VANINXT MICRO Privacy Policy

1. Who is responsible

Zertical Private Limited is the Data Fiduciary for account, authentication, security, subscription, support and legal-administration data. For business content entered by a customer company, that company determines the purpose and means of processing and Zertical Private Limited acts as its processor under the Data Processing Addendum.

2. Personal data we process

• Username, company, role, account status, email when supplied, salted password hash, sign-in times and versioned legal acceptance.
• Session, request, security-event, hashed IP and hashed browser/device evidence, and a hashed device key when the phone app keeps a shop signed in.
• When you choose to sign in with Google or Apple: the account identifier and verified email that provider shares.
• Business records entered by authorised company users, including billing, purchasing, stock, customer and supplier records.
• Reports, exports, support, grievance and lifecycle requests.
• When an authorised user chooses document reading: the selected PDF or image, text recognised in that user’s browser, corrected template values, and review evidence.
• When a shop turns on Munimji, the optional AI helper: what a user types or says to it, any supplier’s purchase bill (photo or PDF) a user gives it to read, and the shop records needed to answer (see “Munimji, the optional AI helper” below).

We do not store plaintext passwords. VANINXT MICRO does not sell personal data. Generative AI is used only in Munimji, and only for shops that turn it on.

3. Purposes

We process the minimum data reasonably required to authenticate users, enforce tenant isolation and purchased seats, provide billing and inventory functions, create requested reports, run the Munimji AI helper for shops that turn it on, preserve security evidence, provide support, prevent misuse, recover service, administer subscriptions, and meet legal obligations.

Munimji, the optional AI helper

Munimji is off until a Company Admin of the shop reads a short notice and turns it on. It can be turned off again at any time.

When a user asks Munimji something, the following are sent to an AI model to understand the request and prepare the answer: the message; the last few messages of the same conversation; a few context lines (today’s date, whether the shop is GST-registered, the helper’s name and the app language); and the shop records needed to answer it, such as item, customer and supplier names, prices, stock and amounts. Saved phone numbers, GSTINs, addresses and email addresses are not sent unless the user types or says them in the message, or they are printed on a bill the user gives Munimji to read. If the user speaks, the phone’s or browser’s own speech service (often Google’s) hears the speech and turns it into text under its maker’s privacy terms; we receive only the text, never the audio.

Reading purchase bills. A user can give Munimji a photo or PDF of a supplier’s purchase bill, so that it prepares a purchase preview with the items, quantities, rates and tax. Everything printed on the bill is sent with it, which can include the supplier’s and the shop’s names, GSTINs, addresses and phone numbers; the shop’s name is also sent, so that the AI can tell the buyer from the supplier. A photo is made smaller on the device first. The device takes the text out of a PDF itself; a PDF without text (a scan) is sent as pictures of at most four pages. Bills are never sent to Cloudflare Workers AI. A bill usually goes first to DeepSeek in China, as the photo, the text of the PDF or the page pictures. Anthropic in the United States reads it first, as the photo, the page pictures or the PDF file, at times when DeepSeek charges more and always for a PDF without text. A bill may be sent to both services: the second is asked when the first one’s reading does not pass our checks (for example, the figures do not add up) or the first cannot be reached. If only one of the two services is switched on, it reads every bill. We do not keep the bill photo or PDF on our servers: it is used only while the bill is being read. We keep the purchase preview made from it (the supplier’s name, GSTIN and phone, the bill number and date, and the lines) like any other preview, and, if a user changes that preview by hand, the bill’s file name in the edit record. Give Munimji only purchase bills, not other documents.

For messages, Munimji uses up to three AI services. Each request goes to whichever one answers it, in an order that depends on the day of the week (India time), which services are switched on, how busy they are and, on Saturdays and Sundays, whether our daily Cloudflare allowance is used up. The same content is sent to whichever service answers:

• Cloudflare Workers AI (an open AI model run by Cloudflare) answers first. On Saturdays and Sundays it is left out once our daily Cloudflare allowance is used up. It is never used for purchase bills. Cloudflare states that it does not use this content to train AI models and does not keep it after answering, except in limited safety or legal cases.
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China), once we switch it on, answers messages only on Saturdays and Sundays (India time): when Cloudflare cannot answer, and first once the daily Cloudflare allowance is used up. It also reads purchase bills on any day, as described above. DeepSeek processes and stores what it receives in China and keeps it for as long as our DeepSeek account exists. Its terms allow it to use that data to train and improve its AI models. Deleting a MICRO account does not delete what DeepSeek already holds.
• Anthropic (Claude, United States), once we switch it on, is the back-up when the services before it cannot answer: second from Monday to Friday, third on Saturdays and Sundays. Its business terms do not allow it to train its models on the data we send.

