Privacy policy

Last updated 3 November 2026

Kshitij ERP is business software made by Kshitij Infotech, in business since 1990. This policy explains what personal data we handle when you use kshitijerp.com, sign in to Kshitij ERP, register for a demo, or receive a WhatsApp or email message sent through it — and what you can ask us to do about it. It is written for India's Digital Personal Data Protection Act, 2023.

Who decides what is recorded

Businesses use Kshitij ERP to run their stores: billing, stock, accounts, service and staff. What a business records about its own customers, suppliers and staff is that business's decision — it is the Data Fiduciary for those records, and we process them on its behalf, only to provide the service. If you are a customer of a business that uses Kshitij ERP, that business is the first place to ask about your data; we will help it answer you.

For the people who register for a demo, sign in, or write to us, we — Kshitij Infotech — are the Data Fiduciary.

What we collect

When a business records you

Name, mobile number, email address, addresses, GSTIN and PAN, and what was bought, sold, repaired or paid — on the business's invoices, orders and accounts.
Bank account and UPI details, if the business records them for payments.
For staff: employment and contact details, and the documents the business keeps on file.

When you sign in

Your email or mobile number, a password stored only as a salted scrypt hash (never the password itself), and, if you turn it on, an authenticator secret.
A record of each sign-in by code (which channel the code went to), and the network address a sign-in attempt came from, used to stop password guessing.
An audit trail of the changes you make to records, which accounting law requires the software to keep.

When you register for a demo

Your name, business name, city, kind of business, email, mobile, any note you add, your consent, and the network address the form came from. We confirm the email and mobile with a one-time code.

When you visit

Our web server logs the time, page address, response and network address of each request — not your browser's details.
No advertising or analytics trackers. No third-party cookies are set by Kshitij ERP.

Why we use it

To provide Kshitij ERP to the business that records the data.
To sign you in, keep the account secure, and stop misuse.
To send the messages the service needs — verification codes, and the documents and notices a business chooses to send.
To arrange and give the demo you asked for.
To meet legal duties such as keeping books and audit trails.

We do not sell personal data, and we do not use it for advertising.

WhatsApp messages

When a business turns on WhatsApp, Kshitij ERP sends messages through Meta's WhatsApp Business Platform (the Cloud API): verification codes, and — if the business chooses — its documents and notices. Meta receives the recipient's number and the message, and handles them under its own terms and privacy policy. We keep a log of each send: the number, the approved template used, the delivery status and Meta's message reference.

A business may also send its offers over WhatsApp — but only to customers it has recorded as having agreed to receive them, with when and how that agreement was given; customers who have not agreed, or who have said no, are left out. Kshitij Infotech does not message a business's customers for its own purposes.

To stop WhatsApp messages from a business, reply STOP to any of its messages (UNSUBSCRIBE also works). If the number you reply from is on that business's records as a customer or supplier, Kshitij ERP records that you said no, and the business can no longer send you WhatsApp messages through it — not its offers, and not its receipts or reminders either — until you reply START or tell the business you agree again. You can also ask the business, or block its number in WhatsApp.

On the demo at kshitijerp.com, messages can only be sent to the Kshitij team's own number and email addresses — never to the sample customers in it.

Who else receives it

Only the service providers each feature needs:

Meta (WhatsApp Cloud API) — messages, when the business turns WhatsApp on.
The business's own email provider — email messages go through the mail server the business sets up.
OpenStreetMap — looking up a place, and the map shown when a location is pinned; a business may choose Google's geocoding instead.
A GST Suvidha Provider and the government's e-invoice and e-way bill systems — invoice details, only when the business turns e-invoicing on.
Our hosting provider (host.co.in), where the service runs, and Microsoft OneDrive, where encrypted backups are kept.
Demo registrations are handled by our own site, kshitij.net; the confirmation codes go out by our email provider (Gmail) and an SMS provider (APITxT).

We also disclose data where the law requires it, for example to a tax authority or a court.

How it is protected

Every connection is encrypted (HTTPS).
Each business's data is walled off from every other's by the database itself, not only by the application.
Addresses, bank account and UPI details, staff personal details, notes, reference numbers and authenticator secrets are encrypted at rest (AES-256-GCM).
Backups are encrypted before they leave the server, with a key the server itself does not hold.

How long it is kept

A business's records: while it uses Kshitij ERP, and as long as the law requires it to keep its books (at least eight years for accounts, and GST records for the period GST law sets).
The audit trail: it cannot be edited or deleted, and is kept at least as long as the books it describes.
Notifications: 90 days. Sign-in sessions: 24 hours. Sign-in codes: 10 minutes. Web server and system logs: 30 days.
Backups, encrypted and off the server: the last 7 nightly copies, one a week for 4 weeks and one a month for 12 months; restore points made during an upgrade: 48 hours.
Demo registrations: until you ask us to delete them. The one-time codes: 2 days.

Cookies

Kshitij ERP sets only the cookies it needs to sign you in: a session cookie that lasts 24 hours, and a short-lived one (10 minutes) while a sign-in code is being checked. Your browser also remembers display choices — theme, density, the menu layout and the last few pages you opened — on your own device.

Your rights

Under the Digital Personal Data Protection Act, 2023, you may ask us:

for a summary of the personal data we hold about you and how it is used;
to correct, complete or update it;
to erase it, where the law does not require it to be kept — see how to have data deleted;
to withdraw a consent you gave, such as for a demo call — or, for a business's WhatsApp messages, by replying STOP;
to name someone to exercise these rights for you.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Children

Kshitij ERP is for businesses. We do not knowingly collect data from anyone under 18 except where a business records a customer in the ordinary course of a sale.

Changes

When this policy changes, we update it here and change the date at the top.

Contact and grievances

Grievance Officer, Kshitij Infotech
Email: privacy@kshitij.net
Phone: +91 97007 96005
We acknowledge every request within 7 days and answer it within 30.