Privacy Policy

This Privacy Policy explains how AVS Corporations (“AVS”, “we”, “us”, or “our”) collects, uses, stores, and protects information when you use the AVS Invoice application available at invoice.avscorp.in (the “Service”). By creating an account or using the Service, you agree to this Policy.

1. Who we are

AVS Corporations is a sole proprietorship registered in India, with its principal place of business at:

For all privacy, data protection, and grievance queries under the Digital Personal Data Protection Act, 2023, write to admin@avscorp.in.

2. Information we collect

We collect only what we need to run the Service:

• Account information. Name, email address, password hash, phone number (optional), and the organization details you enter (business name, GSTIN, address, logo).
• Business records you create. Invoices, quotes, bills, payments, customers, vendors, items, stock movements, expenses, and related accounting data you enter into the Service.
• Google account data (only if you choose to connect Google Drive backups): your Google email address, an OAuth refresh token, and metadata about backup files this application creates. See “Google API Services” below.
• Payment gateway data (only if you enable Razorpay): transaction identifiers and webhook events. We do not store full card numbers, UPI PINs, or net-banking credentials — those stay with Razorpay.
• Technical data. IP address, browser user-agent, session cookies, and server logs (request URL, status code, timestamp) used for security and debugging.

We do not sell your data, run third-party advertising trackers, or build advertising profiles.

3. How we use your information

• To provide the Service — rendering invoices, computing GST, generating reports, sending you and your customers emails you initiate.
• To authenticate you, prevent abuse, and keep your data isolated to your organization.
• To produce backups to a destination you connect (e.g. your Google Drive).
• To comply with Indian tax law (GST, e-invoicing, e-way bill obligations) when you use those features.
• To contact you about service-critical changes — billing, security incidents, or material updates to this Policy.

4. Google API Services — Limited Use disclosure

If you connect Google Drive for backups, the Service requests the following Google OAuth scopes:

• https://www.googleapis.com/auth/drive.file — create and manage only the backup files that this application creates. We cannot read, modify, or delete any other file in your Drive.
• https://www.googleapis.com/auth/userinfo.email — read your Google account email address so we can show which account is connected.

AVS Invoice’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• Use Google user data only to provide the backup feature you have explicitly enabled.
• Do not transfer Google user data to third parties except as needed to provide the feature, comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior notice to you.
• Do not use Google user data for advertising, including retargeting, personalized advertising, or interest-based advertising.
• Do not allow humans to read Google user data, except (a) with your affirmative consent for specific files, (b) where necessary for security reasons such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymised for internal operations.

You can revoke the Service’s access to your Google account at any time at myaccount.google.com/permissions, or by disconnecting Google Drive from within the Service’s Backup settings.

5. Who we share data with

We share data only with the parties needed to run the Service:

• Hosting and database providers that store the Service’s data on our behalf, under written data processing terms.
• Google LLC, when you use the Google Drive backup feature.
• Email delivery provider (SMTP), when you send invoices or payment reminders to your customers.
• Razorpay, when you enable online payment collection.
• Government authorities (e.g. GSTN, NIC IRP and e-way bill systems) when you use the corresponding tax-compliance features. Submissions to these authorities are made using credentials you provide.
• Law enforcement or regulators, when required by valid legal process.

We do not sell, rent, or trade personal data.

6. Where data is stored

Application data is stored on servers located in India. Backups, if you enable them, are stored in your Google Drive (location controlled by Google). Email is delivered through SMTP providers that may route messages internationally.

7. How long we keep data

• Account & business records: kept for as long as your account is active, and for up to eight (8) years after closure, in line with retention requirements under the Companies Act and the CGST Act.
• OAuth refresh tokens: kept until you disconnect the integration or delete your account.
• Server logs: retained for up to 90 days, then purged.
• Backups in your Drive: retained according to the retention policy you configure inside the Service.

8. Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• access a summary of the personal data we process about you,
• request correction, completion, or updating of inaccurate data,
• request erasure of personal data we no longer need to retain by law,
• withdraw a consent you previously gave (e.g. disconnect Google Drive),
• nominate an individual to exercise these rights in the event of your death or incapacity, and
• file a grievance with us, and, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, write to admin@avscorp.in. We will respond within a reasonable period and in any event within the timelines required by law.

9. Security

We use industry-standard safeguards to protect your data, including TLS in transit, encrypted storage of sensitive secrets (such as GSP credentials and OAuth refresh tokens), hashed passwords, role-based access control inside each organization, and audit logs of administrative actions. No system is perfectly secure; you are responsible for keeping your password and any API keys confidential.

10. Children

The Service is intended for businesses and is not directed at children under 18. We do not knowingly collect data from children.

11. Changes to this Policy

We may update this Policy from time to time. When we make a material change, we will update the “Effective date” above and, where appropriate, notify you in-app or by email. Continued use of the Service after a change means you accept the updated Policy.

12. Contact & grievance officer

All privacy, data-protection, and grievance queries should be addressed to:

We will acknowledge receipt of your query and respond within the timelines required by applicable law.