It is a working draft written from what the software actually does, so that a lawyer can correct it rather than start from nothing. It is not yet signed by anyone and should not be relied on as a compliant Article 28 contract until it has been reviewed and executed.
This agreement covers one specific thing: the details a shop enters about its own customers — their names, phone numbers, addresses and GSTINs — which Okount holds on the shop's behalf.
It does not cover the shopkeeper's own account details. We decide what happens to those, and the Privacy Policy explains them.
Who is who
You, the shop, decide what to record about your customers and why. That makes you the controller under the GDPR and the Data Fiduciary under India's DPDP Act 2023.
We hold and handle those records only to make the software work. That makes us the processor, or Data Processor.
The practical consequence is worth stating plainly: your customers are your responsibility, not ours. If one of them asks why you hold their number, the answer has to come from you. We have never met them and have no relationship with them.
What we are allowed to do with it
We process customer records only on your instructions. In practice your instructions are the features you use — issuing a bill, running a credit account, booking a delivery, sending a statement link.
We do not sell them, do not use them for advertising, do not use them to train models, and do not use them to build anything of our own. If we are ever compelled by law to hand something over, we will tell you before we do unless we are forbidden from saying so.
The particulars
| Item | What it is here |
|---|---|
| Subject matter | Running billing, stock, credit and order software for your shop. |
| Duration | For as long as your account is open, plus the seven-day closure window. |
| Nature and purpose | Storing, organising, displaying, exporting and transmitting records so the features work. |
| Type of personal data | Names, phone numbers, addresses, GSTINs, purchase and payment history, amounts owed. Photographs of supplier bills where you use that feature. |
| Categories of people | Your customers, and your staff where you record them. |
| Special category data | None is asked for. Do not enter health, biometric, religious, caste or similar details — there is no field for them and no safeguard around them. |
Who else touches it
These are our sub-processors. We stay responsible to you for what they do.
| Who | What for | Where |
|---|---|---|
| Supabase | The database and file storage — everything lives here | Tokyo, Japan |
| Anthropic | Reading a photographed product or supplier bill, only when you use that feature | United States |
| Expo | Delivering push notifications, only if you allow them | United States |
We will tell you in the app at least 30 days before adding or changing one, so you have time to object. If you object and we cannot resolve it, you may close the account and export your records first.
Couriers and marketplaces are not on this list. If you connect Shiprocket, Amazon or Flipkart, you are sending your customers' details to a company that decides its own purposes — it is a controller in its own right, not our sub-processor, and its own terms and privacy policy govern what it does. That connection is yours to make and yours to justify.
Crossing borders
Records sit in Japan, which has an EU adequacy decision, so no additional safeguard is needed for the database itself.
The US transfers are not papered yet. Sending EU personal data to Anthropic or Expo needs either their certification under the EU–US Data Privacy Framework or Standard Contractual Clauses signed with them. Neither has been confirmed. Until it is, the photo and notification features should not be offered to shops in the EU or UK.
Keeping it safe
What is actually in place today: each shop's records are separated at the database level so one shop cannot read another's; staff permissions are enforced on the server rather than by hiding buttons; marketplace and courier credentials are stored so the app can send them but not read them back; traffic is encrypted in transit and storage is encrypted at rest by the provider.
Sign-in is not secure in this build. The app accepts a fixed code instead of one sent by SMS, so anyone who knows a phone number in the system can sign in as that person and read that shop's customer records. Under Article 32 of the GDPR this is not an adequate security measure, and no agreement can paper over it. Do not enter real customer details into this build. This is the first thing that has to be fixed, before any of the rest of this document means anything.
When something goes wrong
If we find out that customer records have been exposed, lost or reached someone who should not have them, we will tell you without undue delay and in any case within 48 hours of becoming aware. We will tell you what happened, which records are affected as far as we know, what we are doing, and what we suggest you do.
Reporting a breach to a regulator, and telling the affected people, is the controller's duty — so it is yours. The GDPR gives you 72 hours from when you become aware. Our 48-hour commitment exists so you have time left to act.
Helping you answer your customers
Most of what a customer can ask for, you can already do yourself from the customer's page — see what is held, correct it, delete it. Exports give you the whole record in a portable form without asking us.
If a request reaches us instead of you, we will not answer it. We will pass it to you, because it is yours to answer. Where you need something the app cannot do on its own, we will help, and we will not charge you for a reasonable number of such requests.
We will also help you with a data protection impact assessment or a consultation with a regulator, to the extent it concerns what we do.
People who work on the system
Anyone with access is bound to keep it confidential, has access only where the job requires it, and loses it when the job no longer requires it.
Today that is one person. Okount is run by an individual, who holds administrative access to the database. There is no second pair of eyes and no separation of duties. That is a real limitation, and a shop weighing up whether to enter its customers' details should know it.
Giving it back, and deleting it
You can export everything at any time from Business → Exports; you do not need to ask. When the owner closes the account, the records and the photographs are erased seven days later, and a dated note that closure was asked for and carried out is kept — which holds no customer details and exists so we can show the erasure happened.
Keeping your books for as long as tax law requires is your obligation, not ours. Export before you close.
Showing that this is true
You can ask us for the information needed to show we are meeting this agreement, and we will give it. You may audit, or have someone audit for you, on reasonable notice and not more than once a year unless a regulator asks or a breach has happened.
There is no certification to point to. No ISO 27001, no SOC 2, no independent audit has been done. An audit right is offered honestly here, but it means you inspecting a small operation, not us handing over a report that does not exist.
If this conflicts with the Terms
For anything about customer records, this document wins over the Terms of Service.
Law and contact
Governed by the law of India, on the same footing as the Terms, and without affecting rights you have under the law where you live.
Questions: privacy@okount.com.
Not signed, and not yet live. Nobody has executed this agreement and the mailbox is not receiving mail. It needs a lawyer's review, a way for a shop to actually accept it, and a named contact on our side before it does the job it is written for.