Privacy Policy

How Spheyas collects, uses and protects your data, and the choices you have over it.

This version takes effect: immediately for accounts created from now on; 15 October 2026 for accounts that existed before it was published
First published: 23 July 2025
Last updated: 10 September 2026

1. About this policy

This policy explains what personal data Neelabh Suhas Katte, trading as Hiranyavarna (“Spheyas”, “we”, “us”) collects when you use the Spheyas accounting and invoicing software, our website, and related services; why we collect it; who we share it with; and the rights you have over it.

This policy covers Spheyas only. The same proprietor operates other products under other names, each with its own privacy notice.

“Personal data” means information that identifies you or can be linked to you — your name, email address, phone number, business name, billing details, IP address, and your support correspondence. Anonymised data that cannot be linked back to you is outside this policy.

2. Two different roles: your data, and your customers’ data

This distinction runs through the whole policy.

When we handle data about you — your account, your billing, your support tickets, how you use the product — we are the controller. We decide why and how it is processed, and this policy governs it.
When we handle data you enter into Spheyas about other people — your customers, suppliers, contacts and staff, and the invoices, statements and records concerning them — you are the controller and we are your processor. We hold and process it only on your instructions, to provide the services to you. We never use it to market to your customers and we never sell it.

If one of your customers contacts us about their data, we will direct them to you, because you hold the relationship and the lawful basis for it. You are responsible for having a lawful basis for that data and for telling those people how you use it.

The same applies to accounting and bookkeeping practices using Spheyas for their clients: the practice, or its client, is the controller, and we are the processor for both.

A Data Processing Agreement is available on request from support@hiranyavarna.com.

3. What we collect

Data you give us

Account and identity — name, email address, password (stored hashed), business name, role, phone number.
Organization profile — business name, address, tax identifiers, logo, financial-year and currency settings.
Billing — plan, billing contact and address, payment-method metadata and the processor’s transaction references. We never see or store full card numbers or bank credentials; those go directly to Stripe or PayPal.
Content you create — invoices, quotes, credit notes, ledgers, journal entries, payments, attachments and notes.
Contacts you enter — names, addresses, email addresses and phone numbers of your customers, suppliers and staff.
Bank statement data — transaction lines, dates, amounts, descriptions, counterparty names and account references that you upload or import yourself. We do not connect to your bank, and we hold no bank credentials.
Support and enquiries — the content of emails, enquiry forms and any diagnostic information you send us.

Note that our terms ask you not to enter payment card numbers, personal identity numbers, health information or biometric data into any field. Tax identifiers such as an EIN, VAT number, GSTIN or PAN are expected and fine.

Data we collect automatically

Device type, operating system and browser
IP address, approximate location derived from it, and language
Pages visited, features used, timestamps, and referring URL
Session and authentication cookies, and security and anti-abuse signals
Application and error logs, and a record of logins (device, IP, time)

Your agreement to our terms

When you tick the box agreeing to our terms as you register, we record that you did — the date and time, the IP address the registration came from, the browser you used, and which version of the terms and of this notice you were shown. We keep it for as long as you hold an account, because it is the only proof either of us has of what was agreed and when.

Data from third parties

Our payment processors confirm to us that a payment succeeded or failed, and give us the transaction reference and payment-method metadata.
Advertising and analytics platforms report aggregate campaign performance.

4. Why we use it, and our legal bases

Providing the services, hosting your data, authenticating you — performance of a contract.
Billing, collecting fees, issuing refunds — performance of a contract.
Support and responding to your enquiries — performance of a contract; legitimate interests.
Security, fraud prevention, abuse detection, rate limiting — legitimate interests.
Recording your acceptance of our terms — performance of a contract; legitimate interests (evidence of the agreement).
Product analytics, in aggregated or de-identified form only — legitimate interests.
Service and transactional email (billing notices, security alerts, policy changes) — performance of a contract; legal obligation.
Marketing email, advertising cookies, session-recording analytics — consent.
Retaining transaction records for tax and accounting — legal obligation.

