Policies

This policy applies from the very first use of the platform. That includes visiting the site, creating or signing in to an account, placing a storefront order, or receiving an OTP or other message from ApxBiz. You do not need to finish signup for this notice to apply.

ApxBiz provides software for shop accounts, outlets, catalogue, billing, customers, invoices, returns, and staff roles. We are a very small entity. For this notice, ApxBiz is the data fiduciary for platform account data and the processor for shop records that a business enters while using the product.

Contact: support@apxbiz.com.

Depending on how you use ApxBiz, we may process:

• Account identity — name, email, phone, password hash, and shop name at signup.
• Authentication — one-time codes, password-reset tokens, and a signed session cookie.
• Business records — businesses, outlets, staff roles and memberships, customers (name, phone, address, ledger), orders, invoices, returns, credit notes, inventory, and related files such as pack photos or prescription images a shop uploads.
• Storefront orders — phone, name, delivery address, and cart when a customer orders from a public shop page.
• Technical logs — request metadata needed to run and secure the service (hosted on Vercel).

We use personal data only to:

• create and sign in to accounts, including OTP and password reset;
• operate inventory, billing, dues, invoices, and returns for a shop;
• apply staff roles so only authorised people see that shop’s data;
• send transactional messages you request (verification, reset links);
• secure the service, prevent abuse, and meet tax or legal duties;
• improve reliability of the product — not to sell profiles.

Sign-in and signup codes are sent by email today, using Resend (or SMTP if configured). We do not put OTPs in marketing mail.

SMS and WhatsApp are planned. When they go live, codes or transactional notices may be sent through MSG91 and/or Meta WhatsApp Business. Those channels are not used for live OTP until they are configured and approved. We will not use WhatsApp or SMS for unrelated advertising.

We use a small set of first-party cookies that are needed for the product to work. There is no cookie banner and no advertising cookies.

• apx_session — signed login session (HttpOnly).
• apx_flash — short-lived status message after a redirect.
• apx_scanner_cap — companion phone scanner capability, not a staff login.

Your browser may also store local UI preferences. Clearing cookies signs you out of the session cookie.

We do not run a third-party marketing analytics or advertising pixel on these pages. Hosting and runtime logs from Vercel may include IP address and user-agent for security and reliability. We do not sell that data.

We use trusted third-party processors to run the product and serve customers, including but not limited to hosting and content delivery, the database, email, SMS and WhatsApp, object storage, and payments if any. Examples we use now or may add later include Vercel (hosting), Neon (database), Resend (email), MSG91 and Meta (SMS / WhatsApp), and a payment provider when a shop uses a hosted pay link. We do not store card PAN or CVV.

Adding or changing a processor to provide the same kinds of service does not require a new policy before we use them. They process data only to help us operate ApxBiz, under their contracts and security controls.

ApxBiz does not sell personal data and does not share it for cross-context advertising. We share data with processors only to run the service, or when a shop user instructs us (for example, sending an invoice), or when law requires it.

OTP codes and password-reset tokens are short-lived and then invalidated. Session cookies last for the signed-in period.

Shop operational records (orders, invoices, returns, ledger) are kept while the business uses ApxBiz, and may be kept longer where Indian tax, drug, or accounting rules require a trail. Account profile data is kept until the account is closed or a valid deletion request is completed.

Access is gated by login and role. Sessions use an HttpOnly cookie. Traffic is served over HTTPS. The database and hosts apply provider-managed encryption at rest. OTPs are redacted from application logs. No safeguard is perfect; report suspected abuse to support@apxbiz.com.

If you are in India, the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 inform this notice. Subject to those laws and any legal hold, you may ask us to:

• confirm whether we process your personal data;
• correct inaccurate account details;
• erase personal data we no longer need (see How to delete your data);
• nominate someone to exercise rights on your behalf where the law allows;
• complain to our Grievance Officer.

Shop owners remain responsible for customer data they enter. We will help a shop fulfil a customer request that relates to records stored in ApxBiz.

The service is for shop operators and adult customers. We do not knowingly create accounts for children under 18. If you believe we have a child’s data, write to support@apxbiz.com and we will delete it.

Our processors may store or process data outside India. We use them only as needed to host and operate the product, under their contracts and security controls.

We may update this policy from time to time. The effective date at the top will change when we do. The current version is always at /policies. Continued use of the platform after an update means you accept the revised policy.

To request deletion of your account or personal data, email support@apxbiz.com from the email or phone registered on the account. Use the subject Data deletion request. Include the shop or business name if you have one, and what you want removed (your account, a shop workspace, or a specific customer record).

If an in-app deletion or close-account option is available on your account, you may use that instead. Today there is no self-serve wipe — email is the supported path.

This request covers personal data we hold about you, including contact data received through Meta / WhatsApp (and SMS when that channel is live). We delete or anonymise account identity (name, email, phone, login credentials) and stop using that contact for messages.

Some records must be kept where Indian tax, accounting, or other law requires a trail — for example tax invoices, returns, and similar operational documents. We will say so in our reply rather than silently keep extra profile fields. Shop owners can also ask us to close an outlet or business workspace.

We aim to acknowledge a valid request within 72 hours and to complete deletion or anonymisation within 30 days, unless a legal hold requires more time. We will confirm when the work is done.

Grievance Officer, ApxBiz, support@apxbiz.com

Privacy questions, access or correction requests, and complaints under the IT Rules / DPDP Act go to:

Grievance Officer, ApxBiz, support@apxbiz.com

Email support@apxbiz.com. We aim to acknowledge grievances promptly and resolve them within the timelines those rules require.