Privacy Policy

Last updated: May 5, 2026

1. Introduction

Welcome to Nijam (nijam.co) - a multi-entity invoicing, compliance, and financial operations platform. We serve businesses in both India and the United States, providing GST-compliant invoicing, sales tax automation, AI-powered receipt scanning, and more.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our platform, website, and related services (collectively, the “Services”). By accessing or using Nijam, you acknowledge that you have read and understood this policy.

2. Information We Collect

Account Data

When you register for Nijam, we collect your full name, email address, phone number, business name, business registration details (GSTIN, EIN, state registration numbers), and billing address. For identity verification purposes, we may also collect Aadhaar-based eSign consent tokens (India) or EIN verification data (USA).

Invoicing & Financial Data

This includes invoices you create and receive, line items, tax calculations (GST/sales tax), HSN/SAC codes, payment records, client and vendor information, bank account details for reconciliation, receipts uploaded for AI scanning, and any documents attached to transactions.

Usage Data

We automatically collect information about how you interact with the Services, including pages visited, features used, actions taken, timestamps, referral sources, and search queries within the platform.

Device & Technical Data

We collect your IP address, browser type and version, operating system, device identifiers, screen resolution, and language preferences. This data helps us maintain security, optimize performance, and troubleshoot issues.

3. How We Use Your Information

  • a.Service Delivery: To create and manage your account, generate invoices, process payments, calculate taxes, produce compliance reports, and deliver the core functionality of the platform.
  • b.Tax & Regulatory Compliance: To compute GST (CGST, SGST, IGST), US sales tax at the state/county/city level, generate GSTR-1 reports, track economic nexus thresholds, and flag 1099-NEC obligations.
  • c.Security & Fraud Prevention: To detect unauthorized access, monitor for suspicious activity, enforce role-based access controls, and maintain immutable audit trails for all financial transactions.
  • d.Communications: To send transactional emails (invoice delivery, payment confirmations, filing reminders), security alerts, and service announcements. We do not send unsolicited marketing emails.
  • e.AI-Powered Features: To process receipts and documents through our Nijam AI for line-item extraction, tax ID validation, HSN code suggestion, and ITC/deduction classification.
  • f.Platform Improvement: To analyze usage patterns (in aggregate), diagnose technical issues, improve accuracy of tax calculations, and develop new features.

4. Data Storage & Security

We take the security of your financial data seriously. Our infrastructure implements the following safeguards:

  • Encryption at Rest & in Transit: All data is encrypted using AES-256 at rest and TLS 1.2+ for all data in transit.
  • Database: Your data is stored in Supabase-managed PostgreSQL databases with automated backups, point-in-time recovery, and disaster recovery capabilities.
  • Tenant Isolation:Each organization’s data is logically isolated using row-level security (RLS) policies. No organization can access another’s data, even within shared infrastructure.
  • Access Controls: Role-based access control (RBAC) ensures that users only see data appropriate to their role (CEO, CFO, Accountant, CA). Sensitive PII is masked for junior roles.
  • Audit Trails: Every financial record change is logged with immutable audit trails, including who made the change, when, and what was modified.

5. Data Sharing & Third Parties

We do not sell your personal information. We share data only with the following categories of service providers, strictly to operate the platform:

  • Payment Processors: Razorpay (India) and Stripe (USA) process payment transactions on your behalf. They receive only the data necessary to complete the transaction.
  • Email Delivery: Resend handles transactional email delivery (invoices, payment confirmations, alerts). They process recipient email addresses and email content.
  • AI Processing: Receipt images and documents uploaded for AI scanning are processed by our AI models for data extraction. This data is not used to train third-party models and is not retained beyond the processing session.
  • Infrastructure: Supabase (database hosting), Vercel (application hosting), and related cloud providers process data as part of service delivery.
  • Legal Requirements: We may disclose information if required by law, regulation, legal process, or enforceable governmental request.

6. India-Specific Rights (DPDPA 2023)

If you are a user based in India, the Digital Personal Data Protection Act, 2023 (DPDPA) grants you the following rights as a Data Principal:

  • Right to Access: You may request confirmation of whether we process your personal data and obtain a summary of the data and processing activities.
  • Right to Correction & Erasure: You may request correction of inaccurate data or erasure of data that is no longer necessary for the purpose it was collected.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
  • Right to Grievance Redressal: You may raise grievances with our designated Grievance Officer (see Contact Information below) or escalate to the Data Protection Board of India.
  • Consent Management: We obtain clear, informed consent before collecting personal data. Consent requests are presented in plain language and are specific to the purpose of processing.
  • Data Localization: Financial data of Indian entities is stored on servers within India or in jurisdictions that provide adequate levels of data protection, in compliance with applicable regulations.

Grievance Officer

For DPDPA-related queries and grievances, contact our Grievance Officer at support@nijam.co. We will acknowledge your request within 48 hours and resolve it within 30 days.

