Privacy Policy

This Privacy Policy explains how MicroBeet (“MicroBeet”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you visit our website, create an account, use our web application or mobile app, or connect a third-party app to your workspace. It also explains the choices and rights you have.

MicroBeet is operated by Oneonic Solutions, 909, Runway Heights, Ayodhya Chowk, 150 Feet Ring Road, Rajkot, Gujarat, India – 360006.

1. Scope of this policy

This policy covers:

• our marketing website and other public pages
• the MicroBeet web application and mobile app, including invoicing, estimates, expenses, inventory, vendor and purchase order features, and customer portals
• our billing for subscription plans
• support, sales, and newsletter communications
• data that flows between MicroBeet and third-party apps or payment gateways that you choose to connect

It does not cover the independent privacy practices of third parties, such as a payment gateway, Shopify, Odoo, or an accounting platform, which are governed by their own policies once you use them.

2. Two roles: our data and your business data

We act in two different roles, and the rules below depend on which applies.

• For our own data, such as your account details, billing information, website analytics, and marketing preferences, MicroBeet decides why and how the data is processed. We act as the data controller (or “data fiduciary” under India’s Digital Personal Data Protection Act, 2023).
• For your business data, such as the clients, customers, vendors, employees, invoices, and inventory you record in MicroBeet, you decide what to collect and why. We process that data on your behalf as a data processor (or “data processor” under the DPDP Act). Your use of MicroBeet is subject to our Terms of Service and any data processing terms we agree with you.

3. Information we collect

3a. Information you give us

• Account information: name, work email address, phone number, business name, and business address. MicroBeet does not use passwords for sign-in. One-time codes are sent to your email and expire after use.
• Business records: clients, customers, vendors, products, inventory, estimates, invoices, purchase orders, expenses, payments, ledger entries, and notes you enter or upload
• Team information: names, email addresses, roles, and permissions of people you invite to your workspace
• Payment and billing details: the billing contact, plan, currency, and invoice history for your subscription. Card and bank data for your subscription is collected and stored by our payment providers. We do not store full card numbers.
• Gateway and banking details you connect: API keys, webhook secrets, UPI IDs, and bank account details for the payment gateways you enable. These are encrypted at rest (see section 9).
• Communications: messages sent to our support, sales, or legal teams, and demo or contact form submissions

3b. Information collected automatically

• Usage data: pages and features you use, actions taken, timestamps, and error reports
• Device and log data: IP address, browser type and version, operating system, device identifiers for the mobile app, and language and time zone settings
• Authentication data: session tokens and sign-in events, used to keep you signed in and to detect misuse
• Cookies and similar technologies: described in section 10

3c. Information from third parties

• Sign-in providers: if you sign in with Google, we receive your name, email address, and profile picture as permitted by your Google account settings
• Payment gateways: payment status, transaction IDs, refund events, and webhook notifications for payments processed through the gateways you connect
• Connected apps: data that a connected app (such as Shopify or Odoo, once available) sends to MicroBeet after you authorize the connection

4. How we use personal data

We use personal data to:

• create and run your account and workspace, and provide the features you use
• process subscription payments, issue receipts and invoices for MicroBeet plans, and handle renewals, failed payments, and cancellations
• send transactional messages, such as one-time passwords, invoice emails you trigger, renewal and payment notices, and security alerts
• provide support and respond to your requests
• secure the service, detect fraud and abuse, and investigate incidents
• measure usage and improve the product, using aggregated or de-identified data where possible
• send product updates and marketing messages where you have agreed to receive them. You can opt out at any time.
• meet our legal, tax, accounting, and regulatory obligations and respond to lawful requests

4a. Legal bases

Where the GDPR or UK GDPR applies, we rely on one or more of these bases: performance of a contract (providing the service), legitimate interests (security, fraud prevention, and improving the product, balanced against your rights), compliance with legal obligations, and consent (for marketing and non-essential cookies). Where the DPDP Act, 2023 applies, we process personal data for a lawful purpose with your consent or for another legitimate use the Act permits.

5. Automated decisions

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Automated checks, such as fraud and abuse detection, may restrict access to the service, and you can ask us to review those decisions.

