1. Who we are
HZ ERP (“HZ ERP”, “we”, “us”) is a software service operated by devhz, a sole proprietorship with its address at Surat, Gujarat, India, India.
This Privacy Policy explains how we collect, use, store, share and protect personal data when you visit hzerp.in (the “Website”) or use the HZ ERP application at app.hzerp.in (the “App”; together, the “Service”).
It is published under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other applicable Indian laws.
2. Our role: two kinds of data
We look after your account data. You decide what happens to the business data you put into HZ ERP.
- Account data (who you are, how you sign in, how you pay): we decide why and how this is used, so for this data we are the Data Fiduciary under the DPDP Act.
- Business data (your customers/parties, materials, challans, job cards, invoices, staff records and similar data you or your staff enter): you decide what goes in and how it is used. For this data, your business is the Data Fiduciary and we act only as your Data Processor, processing it on your instructions to provide the Service. You are responsible for having a lawful basis to enter personal data of your customers, suppliers and staff into HZ ERP.
3. What data we collect
3.1 Data you give us
- Owner and admin accounts (via Google sign-in): your name, email address and profile photo, as shared by Google. We never see or store your Google password.
- Staff accounts (created by you): staff name, employee ID, username, role and a password. Passwords are stored only as a one-way hash (bcrypt) and can never be read back, even by us.
- Shop profile: legal and trade name, GSTIN, PAN, state, address, PIN code, mobile number, WhatsApp number, email, logo, and invoice and challan number settings.
- Business records: parties (customers and suppliers, including their names, GSTINs, addresses and contact details), items, customer material received, job cards, delivery challans, invoices, scrap sales, tooling, and reports generated from these.
- Billing data: your plan, subscription status and dates, and payment records (Razorpay payment, subscription and invoice IDs, amount, payment method type and status). We do not collect or store card numbers, CVV, UPI PINs or bank login details. Payments are handled entirely by Razorpay, which is PCI-DSS compliant.
- Messages: anything you send us by email, phone or WhatsApp for support, feedback or grievances.
3.2 Data collected automatically
- Activity history (audit log): inside each workspace, the App records who created, changed or deleted a record, and when. This is a core feature that you and your team can see.
- Technical data: IP address, browser and device type, and timestamps, recorded in server logs to keep the Service secure, prevent abuse and fix errors.
- Cookies: see section 7.
3.3 What we do not collect
- We do not use advertising trackers, tracking pixels or third-party analytics on the Website or the App.
- We do not knowingly collect data from anyone under 18.
- We do not buy personal data from data brokers.
4. Why we use your data
| Purpose | Legal basis (DPDP Act) |
|---|---|
| Create your account, sign you in and keep you signed in | Your consent, given when you sign up |
| Provide the Service: store records, make challans, invoices and reports, send alerts inside the App | Your consent and the use you asked for |
| Process subscription payments and keep billing records | Your consent; legal obligation under tax laws |
| Send service messages: trial ending, payment failed, security notices, policy changes | Necessary for the Service you requested |
| Answer support requests and grievances | Your consent and legal obligation |
| Keep the Service secure, prevent fraud and misuse, fix bugs | Legitimate uses permitted under Section 7 |
| Comply with law, court orders and lawful government requests | Legal obligation (Section 7) |
We do not use your business data for any purpose other than providing the Service to you. We do not read your business records except when you ask us to (for example, during a support request), when needed to fix a technical problem, or when required by law. We do not use your data to train artificial intelligence models.
We will only send you marketing emails if you opt in, and every such email will have an unsubscribe link.
5. Who we share data with
We never sell your data. We share it only with the few services we need to run HZ ERP, or when the law requires.
5.1 Service providers (processors)
| Provider | Why | Data involved |
|---|---|---|
| Google LLC | Sign in with Google for owners and admins | Name, email address, profile photo |
| Razorpay Software Pvt. Ltd. | Subscription payments | Billing name, email, phone, payment details you enter on Razorpay |
| Cloudflare | Hosting the app and its databases | All account and business data, stored encrypted in transit |
Each provider may use the data only to provide its service to us and must protect it under a contract and its own privacy policy. We will update this list before adding a new provider that handles your personal data.
