This policy explains what personal data TabSpree handles, why we handle it, who we share it with and the choices you have. It covers this website, the TabSpree portal, and the invoice pages we run for businesses.
Who we are and our role
TabSpree is a product of UPVAN Enterprise Pvt. Ltd, 201, Pujer Complex, Subhanpura, Vadodara - 390023, which runs the website at tabspree.com and the TabSpree invoice portal. In this policy, “TabSpree”, “we” and “us” mean UPVAN Enterprise Pvt. Ltd. Under India’s Digital Personal Data Protection Act, 2023:
- for website visitors and for businesses and their users, TabSpree decides how personal data is used — we are the Data Fiduciary;
- for the invoices and customer details a business puts into TabSpree, that business is the Data Fiduciary, and TabSpree processes the data on its behalf.
If you are a customer of a business that uses TabSpree, please contact that business first about your invoices. We will help them answer you.
What we collect
Website visitors
- What you type into the demo request form: name, business name, mobile number, email address, city, business type and message. The form is delivered to us by Formspree.
- Anything you send us on WhatsApp, by phone or by email.
- Technical details our web server records for every visit, such as your IP address, browser, the page requested and the time.
Businesses and their users
- Business details: legal name, address, GSTIN, contact person, email and mobile number.
- Each user’s name, username, email address and mobile number. Passwords are stored only as one-way hashes, never in readable form.
- Two-step sign-in settings, and email preferences such as the weekly report.
- Sign-in records (time, IP address, browser, success or failure) and an audit trail of actions taken in the admin area.
Customers of a business (End Customers)
- The invoice details the business provides: name, mobile number, address, state, PIN code, invoice numbers, dates, amounts, items, serial numbers and invoice PDFs.
- When you sign in: the name and mobile number you enter, your code requests (codes are stored only in scrambled, hashed form and expire after 5 minutes), the result of the “not a robot” check, and the time, IP address and browser.
- Which invoices you view or download, and when.
- Delivery status of the codes sent to you on WhatsApp.
Payments and integrations
- Subscription payments made online are processed by Razorpay or CCAvenue. We receive the order and payment references, amount and status — never card numbers, UPI PINs or banking passwords.
- For manual payments, the reference you give us, such as a UTR or cheque number.
- For the API: each client’s label and usage. API secrets are stored only as one-way hashes.
How we use it
- To run the Service: show invoices to the right person, send one-time codes, sign people in, and let businesses manage their invoices.
- To keep it secure: detect and block abuse, limit repeated attempts, and keep logs and an audit trail.
- To bill for subscriptions and meet tax and accounting obligations.
- To send service messages: password reset links, renewal and usage notices, alerts and the weekly report a user has asked for.
- To answer demo requests and support questions.
- To understand how the Service is used, in aggregate. Platform-wide statistics show totals only, never an individual customer’s details.
We do not sell personal data, and we do not use it for advertising.
Our grounds for using data
We use personal data with your consent (for example, when you send us a demo request), to provide the Service a business has subscribed to, on a business’s instructions for its End Customers’ data, for legitimate uses allowed by law such as security and fraud prevention, and to comply with the law.
Who we share it with
- Our hosting provider, which runs the servers the Service uses.
- Meta (WhatsApp Business Platform) or the WhatsApp provider a business has chosen, to deliver one-time codes and notices.
- Google, for the reCAPTCHA check on sign-in pages and for the web fonts on this website.
- Razorpay and CCAvenue, for online payments; our email provider, for service emails; Formspree, for the website’s demo form.
- Professional advisers, and authorities where the law requires it.
- A buyer or successor, if TabSpree’s business is transferred, under the same protections.
A business can see the data of its own customers. No business can see another business’s data.
Cookies and similar technology
- The portal uses essential cookies to keep you signed in and to protect forms against forgery. They end when your session ends.
- The admin area remembers your light or dark mode choice in your browser.
- Google’s reCAPTCHA, on sign-in pages, may set its own cookies to tell people from bots.
- This website sets no cookies of its own and uses no advertising or tracking cookies.
How long we keep it
- Invoice data stays for as long as the business keeps it in its account. After a business leaves, it is deleted at the business’s request, or as set out in our Terms and Conditions.
- Encrypted exports are deleted 30 days after they are made.
- Expired one-time codes and sessions are removed regularly.
- Sign-in, code, download and message records, and the audit trail, are kept for as long as needed for security, accounting and legal purposes.
- Payment records are kept for as long as tax law requires.
- Backups are replaced on a rolling basis, within 30 days.
- Demo requests are kept for as long as needed to respond and follow up.
How we protect it
- Each business’s data is kept apart, and a customer only ever sees invoices issued to their own mobile number by that business.
- One-time codes and passwords are stored only as hashes; codes expire after 5 minutes and allow a limited number of attempts.
- Invoice PDFs are kept outside the public web and handed only to a signed-in customer.
- Every page is served over HTTPS; sign-in is protected by reCAPTCHA and account lockouts.
- Every change in the admin area is recorded, and the database is backed up every night.
Your rights
Under the law you may ask for a summary of your personal data and how it is used, ask us to correct, complete or erase it, withdraw consent you gave, nominate someone to act for you, and have a grievance addressed. Email info@tabspree.com and we will reply within the time the law requires. We may need to confirm your identity first.
For invoices issued by a business, please contact that business: it decides what happens to that data, and we will help it respond.
Children
TabSpree is meant for businesses and their customers. It is not directed at children, and we do not knowingly collect children’s data for our own purposes.
Where data is stored
Data is stored on secured servers used by our hosting provider. If we ever transfer personal data outside India, we will do so only as Indian law permits.
Changes to this policy
We may update this policy. The new version will appear on this page with its effective date, and we will tell businesses about significant changes.
Contact and Grievance Officer
Questions or complaints about privacy: email info@tabspree.com or WhatsApp +91 81606 03939. Our Grievance Officer can be reached at the same email address. By post: UPVAN Enterprise Pvt. Ltd, 201, Pujer Complex, Subhanpura, Vadodara - 390023.