What we never do with your data

We never use your data to train a model that benefits us or another customer. Where the product has AI features we may run your data through a model — sometimes one run by a third-party provider on our behalf — to give you a result, and we may tune a model that serves your account alone. But your books never train a model that serves anyone but you, and changing that would take a policy change, fresh notice, and your opt-in.
We never sell the contents of your account, and we never use them for advertising or share them with an advertising platform. Your invoices, ledgers, bank lines and contacts are not a product we sell, in any sense of the word.
We do not market to your customers, suppliers or contacts.

There is one place where we have to be more careful than a flat denial would allow, and we would rather say it than let you find it: on our public marketing website, if you accept cookies, your browsing is shared with advertising platforms so we can measure our ads. Some laws call that “sharing” or even “selling”, even though no money changes hands. It applies to the marketing site only — never to anything inside your Spheyas account — and one click turns it off. Section 6 explains exactly what happens.

Statistics we compile about how the product is used are aggregated and de-identified: if a statistic could identify you, your business or any of your contacts, it is not one we use.

5. Who we share it with

We do not sell personal data. We share it with the following providers, who process it on our behalf:

Linode (Akamai Technologies) — application and database hosting; holds all customer data. Seattle, Washington, USA.
Stripe — card and subscription payment processing. US and global.
PayPal — alternative payment processing. US and global.
Amazon Web Services (Amazon SES) — transactional and service email delivery. Oregon, USA.
Cloudflare (Turnstile) — bot protection on the registration, login and enquiry forms. US and global.
Microsoft (Clarity) — heatmaps and session recordings, public marketing website only, and only with your consent. US and global.
Meta (Pixel and Conversions API) — advertising measurement, marketing website only, and only with your consent. US and global.
Google (Google Ads) — advertising conversion measurement, only with your consent, and only if you arrived from one of our ads. US and global.

The advertising and analytics tools in the last three entries run only on our public marketing website. They are not loaded on any page where you are signed in to Spheyas. Nothing in your accounting records — no document, no ledger, no contact — is ever seen by an advertising platform.

We also share data with professional advisers under confidentiality; with authorities where legally required, telling you unless we are prohibited from doing so; with an acquirer if the business is sold, merged or restructured, subject to this policy continuing to apply; and with anyone else only with your consent.

6. Cookies, tracking, and how to turn it off

Strictly necessary cookies — session, authentication, security, and the record of your cookie choice itself — are always set.

Everything else loads only if you accept cookies on our banner: Microsoft Clarity, the Meta Pixel, and Google Ads conversion tracking. Decline, and those scripts are never loaded at all. This applies to the server-side counterpart of the Meta Pixel too — if you have not consented, no event is sent from our servers either.

You can change your mind at any time using Cookie settings in the footer of any page, or the Your Privacy Choices link in our website footer. Your choice is stored for one year and applies across our whole site. Declining costs you nothing — every page works identically either way.

We do not sell your personal data for money, and we never will. We should be plain about one thing, though: when you accept cookies, the Meta Pixel and Google Ads tools described above send your page-view data to those platforms so we can measure whether our advertising works. Meta may combine what it receives with the profile it already holds about you. Some privacy laws classify that kind of disclosure as “sharing” — or even “selling” — even though no money changes hands.

That is the honest description of what the technology does, and it is why we would rather say it here than leave you to find the cookie. You can stop all of it with one click on our cookie settings, and none of it ever touches the data inside your Spheyas account.

7. Security

We protect personal data with:

Encryption in transit — HTTPS/TLS across all of our sites, and TLS to our email relay
Hashed passwords, never stored in plain text
Two-factor authentication, available on every account
Role- and organization-scoped access control, so a user sees only the organizations they are entitled to
Bot and abuse protection on registration, login and public forms
Limited production access — access to live systems is restricted to those who need it
Login monitoring, so unusual sign-in activity can be reviewed
Daily automated backups of the servers your data is held on, taken by our hosting provider and retained on a rolling cycle

We describe what we actually do rather than list reassuring measures we have not implemented. To be specific about one of them: the database is not separately encrypted at rest. Your data is protected by the controls above and by our hosting provider’s own physical and platform security, but we are not going to claim an encryption measure we have not put in place.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Use a strong, unique password and enable two-factor authentication.

If a breach affects your personal data, we will tell you and notify the relevant authorities as the law requires.

