Privacy Policy

Challan Chopadi is a job-work register for textile and embroidery workshops. This page explains what it stores, where that data lives, who can reach it, and how to get it deleted. It is written to be read, not to be survived.

Who this is

Challan Chopadi is operated from Gujarat, India by the individual reachable at hello@challanchopadi.com. In this policy, “we” means that operator and “you” means the person using the service.

What we collect

Your account

• Email address. Required. It identifies your account and is where an invite to a shared register is sent.
• Name. So your co-workers can tell who did what.
• Password. If you sign up with a password, we store a bcrypt hash of it, never the password itself. We cannot read it, and neither can anyone who obtains the database.
• Google account details. If you sign in with Google, we receive your email address, name and profile picture from Google, and store the tokens that let the sign-in work. Nothing else. We do not request access to your Gmail, Drive, contacts or any other Google service.

What you type into the register

Everything you enter to run your workshop: veparis and their phone numbers and notes, challans, dates received and promised, item descriptions and quantities, which carbon copies have come back, delivery records, and payment status and amounts.

What the servers record

Our hosting and database providers keep standard operational logs — IP address, browser type, time of request, error traces — for security and debugging. We do not build profiles from these and do not link them to your workshop records.

What we do not do

The one thing that counts

We do count page views, using Vercel Web Analytics. It is the only measurement of any kind on this site, and it is worth being exact about it rather than letting the section above imply something broader than the truth.

• It sets no cookie and stores nothing in your browser.
• What it records is which page was opened, which page referred you, and coarse facts about the device — country, browser, operating system, phone or desktop.
• How it counts a visitor is a one-way hash of your IP address and browser details, made with a secret that is thrown away and replaced every day. Your IP address itself is not stored. The hash cannot be turned back into it, cannot be matched to you again tomorrow, and cannot be matched to you on any other website.
• Nothing from your register reaches it. It sees the address of the page, not what is on it — no vepari, no challan, no amount. Where an address itself carries something private, we take it out before anything is sent: an invite link contains a token that would let someone join your register, so it is replaced with /invite/[token] first, in the page and in the query string both.
• If you block it, nothing breaks. The script is loaded after the page is already working, and a blocker stopping it costs you nothing at all.

We use it for one thing: to know whether anyone is finding the site, and from where. If that ever stops being true, this page changes before the code does.

The people you record

When you enter a vepari’s name and phone number, you are entering somebody else’s personal information. Under India’s Digital Personal Data Protection Act, 2023, you are the Data Fiduciary for that information and we are your Data Processor — we hold it and process it on your instructions, and for no purpose of our own.

That means it is your responsibility to have a lawful basis for recording those details, to enter only what your business genuinely needs, and to respond if one of those people asks you what you hold about them. If you need something corrected or removed and cannot do it from inside the app, write to us and we will help.

Where your data lives

• Database — Supabase, on servers in the Mumbai region (ap-south-1). Your records do not leave India in the ordinary course of operation.
• Application hosting — Vercel, with the application configured to run in the Mumbai region (bom1).
• Google receives nothing from us. It is involved only if you choose to sign in with Google, in which case Google knows you signed in, exactly as it would for any site.

These providers are our sub-processors. They can technically access the infrastructure your data sits on, and are bound by their own agreements and security practices. We do not engage any other third party that can reach your data.

Who can see your register

Your workspace is visible only to you and to people you invite into it. Only the person who created the workspace can invite or remove someone. There is no public sharing, no cross-workspace visibility, and no way for another customer to reach your records.

We do not read your business records. We may need to access the database to fix a fault or respond to a support request from you, and we will keep that to the minimum the problem requires. We will disclose data if compelled by a valid legal order, and will tell you unless we are prohibited from doing so.

Cookies and local storage

• A session cookie that keeps you signed in. Strictly necessary — the app cannot work without it. It is not used for tracking.
• A language preference — a cookie recording whether you chose English or Gujarati, so the site opens in the language you picked. It holds that one word and nothing else.
• A theme preference saved in your browser’s local storage, so the app opens in light or dark as you left it. It never reaches our servers.

There are no advertising cookies and no third-party cookies. The page-view counting described above sets no cookie either.

How long we keep it

Your records are kept for as long as your account exists, because a challan register is a historical document and is of no use with the history removed. Delete your account and your workspace and everything in it — challans, veparis, items, copies, payments — is removed from the live database. Encrypted backups held by our providers roll off on their own schedule, typically within 30 days.

Your rights

You can see and correct most of your data directly inside the app. Beyond that, you may ask us to give you a copy of your data, correct it, delete your account entirely, or explain anything on this page. Write to hello@challanchopadi.com and we will respond within 30 days. You do not need to give a reason to have your account deleted.

Security

Traffic is encrypted in transit with HTTPS. Passwords are stored only as bcrypt hashes. Every request is authorised on the server before it can reach data, and a request is scoped to the workspace the signed-in user belongs to.

We will not tell you this makes anything unbreakable, because no one can honestly say that. If we ever discover a breach that affects your data, we will tell you and the relevant authority promptly rather than quietly.

Children

This is a tool for running a business. It is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

If this policy changes, the date at the top changes with it. If a change materially affects how your data is handled, we will tell account holders by email rather than relying on you to re-read this page.