Terms and Conditions

TERMS AND CONDITIONS, AND NOTICE OF PERSONAL DATA PROCESSING

Ledgior, operated by Dunime Technologies Version 1.0 · reviewed by counsel · in force from 25 September 2026 · supersedes 0.2-UNREVIEWED

Each client accepts these terms once, at their first sign-in to Ledgior, together with setting their own password. The text from section 1 onward is the 0.2 notice exactly as counsel reviewed it; only this heading changed. Documents are read by an AI model running in India (Google Vertex AI, Mumbai region), so the separate consent in section 4 for a model running outside India is not asked while that stays true.

---

1. WHO WE ARE

Dunime Technologies operates Ledgior, a bookkeeping and GST compliance service delivered over WhatsApp.

**For your own personal data — your name, PAN, address, WhatsApp number, and the bank statements in your own name — we are the Data Fiduciary** under the Digital Personal Data Protection Act, 2023. That means we decide why this data is collected and what it is used for, and we answer for it, including to the Data Protection Board of India if it ever comes to that.

For information about your own customers and suppliers that appears on the invoices and bills you send us, **you are the Data Fiduciary and we are your Data Processor.** We act only on your instruction, under the engagement letter, and never decide on our own what that data is used for. §2 below says more about this line.

DPDP-COMPLIANCE.md, a document we keep alongside this one, maps every obligation the Act places on us against what is actually built, honestly marking what is done, what is a standing commitment, and what remains open. It is not shown to you as routine reading — it exists so that nothing in this notice is asserted without something real behind it.

For questions, corrections, or complaints about your personal data, contact our Grievance Officer:

Name	Manogya Pandey
Email	contact@dunime.com
Postal address	S-46, 3rd Floor, Meenakshi Garden, New Delhi, Delhi, India – 110018
Response time	Within 30 days of receiving your request

---

2. WHAT THIS NOTICE COVERS, AND WHAT IT DOES NOT

This notice is about your personal data — you, the proprietor.

Your books also contain information about **your customers and your suppliers**: names, addresses, GST numbers on the invoices you send us. For that information you are the one who decides why it is held and what is done with it, and we act only on your instruction. Your engagement letter, not this notice, governs that.

Most of it is not personal data at all. A company's GST number is information about a company. A sole proprietor's name and PAN is information about a person, and we treat it as such.

---

3. WHAT WE COLLECT

Only what the work requires.

What	Why we have it
Your name, PAN, address, GST registration	Every invoice we raise for you carries them; GST law requires it
Your WhatsApp number	It is how the service works
Your bank statements	To match receipts and payments against your invoices and bills
Invoices and bills you send us	They are your books
Your customers' and suppliers' details, as they appear on those documents	An invoice must name its parties
What you tell us in conversation	To answer you, and to know what you asked for

What we do not collect: your GST portal password does not sit in this system. Anything of that kind is held in a separate encrypted vault, read only at the moment of use, and every access is recorded.

---

4. WHY WE PROCESS IT

Purpose	Is it optional?
Maintaining your books of account	No — it is the service
Preparing and filing your GST returns, and operating IMS	No
Preparing your income-tax computations	No
Keeping records for the period the law requires	No — see §6
Checking whether a supplier's GST registration is active and filing	Yes
Improving how the software classifies documents, using de-identified outcomes only	Yes
Sending a document image to an AI model that may run outside India	Yes — and it is asked separately

The last one is genuinely separate. Sending your documents outside India is a transfer, not an internal step, and consenting to bookkeeping is not consenting to that. You may decline it and still receive the service; some documents will then take longer, because a person reads them.

---

5. WHAT WE DO NOT DO

• We do not sell your data. To anyone, for any purpose.
• We do not message your customers or your suppliers. If you need an

invoice sent to a customer, we return it to you and you forward it. Your customer never hears from us.

• We do not use your data to train a general-purpose AI model. Where we

improve our own classification, it is from de-identified outcomes — what category a document turned out to be, not whose document it was.

• **We do not decide anything about you automatically that carries a legal

consequence.** Every return is read and signed by a person.

---

6. HOW LONG WE KEEP IT — AND THE ONE THING WITHDRAWAL DOES NOT UNDO

Read this part. It is the only place where the law overrides your choice, and it is better to know now than to discover it later.

Section 35 of the CGST Act, read with Rule 56, requires books of account to be kept for approximately 72 months from the due date of the annual return. The Income-tax Act imposes its own periods.

So:

• You may withdraw consent at any time, and we will stop the optional

processing in §4 immediately — the vendor checks, the de-identified improvement, and any transfer outside India.

• We cannot delete your books on request while that statutory period runs.

Not because we want them, but because keeping them is a legal obligation that binds us the same way it binds you. Deleting them would expose you, not protect you.

• When the period ends, they go.

If you leave, we will give you your data in a portable form and stop processing it for anything except the retention obligation.

---

7. YOUR RIGHTS

Under the Digital Personal Data Protection Act, 2023:

Right	What it means here
Access	Ask what we hold about you and what we have done with it
Correction	Have anything wrong corrected, and anything incomplete completed
Erasure	Have it deleted, subject to §6
Grievance redressal	Complain to our Grievance Officer, who must respond within 30 days
Nominate	Name someone to exercise these rights if you die or become incapacitated
Withdraw consent	At any time, as easily as you gave it

To exercise any of them, message us on WhatsApp or email the Grievance Officer. We do not require a form.

If we do not resolve your complaint, you may take it to the **Data Protection Board of India**. Coming to us first is not a precondition we impose; it is just usually faster.

---

8. WHERE YOUR DATA LIVES

On Amazon Web Services, in AWS's Mumbai region (ap-south-1) — chosen specifically to keep your data in India, not for any other reason. We do not operate our own data centre; AWS does, and India is where that infrastructure physically sits for this service.

The single exception is the AI model that reads document images, which may run outside India. That is the separate consent in §4, and if you decline it your documents stay in India.

We do not hold, and do not claim to hold, any third-party security certification (such as ISO 27001). If that changes, this notice will say so; until it does, assume it has not.

---

9. SECURITY

Every client's data is isolated at the database level, not by application code — the database itself refuses to return one client's rows to a query made on behalf of another. Access is logged. Credentials are held outside the application and never written into it.

If there is a breach, we will tell you and the Data Protection Board. That is an obligation, not a courtesy, and we would rather you heard it from us.

---

10. IF THIS NOTICE CHANGES

We publish a new version. We do not edit this one — what you consented to on a given day is a fact about that day, and the system stores which version it was.

For a change that widens what we do with your data, we ask again. We do not treat silence as agreement.

---