Privacy Policy

Clarafi is currently an independent, personal/hobby software project, not a registered company. It is operated by an individual based in India. Contact details for privacy matters are listed in Section 10 below.

We collect the following categories of personal data:

• Account data: your name, email address, and a securely hashed password, provided when you sign up.
• Organization data: the organization name and any team members you invite, along with their email addresses.
• Financial and accounting data: transactions, ledger entries, invoices, bills, vendor and customer records, and any other bookkeeping data you enter into the Service. This may include third-party names and amounts if you record transactions involving other people or businesses.
• Technical and usage data: IP address, browser type, device information, log data, and basic usage patterns (e.g., pages visited), collected automatically to operate and secure the Service.
• Authentication data: session tokens and login timestamps, used to keep you signed in and to detect suspicious activity.

We do not knowingly collect any special or sensitive personal data beyond what you voluntarily enter into your own records.

We process your personal data only for the following specific purposes:

• To create and manage your account and organization;
• To provide the core Service — recording, calculating, and displaying your accounting data;
• To authenticate you and protect the Service against unauthorized access;
• To operate, maintain, and troubleshoot the Service (e.g., debugging errors);
• To communicate with you about your account, such as security notices, if necessary.

We do not use your personal data for advertising, do not sell your personal data, and do not use your financial data to build marketing or advertising profiles.

By creating an account, you provide consent for us to process your personal data for the purposes described in Section 3, in accordance with the DPDPA. Consent is:

• Free, specific, informed, and given through your affirmative action of signing up;
• Limited to the personal data necessary for the purposes stated;
• Withdrawable at any time (see Section 8), without affecting the lawfulness of processing before withdrawal.

We do not sell your personal data. We may share limited data with:

• Infrastructure and hosting providers who store data on our behalf (e.g., cloud hosting and database providers), strictly to operate the Service;
• Other members of your organization that you invite — they will be able to see the organization's accounting data according to the access you grant them;
• Law enforcement or regulators, only where required by applicable Indian law.

Some infrastructure providers we use may process or store data outside India. Where this occurs, we take reasonable steps to ensure the provider maintains adequate security safeguards. [Add specific hosting provider name(s) and data-center region(s) here once finalized.]

We apply reasonable technical and organizational measures to protect your data, including password hashing and access controls scoped per organization. However, as noted in our Terms of Service, the Service is provided on an "as is" basis and no security measure, including authentication, is guaranteed to be error-free or impenetrable. You should not enter data into the Service that you cannot afford to have exposed.

We retain your personal and accounting data for as long as your account remains active, or as needed to provide the Service to you. If you delete your account or organization, we will delete or anonymize your personal data within a reasonable period, except where retention is required by applicable law or to resolve disputes.

Under the DPDPA, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed;
• Correct inaccurate or incomplete personal data;
• Erase personal data that is no longer necessary for the purpose it was collected for;
• Withdraw consent at any time, which may limit or end your ability to use the Service;
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
• Grievance redressal — to raise a complaint about how your data is handled (see Section 10).

To exercise any of these rights, contact us using the details in Section 10.

The Service is not directed at, and is not intended for use by, children (individuals under 18 years of age). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us so we can delete it.

In accordance with the DPDPA, you may direct questions, complaints, or requests to exercise your rights to: clarafi@codexlab.me

We will aim to acknowledge and respond to your request within a reasonable time. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required under the DPDPA and DPDP Rules, 2025.

The Service uses essential cookies or local storage strictly necessary to keep you signed in and to operate the application. We do not use third-party advertising or tracking cookies.

We may update this Privacy Policy from time to time. If processing purposes or categories of data change materially, we will make reasonable efforts to notify you and, where required, seek fresh consent.