Privacy Notice

Last updated: 8 November 2026 · Notice version 2026-11-08

In short

  • We collect what we need to run Bilzy for you: your account, your business records, and how you pay.
  • We never sell personal data. Your customers' and patients' details are never used for ads.
  • On bilzy.in, the Meta Pixel and the Google tag run only if you say yes.
  • You can see, correct or erase your data, name someone to act for you, and complain. We answer within 90 days. Make a request

1. Who we are

Bilzy, a registered MSME at Purba Jopea, Bongaigaon, Assam, India 783384, runs the bilzy.in website (with its subdomains: the partner portal and the shops hosted on it), the Bilzy and Bilzy Pharmacy apps for Android, and the Bilzy and Bilzy Pharmacy apps for Windows.

Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the Data Fiduciary for personal data about you as our visitor, customer or partner. When your business records its own customers' or patients' details in Bilzy, your business decides what is recorded and why; we process that data only to provide the service to you. Other Bilzy apps that have their own privacy notice (such as Bilzy Restaurant and Bilzy Jyotish) are covered by that notice.

2. What we collect, and why

2.1 When you visit bilzy.in

  • Cookies that keep you signed in and remember your choices. Needed for the site to work.
  • Only with your consent: the Meta Pixel and the Google tag. They tell Meta and Google which of our pages you visited and whether you clicked a download, so we can measure our ads. They do not load until you press Accept on the privacy banner. See section 6.
  • Downloads. When you download a Windows app through bilzy.in, our server notes the time, your IP address, your browser and the page you came from, to count downloads and stop abuse.

2.2 When you write to us

The contact form opens your own email app. What you send (your name, email and message) reaches us by email and is used only to answer you.

2.3 Your Bilzy account

  • Name, mobile number, email, business name, address and GSTIN (if you give them), and your password, which is stored only as a one-way hash.
  • Your plan and your payments. Card, UPI and bank payments are handled by Razorpay; we receive the result, never your card details.
  • The devices you sign in on, to keep your account secure and let you sign a device out.
  • Why: to give you the service, bill you, support you, keep your account secure, and meet legal duties such as GST.

2.4 Your business records

  • Products, stock, invoices, purchases, expenses, and the customers' and patients' details you choose to record.
  • Why: only to run your billing, stock and accounts, and to keep them in step across your devices. We never sell them and never use them for ads.

2.5 Reading a supplier's bill for you

On Windows (including the Windows 7 version) and on the website, a photo or PDF of a purchase bill is read on your own computer; only the words are sent to our server, where an AI service (DeepSeek) arranges them into lines. A photo sent from the Bilzy phone app is read on our server by OpenAI's model. The AI marketing feature uses Google's Gemini to write text for you.

2.6 Messages we send for you

One-time passwords, and the bills and messages you choose to send, go out through our messaging providers (Fast2SMS, and Meta's WhatsApp Business service), who receive the phone number and the message.

2.7 The partner programme

  • Name, mobile number, email, password (as a hash), firm and city; the shops you refer and what they buy; and, when you ask for a payout, your UPI ID or bank account (account name and number, IFSC, bank) and PAN.
  • Why: to run your partner account, credit your commission, pay you, and meet tax rules (TDS). When you sign up you confirm you have read this notice and are 18 or older; we record when, and which notice.

2.8 In our apps

  • App usage, crash reports and device details (model, OS), to fix problems and improve the apps.
  • Ad measurement: Google (Firebase Analytics) and Meta (the Meta SDK in our Android apps) receive events such as an install, a sign-up, the first bill, plans viewed and payments made (the amount only), with your device's advertising ID and — to match an install to the ad that brought it — your own phone number, email, name and PIN code, hashed (SHA-256) on your device before they are sent. Your customers', patients' and products' details are never sent. You can reset your advertising ID or turn off ad personalisation in your phone's Settings → Google → Ads, and ask us to stop at any time (section 5).

2.9 Shops on bilzy.in

When you buy from a shop hosted on bilzy.in (shopname.bilzy.in), that shop decides what happens to your order details; Bilzy hosts the shop for it.

3. Who we share it with

We do not sell personal data. We share it only with:

  • Razorpay — payments.
  • Google and Meta — ad measurement as above (on bilzy.in only with your consent), and WhatsApp messages.
  • Fast2SMS — text and WhatsApp messages.
  • DeepSeek, OpenAI and Google — the AI features in section 2.5.
  • Our cloud server provider — hosting and backups.
  • Authorities — when the law requires it.

Some of these providers process data outside India. The DPDP Act allows this, except to countries the Government of India restricts, and we follow any such restriction.

4. How long we keep it

  • Your account and business records: while your account is open. When you ask us to delete your account, we erase it, except what the law makes us keep (such as GST and tax records), for the period the law sets.
  • Partner payout and tax records: as long as tax law requires.
  • Messages to us: as long as needed to answer you and keep a record of the answer.
  • Download records and banner choices: as long as needed for their purpose — counting downloads, stopping abuse, and showing that you gave or refused consent.

Data we no longer need for its purpose is erased.

5. Your rights

Under the DPDP Act you can:

  • Know what personal data we hold about you and how we use it, and get a summary.
  • Correct, complete or update it.
  • Erase it, unless the law makes us keep it.
  • Withdraw consent at any time, as easily as you gave it: on bilzy.in with ; in the apps, by asking us or deleting your account. What was done before you withdrew stays lawful.
  • Name a nominee to use these rights for you if you die or cannot act.
  • Complain to us — and, if you are not satisfied with our answer, to the Data Protection Board of India.

How: make a request on bilzy.in, or write to or call the Grievance Officer (section 9). We may first confirm it is you — for example with a one-time code to your registered phone or email. We answer within 90 days at the most.

6. Cookies and ad measurement on bilzy.in

  • Essential: signing in, and remembering your privacy choice. Always on; the site needs them.
  • Ad measurement: the Meta Pixel and the Google tag — only after you press Accept on the privacy banner, never if you press Reject.

Change your choice at any time with at the foot of every page. Taking it back removes their cookies from this site and stops them from loading.

7. Children

Bilzy is for businesses and adults. We do not knowingly collect personal data from anyone under 18, and the partner sign-up asks you to confirm you are 18 or older. If a child's data has reached us, tell us and we will erase it.

8. Keeping it safe, and if something goes wrong

We use encrypted connections (HTTPS/TLS), store passwords only as hashes, limit access to the people who need it, and back up regularly. If a breach affects your personal data, we will tell you without delay — what happened, what it may mean for you, what we have done, and whom to contact — and report it to the Data Protection Board as the law requires.

9. Grievance Officer

For questions about your personal data, requests and complaints:

We answer within 90 days at the most.

10. Changes to this notice

We post any change here with a new date and version. If a change needs your consent again — such as the ad measurement on bilzy.in — we ask again.