Privacy Policy
What data SunLedger collects, why, who we share it with, and the choices and rights you have.
1. Who we are and what this covers
SunLedger is business software for solar installers and EPC companies, provided by SunLedger ("SunLedger", "we", "us"). This policy explains how we handle personal data when you use our website (sunledger.in), the SunLedger admin web panel and the SunLedger mobile app (together, the "Service"). It is written to meet the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023 ("DPDP Act").
2. Our role
- Account data: for the details of businesses that subscribe to SunLedger and of their administrators and app users (name, phone, email, login), we decide how the data is used, so we are the data fiduciary.
- Customer data: our customers (solar businesses) enter data about their own projects and end customers into SunLedger. For that data, the solar business is the data fiduciary and we process it only on their instructions, as their data processor. If you are an end customer of a solar business, please contact that business first about your data. We will help them respond.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account and profile | Name, username, email address, phone number, role, password (stored only as a one-way hash) | You, or your company's administrator |
| Business details | Company name, GSTIN, address, state, bank details shown on invoices, logo and letterhead details | Customer administrators |
| Project and end-customer details | End-customer name, phone, email, address, city, state, PIN code; system size (kW), panel and inverter details, project cost and billing | Entered by the solar business and its app users |
| Photos and documents | Site photos (for example blank site, structure, panels, final meter), bills, challans and other files you choose to upload | Uploaded by users |
| Payment and payout details | Payment amounts, dates and UTR/reference numbers; for payouts: account holder name, bank account number, IFSC, bank and branch name, UPI ID, GST bill copy, GST and TDS amounts | Entered by users and administrators |
| Inventory and business records | Items, suppliers and their contact details, purchase orders, goods receipts, dispatches, sales and stock | Entered by users |
| Device and technical data | Push notification token, device identifier and platform (Android/iOS) for sending notifications; IP address and browser or device information for login sessions and security; logs of key actions (for example who approved a payment) | Collected automatically when you use the Service |
| Communications | Messages, comments on payments, and emails, calls or WhatsApp messages you send us | You |
We do not collect your precise or approximate location, contacts, call logs, SMS messages or browsing history, and we do not show advertising or use advertising identifiers.
4. Mobile app permissions
- Camera and photos/files: used only when you choose to take or attach a photo or document, for example a site photo or a GST bill. Only the files you pick are uploaded.
- Notifications: used to alert you about approvals, payments, payouts and other account activity. You can turn notifications off in your phone settings.
- Internet access: needed to sync your data with SunLedger.
5. How we use data
- To provide the Service: create accounts, store and show your projects, stock, documents, payments and payouts, and generate PDFs.
- To send push notifications and service messages about your account.
- To keep the Service secure: authenticate logins, prevent misuse and investigate problems.
- To provide support, process subscriptions, issue invoices and keep billing records.
- To improve the Service, using aggregated or anonymised information where possible.
- To comply with the law, including tax and record-keeping rules, and lawful requests from authorities.
We do not sell personal data, and we do not use your data for advertising.
6. Legal basis
We process account data on the basis of your consent, which you give by signing up and using the Service, and for legitimate uses allowed under the DPDP Act, such as providing a service you asked for, meeting legal obligations, and keeping records required by law. You can withdraw consent at any time by contacting us. This will end your use of the Service, but it does not affect processing done before withdrawal or records we must keep by law. For customer data, the solar business that enters it is responsible for its legal basis and for informing its end customers.
7. Who we share data with
- Inside your company: data entered in a Customer account is visible to that company's administrators. App users see only what their role allows, such as their own projects and payouts.
- Service providers who help us run the Service, only for that purpose and under confidentiality: our web hosting and server provider; Google Firebase Cloud Messaging (to deliver push notifications); and Google Fonts (to display fonts on our website).
- Legal reasons: when required by law, court order or a lawful request from a government authority, or to protect the rights, safety and security of our users and the Service.
- Business transfer: if SunLedger is merged or sold, data may move to the new owner, who must continue to protect it under this policy.
Customer data is never shared between different customer companies.
8. Retention and deletion
- We keep data for as long as the Customer account is active and the data is needed to provide the Service.
- When a subscription ends, the customer can request an export within 30 days. After that, we delete or anonymise the account's data within 90 days.
- When a user account is deleted, the person's login, profile, device tokens and saved payout accounts are removed. Business records they created (for example projects, payments and invoices) stay in the company's account, because the company needs them for its books.
- Some records must be kept longer by law. For example, invoices, payment and tax records may be retained for the period required under GST and income-tax laws (generally up to 8 years), after which they are deleted.
- To delete an account, see Delete account / data.
9. Security
We use reasonable security practices to protect data, including:
- encrypted connections (HTTPS) between your device and our servers;
- passwords stored only as one-way hashes;
- role-based access, with each company's data kept separate from other companies;
- access to production systems limited to authorised people;
- logs of key actions, such as approvals and payment changes.
No system is completely secure. If a personal data breach occurs, we will notify affected customers and the Data Protection Board of India as required by law, and take steps to limit the harm.
10. Your rights
Subject to applicable law, including the DPDP Act, you have the right to:
- get a summary of the personal data we hold about you and how it is used;
- have inaccurate or incomplete data corrected or updated;
- have your data erased when it is no longer needed, unless the law requires us to keep it;
- withdraw your consent;
- nominate another person to exercise your rights if you die or are unable to;
- raise a grievance with us, and if you are not satisfied, with the Data Protection Board of India.
To use these rights, email contact@sunledger.in from your registered email address, or call +91 80036 21369. We may ask you to confirm your identity. App users can also ask their company's administrator, who can update or block their account directly.
11. Cookies
The admin web panel uses essential cookies to keep you logged in and to protect forms against misuse. The panel may also remember display preferences (such as light or dark mode) in your browser. We do not use advertising or third-party tracking cookies.
12. Children
SunLedger is a business service for adults. It is not meant for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child's data has been entered, contact us and we will delete it.
13. Transfers outside India
Some service providers, such as Google Firebase, may process data on servers outside India. Such transfers are made only as permitted under Indian law and with providers that protect the data to a standard consistent with this policy.
14. Changes to this policy
We may update this policy. We will post the new version on this page with a new "Last updated" date and, for important changes, notify customers by email or in the app before the change takes effect.
15. Contact and Grievance Officer
For any privacy question, request or complaint, contact our Grievance Officer:
- Organisation: SunLedger
- Email: contact@sunledger.in (subject: "Privacy" or "Grievance")
- Phone: +91 80036 21369
We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days.