Pakka
Log in Start with Pakka

Legal

Privacy Policy

What we collect, why, where it is kept, and how to reach us.

Last updated: 16 October 2026

1. Who we are

Pakka is a billing, stock and accounts service for businesses in India, run by DK825, LLC (“we”, “us”). This policy covers the Pakka website and the Pakka app.

For the personal data of people who sign up and use Pakka, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). For the personal data a business enters about its own customers, suppliers and staff, that business is the Data Fiduciary and we act as its Data Processor (see section 3).

2. What personal data we collect

  • Account details: your name, email address, phone number (if given) and password. We store the password only as an argon2id hash; we never see or keep the password itself.
  • Business details: trade and legal name, address, GSTIN, FSSAI or other licence numbers, state, bank or UPI details you choose to print on bills, and your logo.
  • Staff and devices: names and roles of staff you invite, and the devices you register to bill from.
  • Records you create: bills, quotations, challans, returns, purchases, payments, stock and item details, including item photos and supplier bills you upload.
  • Technical data: IP address, browser type, and timestamps of sign-ins and requests, kept for security and to stop abuse.

We do not collect Aadhaar numbers, biometric data or card numbers, and we do not buy personal data from anyone.

3. Data about your customers and suppliers

When you record a customer’s or supplier’s name, phone number, address or GSTIN, you decide why and how that data is used. We process it only on your instructions, to provide Pakka to you. You are responsible for having a lawful basis to collect it — for example, a customer’s consent before you store their phone number for reminders — and for answering their requests about it. We will help you meet those requests.

4. Why we use it

  • To create and run your account, and to let you bill, print, share and file returns from it.
  • To keep the service secure: sign-in checks, rate limits, fraud and abuse prevention.
  • To give support when you contact us.
  • To tell you about changes to the service, these terms or this policy.
  • To meet our own legal obligations.

We do not sell personal data, show advertising, or use your business records to train AI models.

5. Consent and how to withdraw it

We process your personal data on the basis of the consent you give when you sign up, and for the legitimate uses the DPDP Act allows (such as meeting a legal duty). You can withdraw consent at any time by writing to sales@dk825.com. Withdrawing consent means we can no longer run your account, so we will close it as described in section 8. It does not affect processing done before you withdrew.

6. Who we share it with

We share personal data only with service providers that help us run Pakka, under contracts that limit them to that purpose:

  • Oracle Cloud Infrastructure hosts our servers and database, in India.
  • Google (Gemini API) reads a supplier bill only when you choose to scan one in Purchases. The file is sent to read the bill, the extracted text comes back to you, and we do not ask Google to keep it beyond what its API terms require.

We may also disclose data when Indian law, a court or a government authority lawfully requires it, or to protect the safety of our users and the service. When you share a bill on WhatsApp or by email, your own device opens that app; we do not send the message.

7. Where data is stored

Your account and business records are stored on servers in India (Oracle Cloud, Hyderabad region). So that billing works without internet, a copy of your shop’s data is also kept on each device you sign in from, in the browser’s storage. If you scan a supplier bill, that file may be processed outside India by Google for the few seconds needed to read it.

8. How long we keep it

  • While your account is open, we keep your data so the service works.
  • When you close your account, we delete your account and business records within 30 days. Backups roll off within a further 14 days.
  • Security logs (IP addresses and sign-in events) are kept for up to 180 days.
  • Where law requires longer — for example records we must keep about our own billing to you — we keep only that part, only as long as required.

GST law asks your business to keep its accounts for at least 72 months after the due date of the annual return. Download your records before closing your account; we will help you export them.

9. How we protect it

  • All traffic is encrypted with HTTPS (TLS).
  • Each business’s data is walled off from every other business at the database level.
  • Passwords are hashed with argon2id; sessions can be ended from any device.
  • Staff see only what their role allows, and billing can be limited to registered devices.
  • The servers are patched automatically, accept only web traffic and key-based administrator access, and are backed up every night.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Act requires.

10. Your rights

Under the DPDP Act you can:

  • get a summary of the personal data we hold about you and how we use it;
  • have inaccurate or incomplete data corrected or updated;
  • have your data erased, subject to section 8;
  • nominate someone to exercise these rights if you die or are unable to;
  • have a grievance addressed (section 13).

Most details can be changed yourself in the app’s settings. For anything else, write to sales@dk825.com. We will verify it is you and reply within 30 days.

11. Cookies and device storage

We use one strictly necessary cookie to keep you signed in, and the browser’s own storage to hold your shop’s data for offline billing. We use no analytics, advertising or tracking cookies, and the website loads nothing from third parties. Signing out removes the session; clearing site data in your browser removes the offline copy.

12. Children

Pakka is for businesses and is not meant for anyone under 18. We do not knowingly collect a child’s personal data. If you believe we have, write to us and we will delete it.

13. Changes to this policy

If we change this policy, we will update the date at the top. For a material change, we will tell you in the app or by email before it takes effect.

14. Grievance officer and contact

Questions, requests or complaints about personal data go to our Grievance Officer:

Grievance Officer, DK825, LLC
Email: sales@dk825.com
Website: dk825.com

We acknowledge every grievance within 48 hours and resolve it within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.