Privacy Policy

This Privacy Policy explains what information LupinSync Global Invoices (“LupinSync”, “we”, “us”) processes when you use the Service, and how that information is used and protected. The data operator is Bhoi Enterprises, a proprietorship, operating under the LupinSync.tech technology brand. This policy describes the Global Invoices product and its actual architecture rather than generic boilerplate.

1. Information we process

Account information

• Email address, display name, and authentication credentials (passwords are stored as secure hashes, not in recoverable plain text).
• Email verification and session data needed to keep you signed in securely.
• Organization membership and role information.

Organization and legal-entity information

• Organization name and related setup data.
• Legal entity details you enter (legal/trading name, country, timezone, default currency, contact details, addresses, and tax registrations you choose to store).

Customer and invoice information

• Buyer/customer records you create (names, contacts, addresses, tax IDs you enter).
• Invoice and proforma content: line items, amounts, currencies, taxes, notes, numbering, and status.
• Issued document snapshots and generated PDF files stored so documents can be viewed, re-downloaded, and delivered.
• Recorded invoice payments and related metadata you or integrations supply.

WooCommerce / WordPress connection information

• Site URL/name and connection identifiers when you connect a WordPress installation.
• API credentials issued for the connection (stored and used to authenticate requests; secret values are not exposed in public responses).
• Order/import data you choose to send for customer mapping or invoice generation.
• Entitlement refresh requests from the plugin that read your organization's cloud plan capabilities.

Subscription and billing information

For paid Global plans, when subscription billing is enabled, we process subscription and payment identifiers needed to operate billing — for example plan, subscription status, billing period anchors, and payment/transaction references from the payment processor (Razorpay). We do not store full card numbers, CVV codes, or equivalent instrument secrets.

Technical and security information

• IP address and basic request metadata used for authentication, rate limiting, abuse prevention, and operational logs.
• Browser/user-agent information associated with sessions where collected by normal HTTP requests.
• Application logs and error diagnostics needed to operate and secure the Service.

Cookies and session technologies

We use session cookies (or equivalent session tokens) to keep authenticated users signed in. These are required for the application to function. We do not use them to sell advertising profiles.

2. How we use information

• To provide invoicing, PDF generation, delivery, recurring schedules, and related product features.
• To authenticate users, installations, and API clients.
• To operate SaaS subscription billing and entitlements when enabled.
• To send transactional email (for example verification codes or invoice delivery you initiate).
• To secure the Service, prevent fraud/abuse, and troubleshoot issues.
• To improve reliability and compatibility of the Service.
• To meet legal obligations and enforce our Terms and Conditions.

3. What we do not collect for payments

LupinSync does not receive or store complete payment-card numbers, CVV/security codes, or equivalent authentication secrets for cards or wallets. When Razorpay (or another configured processor) is enabled for SaaS checkout, instrument handling occurs on the processor's systems; we receive references and status information needed to update your subscription and entitlement.

4. Sharing

We share information with subprocessors only as needed to run the Service — for example hosting infrastructure, email delivery, and, when SaaS checkout is enabled, Razorpay as payment processor. We do not sell your personal information. WordPress/WooCommerce sites you connect remain under your control; the plugin sends data to the Global cloud APIs you authorize.

5. International processing

LupinSync Global Invoices is an international product. Information may be processed on infrastructure in locations where we or our subprocessors operate. By using the Service, you understand that processing may occur outside your country, subject to appropriate safeguards and applicable law.

6. Retention and deletion

We retain account, organization, invoice, and billing records for as long as needed to provide the Service and meet ordinary business and legal recordkeeping needs. You may request account or data deletion through our Contact page. Some records may be retained where required by law or for legitimate security, dispute, or accounting purposes. We do not claim a single fixed retention period for every data category beyond what is operationally defined.

7. Your choices and rights

• Access and update account profile information available in the application.
• Disconnect WordPress installations and revoke API keys you control.
• Cancel paid subscriptions under the Cancellation & Refund Policy.
• Contact us to request access, correction, or deletion where applicable law provides those rights.

8. Security

We use reasonable measures such as encrypted transport (HTTPS), hashed passwords, scoped API credentials, server-side document storage, and access controls. We do not claim a specific third-party compliance certification (for example ISO/SOC) unless independently assessed and publicly stated.

9. Children

The Service is intended for business use. It is not directed to children, and we do not knowingly collect personal information from children.

10. Changes

We may update this Privacy Policy as the Service evolves. We will revise the “Last updated” date when we do.

11. Contact

Privacy questions can be sent through our Contact page.

12. Data operator

The data operator for LupinSync.tech and LupinSync Global Invoices is Bhoi Enterprises, a proprietorship — not a private limited company, so no CIN applies, and no dedicated Data Protection Officer has been appointed at this stage.