Privacy Policy

This policy applies to the KLM mobile app for iOS and Android (bundle identifier com.klm.app, package com.klm.app), the https://klmhub.com website, and the backend services that support them. It is published by ‹Company Legal Name Private Limited› (CIN ‹CIN / LLPIN›), registered at ‹Registered address — building, street, city, state, PIN› — referred to below as “we”, “us” or “KLM”.

KLM is a business tool. The people who use it are shop owners and their staff, and the data inside it is mostly business records — products, invoices, stock, vendors and ledgers — rather than personal browsing behaviour. We do not run advertising, we do not operate a data brokerage, and we do not sell your data to anyone.

It matters which hat we are wearing, because it determines who you ask when you want something changed or deleted.

• We are the data fiduciary for your KLM account — your name, email address, phone number, login credentials, subscription and billing records, support tickets and device information. You deal with us directly about this data.
• We are a data processor for everything you enter into your store: your products, your vendors, your expenses, and in particular the records of your customers (their names, phone numbers, GST numbers, purchase history and credit ledgers). That data belongs to the merchant, not to us. We hold and process it on the merchant’s instructions, and we do not use it for our own purposes.

Account and identity data

• Your name, email address, phone number (with country code), profile photo and region, when you register or complete your profile.
• A password, stored only as a salted bcrypt hash — we cannot read it and cannot recover it for you.
• If you sign in with Google or Apple: the account identifier and the basic profile (name, email address, profile picture) that the provider returns. If you use Apple’s Hide My Email, we receive and store only the relay address.
• Email verification codes and password reset tokens, which expire after a short window.

Store and business data

• Store profile: business name, store identifier, address, logo, GST registration number, currency and timezone.
• Staff records: the employee’s linked user account, phone number, join date and the permissions you have granted them.
• Catalogue and inventory: products, images, SKUs, HSN codes, categories, units, GST rates, cost and selling prices, stock levels, stock movement logs and price-change history.
• Trade records: invoices and transactions, held and saved orders, returns and refunds, purchase orders, vendors and vendor payments, expenses, losses, stock transfers between stores, and inventory imports.
• Money owed and held: customer wallets, khata (credit ledger) entries and khata payments.

Your customers’ data, entered by you

When a merchant bills a customer they may record the customer’s name, phone number and GST number, and the app links that customer to their purchase history, wallet balance and outstanding credit. We store this on the merchant’s behalf under the processor role described above.

Subscription and billing data

• Plan tier, billing cycle, start and end dates, renewal and cancellation status, promo codes redeemed, discounts, prorated credits and tax amounts.
• Payment identifiers returned by Razorpay — order ID, payment ID and status. We never see or store your card number, CVV, UPI PIN or bank credentials. Those go directly to Razorpay.

Technical and device data

• Device push notification token and platform (iOS or Android), so we can send you alerts you have opted into.
• Authentication tokens, stored on your device in the operating system’s secure keystore (iOS Keychain / Android Keystore).
• Server logs: IP address, request path, timestamp, response status and error traces. These are operational records used to keep the service running and to investigate abuse.
• App preferences stored locally on your device, such as whether you have dismissed a particular prompt.

Support data

When you raise a support ticket we collect the type, title, description, severity and any attachments you choose to add, along with the account and store that raised it.

We do not use your business data to build advertising profiles, and we do not sell or rent it. We may publish aggregate, fully anonymised statistics (for example, “merchants processed N invoices this month”) that cannot be traced back to any store or person.

KLM includes an assistant called Niti that answers questions about your store and generates business summaries, along with an AI product-comparison feature. When you use one of these features, the relevant business data for your query — for example aggregated sales figures, product names, category totals, vendor names and date ranges — is sent to our AI provider, OpenAI, to generate the response.

• These features run only when you invoke them. Nothing is sent to the AI provider in the background.
• We use OpenAI under an API agreement in which submitted data is not used to train their models.
• AI output can be wrong. Treat Niti’s summaries as a starting point, not as accounting, tax or legal advice. Check the underlying reports before acting on a number.

The app asks for each of these only at the moment you use the feature that needs it, and it keeps working — with that feature unavailable — if you decline.

Images you pick are uploaded to our servers and stored against your store. We do not scan your photo library — the system picker returns only the single image you select.

We share data with the following service providers, each only to the extent needed to do their job, and each bound by contract to protect it. We do not share your data with anyone else except as described in this section.

We may also disclose data:

• to comply with a binding legal order, court direction or a lawful request from a government authority;
• to enforce our Terms of Service or to investigate fraud, security incidents or abuse;
• to a successor entity in a merger, acquisition or asset sale — in which case we will notify you before your data becomes subject to a different privacy policy.

Subscription payments are collected through Razorpay, a payment aggregator authorised by the Reserve Bank of India. Card and bank details are entered inside Razorpay’s own PCI-DSS compliant flow and are never transmitted to or stored on our servers. We receive only the outcome — success or failure — plus the identifiers we need to reconcile your subscription and raise a GST invoice. Razorpay handles that data under its own privacy policy.

• All traffic between the app and our servers runs over TLS.
• Passwords are stored only as bcrypt hashes; we cannot read them.
• Session tokens are held in the device’s hardware-backed secure store, not in general app storage, and expire on a short cycle with refresh-token rotation.
• Access inside a store is controlled by the role and permissions the store owner assigns to each employee.
• Databases are encrypted at rest, access to production is restricted to a small number of engineers, and administrative actions are logged.
• Sensitive endpoints are rate-limited to blunt brute-force and enumeration attempts.

No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board of India as required under the Digital Personal Data Protection Act, 2023, and CERT-In under its directions of 28 April 2022.

Where the law requires us to keep a record after you leave, we retain only that record and stop using it for any other purpose. See Account & Data Deletion for the full mechanics.

Under the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, you have the right to:

• Access — obtain a summary of the personal data we hold about you and the parties we have shared it with.
• Correct and complete — fix inaccurate or incomplete data. Most of it is directly editable in the app under Profile and Store Settings.
• Erase — have your personal data deleted where we no longer need it for the purpose it was collected, and no law requires us to keep it.
• Withdraw consent — for anything you consented to, such as push notifications, at any time and as easily as you gave it.
• Nominate — name another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal — complain to our Grievance Officer, and escalate to the Data Protection Board of India if you are not satisfied with our response.

Write to klmpcenterprises@gmail.com from your registered email address and we will respond within 30 days. We may ask you to verify your identity before we act, to make sure we are not handing your data to someone else.

If a shop billed you using KLM, your name and phone number may sit in that shop’s customer list, along with your purchase history and any credit you owe or wallet balance you hold with them.

That record belongs to the shop, not to us. Ask the shop directly to correct or delete it — they can do so from within the app. If you cannot reach them, write to klmpcenterprises@gmail.com with the shop’s name and we will pass your request on and support them in acting on it.

KLM is a business tool intended only for people aged 18 and over. We do not knowingly collect personal data from children. If we learn that a child’s data has reached us we will delete it. We do not carry out behavioural monitoring or targeted advertising directed at children, which the DPDP Act prohibits in any case.

Your data is stored on servers located in ‹e.g. AWS ap-south-1, Mumbai, India›. Some of our service providers — notably Google, Apple and OpenAI — process limited data outside India. Where that happens we rely on contractual protections with those providers, and we transfer only what the service needs.

We will update this page when our practices change, and revise the “last updated” date at the top. If a change materially affects your rights we will tell you inside the app or by email before it takes effect. Continuing to use KLM after a change means you accept the updated policy.

For any privacy question or to exercise the rights above, contact klmpcenterprises@gmail.com.