Privacy Policy

How Spheyas collects, uses and protects your data, and the choices you have over it.

Effective Date: 23 July 2025
Last Updated: 14 July 2026

Welcome! This privacy notice applies to everything we do at Hiranyavarna, including our Spheyas web and mobile accounting software, and any related services or tools we offer — like our website, support features, or events.

When we say “personal data,” we mean anything that can be used to identify you — like your name, email, phone number, company name, payment info, IP address, or support messages. If data is anonymized and can’t be linked back to you, this notice doesn’t apply.

We may update this notice from time to time. If we make significant changes, we’ll let you know — usually via email or in-app notification.

Who are “we”?

“We,” “our,” or “us” refers to Hiranyavarna, a company based in India. Our product is Spheyas, an intuitive accounting platform.

What information we collect

1. Information you give us directly

When you sign up or use Spheyas
Contacting support
Participating in events or surveys

2. Information we collect automatically

Device type, OS, browser
IP address and usage patterns
Interaction with features

3. Information from third parties

Payment processors like Stripe or PayPal, who confirm to us that a payment succeeded

Why we collect and use your data

To provide and support our services
To communicate updates and, if you have opted in, occasional news about Spheyas
To analyze usage and improve features
To protect against misuse or fraud
To generate anonymized analytics

Data you enter about other people

Spheyas is accounting software, so you will enter personal data about other people into it — your customers, suppliers, and staff. Their names, addresses, email addresses, and the documents you raise for them.

That data is yours, not ours. You decide what to collect and why; we simply hold and process it on your behalf so that we can provide the services to you. In the language of the GDPR, you are the controller of that data and we are your processor.

What that means in practice:

We only use it to run the services for you. We never use it to market to your customers, and we never sell it.
If one of your customers asks us to access, correct, or delete their data, we will point them to you, because you are the one who holds the relationship and the lawful basis for it.
You are responsible for having a lawful basis to hold that data in the first place, and for telling those people how you use it.
If you need a Data Processing Agreement for your own compliance, email us and we will provide one.

Legal bases for processing (GDPR)

Your consent
Performance of a contract
Legitimate interests
Legal obligations

How we share your data

With service providers (e.g., hosting, analytics)
With regulators or law enforcement if required
With acquirers, if our business is sold or restructured
Only with your consent, in other cases

We never sell your personal data.

International transfers

Your data may be processed outside your country. We use standard safeguards like SCCs to protect it.

How we keep your data safe

We use encryption, secure infrastructure, and limited access controls. We continually improve our security practices.

How long we keep your data

We retain your data as long as needed to provide services and meet legal obligations. After that, we securely delete or anonymize it.

Analytics & Aggregated Data

We may analyze usage patterns to improve our product. Any data used for analytics is aggregated or anonymized and cannot be used to identify you.

On our public website we also use Microsoft Clarity, which records how pages are used — clicks, scrolling, mouse movement and the general path through the site — and plays them back to us as heatmaps and anonymized session recordings. We use it to find the parts of the site that confuse people, and nothing else. It sets cookies (_clck, _clsk) to recognise a session, and Clarity masks text input by default, so what you type is not captured. It runs only if you have accepted cookies: decline, and the recording script is never loaded at all. Microsoft's use of the data is governed by the Microsoft Privacy Statement.

Your rights

Access, correct, or delete your personal data
Limit or object to processing
Withdraw consent
File a complaint with a regulator

To exercise your rights, email us at support@hiranyavarna.com.

Your GDPR & CCPA Rights

We comply with both the EU’s GDPR and California’s CCPA. You have the right to know, delete, or opt out of certain uses of your data.

Payment processing

We use trusted payment processors:

We do not store card details ourselves.

If you claim a refund under our 30-day money-back guarantee, the refund is sent back through the same payment provider and to the same payment method you originally used — we cannot send it anywhere else. We keep a record of the transaction and the refund (the amount, the date, the method, and the provider’s reference) because tax and accounting law requires us to, even after you have left. That record does not contain your full card number or bank credentials.

Marketing

If you opt in, we may email you about new features and product updates. You can unsubscribe at any time, and we will still send you the operational emails you need — things like billing notices, security alerts, and changes to these policies.

We run advertising on Google Ads to reach people who might want Spheyas. If you arrive on our site by clicking one of our ads and go on to create an account, Google sets a cookie (_gcl_aw) in your browser and we use it — solely to tell Google that ad led to a signup, so we can measure whether our advertising is working. If you don't arrive via a Google ad, or you browse without clicking through an ad, this never runs and no such cookie is set by us. Google's own use of any data it receives is governed by the Google Privacy Policy.

We also run advertising on Meta (Facebook and Instagram). To measure whether those ads work, our website loads the Meta Pixel, which sets a cookie (_fbp) and tells Meta which pages of our site you visited. Unlike the Google Ads cookie described above, the Meta Pixel runs on ordinary page views, not only when you arrive from one of our ads, and Meta may combine what it receives with the profile it already holds about you and use it for its own purposes, including showing you our ads later on their platforms. That is the plain description of what this technology does, and it is why we would rather say it here than leave you to find the cookie. Meta's use of the data is governed by the Meta Privacy Policy.

You can turn this off. Decline on our cookie banner and none of this runs — no Meta Pixel, no Google advertising cookies, and no Clarity session recording. If you have already accepted and changed your mind, use the Cookie settings link in the footer of any page — the choice is stored for a year and applies across our whole site. Declining costs you nothing: every page works exactly the same either way.

We do not sell your personal data. We do share the page-view data described above with Google and Meta for the sole purpose of measuring and delivering our own advertising, and only where you have not opted out. We do not pass them your accounting records, your documents, your customers' details, or anything else you enter into the product — those never leave our systems for advertising purposes, ever.

Complaints & Dispute Resolution

If you have concerns, email us at support@hiranyavarna.com.

We will acknowledge your request as soon as we can, and respond substantively within 30 days, as GDPR and CCPA require
If we need longer for a complicated request, we will tell you why before those 30 days are up
If you are not satisfied, you can contact your local data protection authority

Thank you for trusting Hiranyavarna and Spheyas.