6. How we share personal data

We do not sell personal data. We share it only in these cases:

• Service providers: cloud hosting, database and backup services, transactional email and SMS providers, error monitoring, customer support tools, and our subscription billing providers. They may process data only to perform services for us.
• Payment gateways you choose: when you connect a gateway such as Stripe, Razorpay, PayPal, Cashfree, or PhonePe, we send it the data needed to process payments you request. Your customers’ payment details are handled by that gateway under its own terms.
• Connected apps you authorize: when you connect an app, we exchange the data needed for that integration. You can disconnect an app at any time, which stops future data exchange. Data already received may remain in your workspace.
• Other users in your workspace: team members see the business records their role allows
• Legal reasons: to comply with law, a court order, or a valid government request, or to protect the rights, property, or safety of MicroBeet, our users, or others
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets. We will tell you before your personal data becomes subject to a different privacy policy.
• With your consent: in any other case where you direct us to share the data

7. Payment information

We use payment processors to handle subscription payments and the gateways you connect to collect payments from your customers. We receive from these processors only what we need, such as payment status, transaction identifiers, amounts, and the last four digits of a card where the processor provides them. We do not store full card numbers or card security codes.

8. International transfers

MicroBeet serves customers in many countries. Your personal data may be processed in India and in other countries where we or our service providers operate. Where personal data is transferred outside the country where you live, we use appropriate safeguards, such as contractual clauses and access controls, consistent with applicable law.

9. Security

We protect personal data using measures that include:

• encryption in transit using HTTPS and TLS
• AES-256 encryption at rest for sensitive values, including gateway keys, webhook secrets, bank account details, and UPI IDs
• scoped access, so each business can only reach its own records, and role-based permissions within a workspace
• access to production systems limited to authorized personnel, with access logs
• regular backups

No method of transmission or storage is completely secure. If we become aware of a personal data breach that affects you, we will notify you and any authorities as required by applicable law.

10. Cookies and similar technologies

We use these categories of cookies and similar storage:

• Essential: keep you signed in, keep your session secure, and remember your workspace selection. The service does not work properly without these.
• Preferences: remember settings such as language, time zone, and display options
• Analytics: help us understand how the site and app are used, in aggregated form

Where required by law, we ask for your consent before setting non-essential cookies. You can change your browser settings to block or delete cookies, but some features may stop working. In the mobile app, we use device identifiers for the purposes described in section 3b.

11. Data retention

• Account and business data: kept while your account is active. You can export your data at any time.
• After cancellation or account closure: we keep your data for 30 days so you can export it. After that, we delete it from active systems. Copies in encrypted backups are removed as those backups expire.
• Financial and tax records: invoices, receipts, and payment records for MicroBeet subscriptions may be kept for as long as tax, accounting, or company law requires, which may be several years.
• Security and legal records: kept as long as needed for security monitoring, dispute resolution, and legal compliance.
• Marketing: until you opt out, then only a suppression record so we do not contact you again.

12. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data, subject to legal retention requirements
• Export your data in a commonly used, machine-readable format
• Restrict or object to certain processing, including direct marketing
• Withdraw consent at any time, without affecting processing already carried out
• Nominate another person to exercise your rights, where the DPDP Act permits
• Complain to us, to our grievance officer (section 16), or to your local data protection authority

To exercise these rights, email privacy@microbeet.com from the address linked to your account. We may need to verify your identity before we act. We aim to respond within 30 days, or sooner where local law requires it.

If you are a team member or customer of a business that uses MicroBeet, please contact that business first. It controls the data it records, and we will support its response to your request.

13. Marketing communications

We send marketing emails only where you have opted in, or where the law otherwise allows it. Every marketing email includes an unsubscribe link. Transactional and security messages will still be sent while you have an account with us.

14. Children

MicroBeet is designed for businesses and is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Third-party apps and future integrations

MicroBeet supports payment gateways today and is building an app directory with more integrations, including commerce and ERP platforms such as Shopify and Odoo, and data migration from accounting platforms. For each integration:

• we receive only the data that you authorize during setup, and only for the purposes shown on the setup screen
• the third-party provider’s privacy policy also applies to data it holds, and we are not responsible for its practices
• you can disconnect the integration at any time from your workspace settings
• where an integration requires separate terms or fees, those terms are shown before you install it

16. Contact and grievance officer

For privacy questions, requests, or complaints, contact us using the details below. Under the DPDP Act, 2023, our grievance officer handles complaints about how we process personal data.

• Privacy requests: privacy@microbeet.com
• Grievance officer: legal@microbeet.com
• Postal address: Oneonic Solutions (MicroBeet), 909, Runway Heights, Ayodhya Chowk, 150 Feet Ring Road, Rajkot, Gujarat, India – 360006

17. Changes to this policy

We may update this policy as our service changes or the law changes. For material changes, we will notify you by email or in the app at least 30 days before the change takes effect, where practical. The “Last updated” date at the top shows when this version took effect. Earlier versions are available on request.