5.2 Other sharing
- People you invite: staff and users you add to your workspace can see data according to the role you give them.
- Documents you share: challans, invoices and reports you download, print or send (for example, to your customer or your CA) leave HZ ERP under your control.
- Legal requirements: we may disclose data when required by law, court order, or a lawful request from a government or tax authority, or to protect the rights, safety or property of our users or the public.
- Business transfer: if HZ ERP is merged, acquired or sold, data may move to the new owner, who must keep honouring this policy. We will tell you before this happens.
6. Where and how your data is stored
- Location: your data is stored on servers in India. If a service provider processes data outside India, we do so only as permitted under Section 16 of the DPDP Act and never to a country restricted by the Government of India.
- Separate database per shop: each workspace's business data is kept in its own isolated database, so one shop can never see another shop's data.
- Security measures: HTTPS encryption for all data in transit, one-way hashed passwords, role-based access for staff, an audit log of every change, restricted internal access on a need-to-know basis, and regular backups.
- Data breaches: no system is completely secure. If a personal data breach happens, we will inform affected users and the Data Protection Board of India as required by the DPDP Act and its Rules, and CERT-In where required, and tell you what we are doing about it.
- Your part: keep your Google account and staff passwords safe, remove staff who leave, and tell us immediately at info@devhz.com if you suspect unauthorised access.
7. Cookies
- Website (hzerp.in): does not set any cookies.
- App (app.hzerp.in): uses only strictly necessary cookies to keep you signed in securely (session and security tokens). The App does not work without them, so they cannot be switched off. We do not use advertising or tracking cookies.
If we ever add analytics, we will update this section first and ask for consent where required.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account and business data | While your account is active |
| Trial that is not converted to a paid plan, or a cancelled subscription | 90 days after the trial or last paid period ends, so you can come back or export your data. Then it is permanently deleted. |
| Account you ask us to delete | Deleted within 30 days of your verified request |
| Backups | Deleted data is removed from backups within 30 days after deletion from the live system |
| Billing and payment records | As long as Indian tax and accounting laws require (up to 8 years) |
| Server security logs | Up to 180 days, or longer where required by law (for example, CERT-In directions) |
| Support and grievance messages | Up to 3 years after the matter is closed |
Your own records: GST law requires you to keep business records such as challans and invoices for several years. Deleting your HZ ERP account does not change that duty. Please export your data before closing your account.
9. Your rights
Under the DPDP Act, you have the right to:
- Access: get a summary of the personal data we hold about you and how we use it.
- Correction and update: fix inaccurate or incomplete data. Most data can be edited directly in the App.
- Erasure: ask us to delete your personal data, unless we must keep it by law.
- Data export: get a copy of your business data. Reports can be downloaded as CSV from the App, and we will provide a full export on request.
- Withdraw consent: at any time, by closing your account or writing to us. This does not affect processing already done, and the Service may stop working for you.
- Nominate: name another person to exercise your rights if you die or become unable to.
- Grievance redressal: complain to our Grievance Officer (below), and then to the Data Protection Board of India if you are not satisfied.
To use any of these rights, email info@devhz.com from the email address on your account. We may need to verify your identity first. We will respond within 30 days.
If you are a customer, supplier or staff member of a shop using HZ ERP and your data is in that shop's records, please contact that shop first, since they control that data. We will help them respond to you.
10. Children
HZ ERP is a business tool for adults. You must be 18 or older to create an account. We do not knowingly process data of children. If you believe a child has given us personal data, contact us and we will delete it.
11. Grievance Officer
In line with the DPDP Act, the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020, our Grievance Officer is:
- Name: Vishal Patel
- Email: info@devhz.com
- Address: Surat, Gujarat, India
We will acknowledge your complaint within 48 hours and try to resolve it within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.
12. Changes to this policy
We may update this policy as the Service or the law changes. The “Last updated” date at the top will show when. For important changes, we will notify you by email or inside the App at least 15 days before they take effect.
13. Contact
Questions about this policy or your data: info@devhz.com. See also our Terms of Service, Refund & Cancellation Policy and Contact page.