8. Where your data lives, and international transfers

Your data is stored in the United States. Spheyas runs on Linode (Akamai Technologies) infrastructure in Seattle, Washington. Your account, your documents and your financial records are held there. Our email is delivered through Amazon SES in Oregon.

We operate from India. We are based in Nashik, Maharashtra, and we access those systems from India in order to run, support and maintain the services. That access is itself an international transfer of your personal data, and we would rather state it plainly than leave it implied.

Where personal data protected by European or UK law is transferred, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, and on the equivalent terms in our providers’ own data processing agreements.

9. How long we keep data

Account and organization data — for as long as your account is open.
Your documents, ledgers, contacts and statements — for as long as your account is open; after termination, kept and available for export for 90 days, then deleted.
Terms acceptance record — for as long as you hold an account.
Billing and transaction records — 8 years, the longer of the two periods Indian law requires: 8 years (income tax) and 6 years / 72 months (GST).
Support correspondence — 2 years after the conversation ends.
Login history — 1 month.
Server, access and error logs — 12 months.
Backups — daily, taken by our hosting provider and overwritten on our routine backup cycle. Deleted data stays in a backup only until that backup is overwritten, and we never restore deleted data back into our live systems.
Marketing contacts — until you unsubscribe, then only on a suppression list so we do not email you again.

10. Deletion, and your choices

You may ask us to delete your personal data at any time by emailing support@hiranyavarna.com, and you may ask us to delete an organization’s data entirely rather than keep it on the Free plan.

We will delete it from our live systems within 30 days. Copies held in our backups are overwritten on our routine backup cycle, and we never restore deleted data back into our live systems. The only things we keep are the records the law requires us to keep (section 9).

Deletion is permanent and cannot be reversed. Export what you need first — see section 11.

We verify who is asking. Before we act on a request to access, export or delete data, we confirm it really comes from the account holder, usually by requiring the request to come from — or be confirmed at — the email address on the account. A request to delete or hand over a business’s financial records is exactly the sort of thing an attacker would try, so we would rather ask you for one extra step than get this wrong.

11. Your rights — wherever you live

We give the same rights to everyone who uses Spheyas, regardless of which country or state you are in. You may ask us to:

Access the personal data we hold about you, and receive a copy
Export it in a machine-readable format — email us and we will send it within 30 days; a self-serve export is being built
Correct anything inaccurate or incomplete
Delete your data
Restrict or object to how we process it
Withdraw consent at any time, without affecting processing already done
Stop advertising and analytics tracking — one click in Cookie settings
Complain to a data protection authority in your country

To exercise any of these, email support@hiranyavarna.com. We will acknowledge promptly and respond substantively within 30 days. If a request is genuinely complex and we need longer, we will tell you why before those 30 days are up. We do not charge for these requests, and we will never treat you differently for making one.

If you are in the EEA, the UK or Switzerland

The GDPR applies to you, and the rights above are your rights under Articles 15–22. Our legal bases are in section 4; international transfers are in section 8; the controller is named at the top of this policy.

We do not make decisions about you that produce legal or similarly significant effects by automated means alone. No automated system suspends an account, refuses service, or scores you.

You may complain to your local supervisory authority, or to the UK Information Commissioner’s Office.

If you are in the United States

Several US states give residents rights over their personal data. Rather than maintain a different policy for each, we extend the rights above to everyone. That includes the right to know what we hold, to have it deleted or corrected, to receive a copy, and to opt out of the advertising tracking described in section 6 — and we will not treat you worse for exercising any of them.

12. Children

The services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we will delete it.

13. Marketing

If you opt in, we may email you about features and product updates, and you can unsubscribe at any time. We will still send operational email you cannot opt out of — billing notices, security alerts, and changes to these policies. Our commercial emails carry our postal address and a working unsubscribe link.

14. Changes to this policy

We may update this policy. If we make significant changes we will notify you by email or in-app at least 30 days before they take effect.

15. Contact

Neelabh Suhas Katte, trading as Hiranyavarna
7, Tara Apt, Sharanpur Road, Tilakwadi, Nashik 422002, Maharashtra, India
support@hiranyavarna.com
www.hiranyavarna.com

Thank you for trusting Spheyas.