7. USA-Specific Rights (CCPA & State Privacy Laws)

If you are a resident of the United States, applicable state privacy laws - including the California Consumer Privacy Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), and Colorado Privacy Act (CPA) - may provide you with the following rights:

  • Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected, the sources of collection, the purposes of processing, and the categories of third parties with whom we share data.
  • Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions (e.g., data required for legal compliance or completing a transaction).
  • Right to Opt-Out of Sale: We do not sell personal information. If this ever changes, we will provide a clear opt-out mechanism.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. You will receive equal service and pricing regardless of whether you exercise these rights.
  • Right to Correct: You may request correction of inaccurate personal information that we maintain about you.

California Residents:Under the CCPA/CPRA, you may also designate an authorized agent to make requests on your behalf. We may require verification of your identity and the agent’s authority before processing such requests.

Virginia & Colorado Residents: You may also appeal a denial of your privacy request by contacting us at support@nijam.co.

8. Cookies & Tracking

  • Session Cookies: We use strictly necessary session cookies to maintain your authentication state and preferences while you use the platform. These cookies expire when you close your browser or after a defined session timeout.
  • No Third-Party Trackers: We do not use third-party advertising trackers, social media pixels, or analytics cookies that track you across other websites.
  • Cloudflare Turnstile:We use Cloudflare Turnstile on certain forms (registration, login) to prevent automated abuse. Turnstile is a privacy-preserving CAPTCHA alternative that does not track users across websites. It is subject to Cloudflare’s Privacy Policy.

9. Children’s Privacy

Nijam is a business-to-business financial platform and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 13 (as defined by COPPA) or minors under 18. If we become aware that we have inadvertently collected data from a minor, we will promptly delete it. If you believe a minor has provided us with personal information, please contact us at support@nijam.co.

10. Data Retention

We retain your data for as long as your account is active and as necessary to fulfill the purposes outlined in this policy. Specific retention periods include:

  • Financial Records: Invoices, tax filings, and transaction records are retained for a minimum of 8 years from the date of creation, in compliance with Indian (Income Tax Act, GST Act) and US (IRS) record-keeping requirements.
  • Account Data: Retained for the duration of your active account plus 30 days after account closure to allow for reactivation.
  • Usage & Device Data: Retained for up to 24 months for analytics and security purposes, then anonymized or deleted.
  • AI-Processed Documents: Uploaded receipts and scanned documents are retained only as long as needed to deliver extraction results and are purged from processing pipelines within 30 days.

Upon account deletion request, we will remove or anonymize your personal data within 30 days, except where retention is required by law. You may request data export before deletion.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email (sent to the address associated with your account) and by posting a prominent notice on the platform at least 15 days before the changes take effect. The “Last updated” date at the top of this page indicates when the policy was most recently revised.

12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, you may contact us at:

Nijam

Email: support@nijam.co

Website: nijam.co

We aim to respond to all privacy-related inquiries within 48 hours and resolve requests within 30 days.

13. Google User Data & Gmail Integration

Scope of Access

When you choose to connect your Gmail account to Nijam, we request access to the gmail.readonly scope. This allows Nijam to read (but not send, modify, or delete) emails in your Gmail inbox. We access only emails that appear to contain invoices, bills, receipts, or payment-related communications, identified by subject line patterns and sender characteristics.

How We Use Gmail Data

Gmail data accessed through this integration is used exclusively to:

  • Detect incoming invoices, bills, and receipts and surface them in your Nijam Finance Inbox
  • Extract invoice metadata (vendor name, amount, due date, invoice number) to pre-populate payable records
  • Match incoming payments against outstanding invoices in your Nijam account

We do not use Gmail data for any other purpose.

Limited Use Policy Compliance

Our use of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We do not use Gmail data to serve advertisements
  • We do not use Gmail data for profiling or behavioural targeting
  • We do not sell, transfer, or share Gmail data with third parties except as required to operate the Gmail integration feature (described in this section)
  • We do not allow humans to read your Gmail data unless you have explicitly given us permission, it is necessary for security purposes, or we are required to do so by law

Data Storage

We do not store raw email content (email body text) on our servers. We store only structured metadata extracted from emails, specifically: sender name, sender email address, email subject, detected invoice amount, detected due date, and detected invoice or reference number. This extracted metadata is stored as part of your Nijam account data and is subject to the same security and retention policies described in this Privacy Policy.

AI Processing of Gmail Data

Extracted email metadata (not raw email body text) may be processed by AI models to improve invoice detection accuracy and automate data entry. This processing is performed under data processing agreements that prohibit the use of your data for AI model training. Raw email body content is processed transiently in memory and is never stored or transmitted to AI providers.

Data Retention

Extracted invoice metadata from Gmail is retained as part of your Nijam account for as long as your account is active. If you disconnect your Gmail account from Nijam, we will stop accessing new emails immediately. Previously extracted metadata remains in your account unless you delete it.

Revoking Access

You may disconnect your Gmail account from Nijam at any time from Settings → Integrations → Gmail. You may also revoke Nijam’s access directly from your Google Account permissions page at https://myaccount.google.com/permissions. Revoking access immediately stops all Gmail data access.

Contact

For questions about our use of Gmail data, contact us at support@nijam.co.

© 2026 Nijam. All rights reserved.