So a Munimji request, including the customer and supplier names and amounts in it, and any bill it reads, may be processed outside India, including in China and the United States. This applies only to shops that turn Munimji on. A shop that does not want this should leave Munimji off, or turn it off. We do not use shop records to train AI models ourselves.

We do not keep the conversation on our servers, except the words that led to a preview the user then changes by hand (see below). The conversation stays in the user’s browser tab or app screen until that is closed. We do keep the following, as part of the shop’s account:

• the Munimji setting and the name the shop gives it;
• who accepted its notice, and the notice version;
• the credit balance and credit history;
• the previews Munimji prepares (an unsaved preview expires after 30 minutes);
• daily usage counts;
• when a user changes a preview by hand with the Edit button: the words that led to that preview, which AI prepared it, and each change with its old and new value (for example a quantity, price, item or customer name). The VANINXT MICRO team reads these records, as counts and examples, only to find where Munimji makes mistakes and improve it. They are not sent to any AI service, and they are deleted with a workspace reset or with the account.

Munimji never changes business records by itself: a record is saved only when the user checks the preview and taps Save. AI answers can be wrong, so check every preview and figure. Do not type passwords, PINs or bank or card details to Munimji.

Email verification and signup

When you request signup, your permanent email address receives a short-lived verification code through Cloudflare Email Sending. Known disposable email services are blocked. The application stores keyed hashes of codes and verification identifiers, limits requests and attempts, and does not log codes or email bodies. Email preview storage is disabled in the sending service. A code verifies control of an email address, not government identity or GST registration. Signup records include your business profile, account, legal acceptance and free-trial dates, including any free access we choose to extend. Requesting a verification code does not subscribe you to marketing. If you choose Continue with Google or Continue with Apple, Google or Apple confirms your identity under its own privacy policy and gives us a stable account identifier, your email address only when it is verified (Apple may give a private relay address) and your name if you share it. We never receive your Google or Apple password. We keep the identifier to link that sign-in to your MICRO account; for Sign in with Apple we may also keep a token used only to revoke the app's access when you delete your account. A username and password remain available, and deleting your account removes these links. If the plan is bought through Apple In-App Purchase in the iPhone app, Apple processes the payment under its own privacy policy; VANINXT MICRO receives only Apple's signed purchase identifiers, the plan bought and its period dates, never card or bank details.

4. Sources and sharing

Data comes from the individual, their authorised company, and technical requests made to the service. Access is restricted to the customer company and authorised operational personnel. Infrastructure providers are listed in the Subprocessor Register. We may disclose data where law requires it.

5. Security and retention

Controls include salted password hashing with a server-side secret, one active session per user, an eight-hour absolute session limit, three-minute unexpected-closure recovery, server-side company routing, private object storage and security-relevant audit metadata. The phone app can keep a shop signed in until the user signs out: it keeps a random device key in the app's private storage and asks for Face ID, Touch ID, fingerprint or face unlock, or the phone's screen lock before using it; we store only a hash of the key, and it stops working after sign-out, a password change or 90 days without use. See Retention and Security for current lifecycle details and the pre-production archive limitation.

6. Your rights

Subject to applicable law, a person may ask for an access summary, correction, erasure, grievance resolution, withdrawal of consent, or nomination. Send the request to the Grievance Officer using the contact below. Withdrawing consent is as easy as sending that request, but it may require closure of the affected account where processing is necessary to provide the service.

7. Complaints and changes

We first provide an internal grievance route. A person may also use the statutory complaint route when available under applicable law. Material policy changes receive a new version and require fresh sign-in acceptance when appropriate.