Privacy policy
What we collect, where it is stored, who can see it, and how to get it deleted.
Who we are
EntryLedger is a service that reads scanned supplier invoices, checks GSTIN and arithmetic, and prepares checked entries for the customer's own books. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Data Fiduciary responsible for your data is:
- Legal entity: DataDab LLP (LLPIN AAD-9765)
- Registered address: Bangalore
- Grievance officer: Amit Ashwini, Partner — hello@entryledger.shop
We are a data processor for the invoice content you upload: that content belongs to you and, in most cases, to your suppliers.
What we collect
Account data
When you create a workspace we store your name, work email, a hashed password, your company name and (optionally) your company GSTIN. Team members you invite are stored the same way.
Invoice data
When you upload an invoice we store the file itself, the text and fields our pipeline extracts from it, the result of every validation check, and an audit trail of any human correction. The audit trail records who confirmed an entry, what they changed, and when. We also store private review drafts, confirmation retry receipts, supplier details and mappings, and retained export files with their invoice and settings snapshots. These records can contain the same invoice and contact data as the original entry.
Operational data
We keep standard server logs (timestamp, method, path, status, response time) and a per-page cost meter so we can bill accurately and diagnose failures. Logs are not used for advertising and are not sold.
Where your data lives
The current application server is in Google Cloud US Central (us-central1), not India. The hosted service supports multiple workspaces with tenant-scoped records and API access. Tenant isolation is not a dedicated server or an India-only residency commitment. Third-party extraction and off-host backup services are also involved; server region alone does not establish where all processing happens. If India-only residency is required, contact us before uploading.
How your documents are processed
Extraction runs in three stages, described in full on the how it works page. In summary:
- Text layer first. If the file is a digital PDF, we read the embedded text directly and no model sees the document.
- OCR second. For scans with readable text, we run optical character recognition locally in our own infrastructure.
- Vision model last. Only pages that fail the first two stages are sent to a third-party vision model to be read.
Your documents are never used to train shared or third-party models. Where a third-party model is involved, we use it for inference on a single document at a time under an agreement that prohibits training on submitted content.
The public try-it demo
The try-it page runs the extraction and validation pipeline without creating a workspace or invoice record. The page shows the current server-set run allowance. Temporary uploads are deleted after processing. We store run metadata, including the file name, page count, verdict and salted hashes of visitor identifiers, to enforce the allowance and diagnose failures. Extraction caches may retain OCR text and model responses, so deleting the temporary upload does not mean every derived copy is immediately erased.
Who can see your data
- Your own team. Workspace operators can read its invoices and saved batches. Review drafts are private to their operator. Supplier master edits and imports require an owner.
- Our operators. Access to production data is limited to the engineers who operate the service, and is used only to diagnose a fault you have reported.
- Nobody else. We do not sell data, and we do not share it with advertisers or data brokers.
How long we keep it
We retain invoices and extracted entries for as long as your account is active, because they are the record of work we have billed for and, in many cases, part of your statutory books and records. Private drafts and retained batch files follow the same active-account policy; there is no automatic draft expiry. You can request deletion of individual documents or of your whole workspace at any time. Requests are handled by our operators, not an automatic purge button. A request involving an exported invoice also needs its retained snapshots, receipts, caches and affected whole batch files reviewed for deletion.
On account closure we delete invoice files and extracted data within 30 days, unless a longer period is required by law. Server logs are retained for 90 days. Scheduled cloud backups expire 30 days after creation; cloud soft deletion can retain recoverable copies for a further 7 days. Removing live data does not immediately erase its earlier backup generations.
Security
All traffic is served over HTTPS. Passwords are stored using Django's standard salted hash; we never store them in plain text. The API is authenticated per tenant and every request is scoped to one workspace, so a valid credential for one tenant cannot read another's data. Login attempts are rate-limited to slow credential-stuffing.
No system is perfectly secure. If you believe your account has been compromised, email us and we will act on it immediately.
Your rights
Under the DPDP Act you may:
- ask what personal data we hold about you and how it is used;
- ask us to correct data that is inaccurate;
- withdraw consent and ask us to delete your data;
- raise a grievance with our grievance officer, who must respond within the statutory period.
To exercise any of these, email hello@entryledger.shop (or the grievance officer above) from the email address on your account.
Cookies
We set one cookie: a session cookie that keeps you signed in. It is HTTP-only, marked Secure, and scoped to this site.
Our public marketing pages (this site and the blog) also run Google Analytics 4, which sets its own cookies to count visits and see which pages get read. It never runs inside the signed-in product: your invoices, GSTINs and amounts are not sent to Google Analytics or advertisers. The third-party vision model described above is a separate processing service and sees only the pages that reach the final stage. If you prefer not to be counted, turn on Do Not Track or block third-party scripts and the site keeps working.
Changes
If we materially change this policy we will update the date above and, where the change affects how we handle your invoice data, notify account owners by email before it takes effect.
Questions about any of this? hello@entryledger.shop. See also our terms of service.