments. A role change, deactivation or password reset revokes every live session for that account immediately. Workspace sessions last 12 hours, operator console sessions 8 hours, and an impersonation session one hour at most.
• Tenant isolation — each Business's data lives in its own database schema, resolved by hostname.
• Roles and permissions are checked on every protected request, including custom roles a Business defines.
• Cross-site request protection — state-changing requests from another origin are refused.
• Security headers — a strict content security policy, HSTS, frame and permissions policies. The policy allows only same-origin scripts and connections.
• Rate limiting on sign-in and sensitive endpoints, keyed by IP address and by account.
• Multi-factor authentication (TOTP) for DataJewellers operators, with the secret stored encrypted (AES-256-GCM).
• Support access control — operator access to a workspace only through a reasoned, time-boxed, audited support session; impersonation requires a reason and expires within an hour.
• Append-only audit logs on both the workspace and platform sides: no route updates or deletes them.
• Input validation on every request, and parameterised database queries throughout.
• Backups through the database provider's backup and point-in-time recovery facilities, plus optional operator-run backups that can be encrypted with AES-256-GCM.

Database encryption at rest is provided by our hosting provider and is a property of their platform, not something DataJewellers implements or separately verifies. We hold no security certification and make no certification claim: nothing here should be read as ISO, SOC 2 or any other audited standard. No system is perfectly secure, and we cannot guarantee that a determined attack will never succeed.

8. How long we keep it

Retention is set out in full in the Data Retention & Deletion Policy. In short:

• Records a Business needs for tax are kept for the statutory periods: at least five years from the end of the income year concerned under the Income Tax Act, 2058, and, for transaction accounts, the period prescribed under the VAT Act, 2052 and its Rules (commonly stated as six years).
• Issued invoices are never edited or deleted; they can only be cancelled with a reason or corrected by credit or debit note.
• Audit logs are append-only and are not pruned.
• A lapsed or cancelled workspace becomes read-only; if it is archived it is scheduled for purge 90 days later, and the purge is a deliberate manual act.
• Rate-limit rows expire on their own. Password reset tokens and one-time credentials expire and are single-use.

9. Your choices and rights

If you are a person recorded in a shop's workspace (a customer, supplier, karigar or employee), the shop controls your record. Ask the shop to show you, correct it or remove it. We will help the shop do so and, where the shop asks us, act on its instructions.

If you have a DataJewellers sign-in, you can:

• See and correct your own name and email in the application, or ask your business administrator to.
• Export data your permissions allow — CSV, Excel or PDF from the screens, and a JSON export per entity from Settings → Legal & Privacy.
• Request deletion of your account from Settings → Legal & Privacy. We review each request, tell you the outcome, and may have to keep records the law requires us to keep.
• Request deletion of the whole business if you are an owner or super administrator with user-management permission. This follows the read-only, export, archive and purge sequence described above.
• See your consent history — which version of these documents you accepted, and when.

Write to support@datadoodlestech.com for anything you cannot do in the application. We answer privacy requests as quickly as we can and will acknowledge yours within 5 business days.

If you are not satisfied, you can complain under the Privacy Act, 2075 (2018), which provides for a complaint to the District Court within the period the Act prescribes (three months from the act complained of) and for a compensation claim to that court. Nepal has no dedicated data-protection regulator, so the courts are the statutory route. Consumer complaints about the service itself may also go to the forums under the Consumer Protection Act, 2075 (2018) — see the Legal & Compliance Contact page.

10. Cookies and local storage

DataJewellers sets exactly two cookies, both strictly necessary session cookies, and stores a few things in your browser to make offline sales and interface preferences work. Details are in the Cookie Policy. There is no advertising, analytics or tracking cookie, and therefore no consent banner.

11. Children

DataJewellers is business software for jewellery retailers. It is not directed to anyone under 18, we do not knowingly create accounts for under-18s, and account holders must confirm they are 18 or older. If you believe a child's personal information has been entered into the service, write to support@datadoodlestech.com and we will work with the Business concerned to remove it.

12. If something goes wrong

Nepal's Privacy Act, 2075 does not, in the text we have verified, impose a data-breach notification duty, and we do not claim a statutory floor. We commit to this voluntarily:

If we confirm a security incident affecting a Business's data, we will inform that Business without undue delay, tell it what we know, what we are doing, and what it may need to do — and we will keep it informed as the picture becomes clearer.

Report a suspected vulnerability or incident to support@datadoodlestech.com. Our Security & Responsible Disclosure page explains how we handle reports.

13. Changes to this policy

Each version of this policy carries a version number and an effective date. When we make a material change — new data collected, a new purpose, a new recipient — we will ask the people who sign in to acknowledge the new version, and older versions stay readable at /legal/privacy/v/<version>. If we ever add an analytics, error-reporting or push service, this policy will say so before it goes live.

14. Contact

• Privacy: support@datadoodlestech.com
• Security: support@datadoodlestech.com
• Support: support@datadoodlestech.com
• Legal: support@datadoodlestech.com
• Post: Data Doodles Tech Private Limited, Baluwatar, Kathmandu, Nepal