Privacy Policy

Who we are

Payslate (com.payslate.app) is built and published by Shivaraj Bakale, an individual developer based in Bengaluru, India. For the purposes of the GDPR, the UK GDPR and India's Digital Personal Data Protection Act, 2023, Shivaraj Bakale is the data controller / data fiduciary for the limited personal data described below. Contact: shivarajapple@gmail.com .

What stays on your device

The following is written to local storage on your phone and nowhere else. We cannot read it, and it is not backed up to any service we run.

• Clients — name, contact details, billing address, tax id, notes.
• Invoices and estimates — numbers, dates, line items, quantities, rates, tax rates, discounts, totals and status.
• Payments recorded against a document, full or partial.
• Expenses — date, vendor, category, amount, and any receipt photo you attach.
• Business profile and settings — business name, logo, address, currency, payment terms, numbering prefixes and reusable tax rates.
• Generated PDFs and CSV exports, written to the app's own documents directory.

Because this data lives only on the device, deleting the app deletes it. Signing in with a different account on the same phone also clears the local database, so one person's books are never visible to the next account that signs in.

What leaves your device

1. Account sign-in

Payslate requires an account, and sign-in goes through Firebase Authentication (Google LLC) using Sign in with Apple or Sign in with Google. Firebase receives and stores a user id, the email address associated with the provider account, and, where the provider supplies it, a display name. We use this only to establish that the app belongs to you and to keep the local database bound to one account.

If you use Sign in with Apple and choose Apple's "Hide My Email" option, we only ever see the relay address Apple generates.

The network is contacted at sign-in. Afterwards the session token is held on the device and restored offline, so the app keeps working without a connection.

2. Product analytics

Payslate sends anonymous usage events to Firebase Analytics (Google LLC) so we can see which parts of the app are used and where people get stuck. Events are limited to screen names, action names, counts, kinds and booleans — for example, that an estimate was converted to an invoice, or that a PDF was shared.

Analytics deliberately never include: a client name, a business name, an invoice or estimate number, a description, a note, a receipt image, an address, or any monetary amount. Firebase Analytics also collects standard device and app information such as device model, operating system version, app version, coarse region and an app instance identifier.

3. What you choose to share

When you share an invoice PDF or a CSV export, the file is handed to your operating system's share sheet and goes wherever you send it — email, messaging, cloud storage. That transfer is initiated by you and does not pass through us. Once a file reaches another app or service, that service's privacy policy governs it.

Device permissions

• Camera and photo library — requested only when you attach a receipt photo or a business logo. The image is copied into the app's local storage. We do not scan your photo library.
• Network — used for sign-in and analytics only.

Payslate does not request access to your contacts, your location or your microphone.

Why we process this data, and on what legal basis

Who else is involved

We use two sub-processors, both operated by Google LLC:

• Firebase Authentication — account sign-in.
• Firebase Analytics — anonymous usage events.

Apple Inc. processes your credentials when you use Sign in with Apple, under Apple's own privacy policy. We do not sell, rent or trade personal data, and we do not share it with advertisers or data brokers. Data handled by Google may be processed on servers outside your country, including in the United States, under Google's standard contractual clauses.

How long we keep it

Your account record is kept for as long as your account exists. Ask us to delete it and it is removed. Analytics events are retained by Firebase under Google's retention settings, currently a rolling window of up to 14 months, after which they are deleted automatically. Data on your device is kept until you delete it in the app, sign in with a different account, or uninstall Payslate.

Your rights

Most of your data is already under your direct control: it is on your phone, and you can edit or delete any record in the app, or remove all of it by uninstalling. For the account data held by Firebase, you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything inaccurate;
• delete your account and the data attached to it;
• stop processing, or object to processing, on legitimate-interest grounds;
• withdraw consent where consent is the basis.

To delete your account, email shivarajapple@gmail.com from the address you signed up with. We will delete the account and its Firebase records within 30 days and confirm when it is done. Uninstalling the app removes everything stored on the device immediately.

If you are in the EU, the EEA or the UK

You have the rights above under the GDPR and UK GDPR, including the right to data portability and the right to lodge a complaint with your national supervisory authority.

If you are in India

Under the Digital Personal Data Protection Act, 2023 you have the right to access a summary of your personal data, to correction and erasure, to nominate another person to exercise your rights, and to grievance redressal. Shivaraj Bakale acts as the grievance officer and can be reached at shivarajapple@gmail.com . If a grievance is not resolved, you may escalate it to the Data Protection Board of India.

If you are in California

Under the CCPA and CPRA you may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction, and opt out of the sale or sharing of personal information. We do not sell or share your personal information as those terms are defined by the CCPA, and we do not use it for cross-context behavioural advertising. Exercising these rights will never get you worse service.

Security

Your business data is protected by your device: it sits in the app's private storage, which the operating system isolates from other apps, and is covered by your device passcode and disk encryption. Keeping a lock screen on your phone is the single most useful thing you can do to protect it. Traffic to Firebase is encrypted in transit over HTTPS. No system is perfectly secure, and we cannot guarantee absolute security.

Children

Payslate is a business tool and is not directed to children under 13 (or under 16 in jurisdictions that set the higher age). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, email us and we will delete it.

About this website

This page is hosted on shivarajbakale.com, a personal website that uses Google Analytics and Google Tag Manager for visitor statistics. That is separate from the Payslate app and applies only to browsing this site.

Changes to this policy

If this policy changes, the updated version is published on this page with a new effective date. Material changes will also be announced in the app release notes. Continuing to use Payslate after a change means you accept the updated policy.