Privacy Policy

Who we are

Cawoba is operated by Cawoba ("Cawoba", "we", "us"). Cawoba is a platform where businesses in India exchange quotations, catalogues, price lists and credit information with the businesses and people they trade with. It is available at cawoba.in and through our business and buyer apps.

For the personal data of people who use Cawoba directly, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

What this policy covers

This policy covers our website, the Cawoba Business and Cawoba buyer apps, and our mobile app. It does not cover websites or services run by others that you reach through Cawoba, such as Zoho Books or a supplier's own website.

When a business adds information about its own customers or contacts to Cawoba (for example a contact's name, phone number or GSTIN, or a customer's ledger synced from Tally), that business decides why that data is processed. For that data we act on the business's instructions, and the business is responsible for having a valid basis to share it with us.

Data we collect

Data you give us

• Account details: your name, email address and password. We store only a secure hash of your password, never the password itself.
• Business details: business name, business type, GSTIN, city, state, address, logo, description and the contact details you choose to publish on your profile.
• Team details: the email addresses of people you invite, and the roles you give them.
• Trade content: products, catalogue entries and images, price lists, schemes, stock and warranty information, contacts, quote requests, quotations and their notes, and credit entries you record.
• Messages to us: anything you send to support.

Data created when you use Cawoba

• Activity records: who created, sent, revised, accepted or declined a quotation and when. These form the history both parties see.
• Security and technical data: IP address, browser and device information, sign-in times, one-time codes sent and failed attempts. We use these to keep accounts safe and detect abuse.
• Notifications: the in-app alerts sent to you.

Data from connected services

• If you connect Zoho Books or Tally Prime, we read balances, bills, invoices and related documents for the customers you choose to share. See Tally and Zoho Books.

We do not collect payment card or bank account details. Cawoba does not process payments.

How we use it

We process personal data on the basis of your consent, given when you register and when you connect an integration, and for the legitimate uses allowed by the DPDP Act. We use it to:

• create and secure your account, verify your email and let you sign in;
• run the features you use, such as delivering a quotation to the buyer, showing a shared credit balance or listing your public catalogue;
• send service emails and in-app notifications, such as one-time codes, invitations and quotation updates;
• prevent fraud, spam and misuse, and investigate security incidents;
• answer support requests;
• improve Cawoba, using aggregated information that does not identify you;
• meet legal obligations and respond to lawful requests from authorities.

We do not sell personal data, and we do not use your trade content to advertise to you or to anyone else.

Who can see your data

• The other party to a deal. A buyer sees quotations sent to them; a seller sees requests and decisions from their buyers. Drafts are visible only to the business that created them.
• The public, if you choose. Your business profile and any catalogue entries you mark as public can be seen by other Cawoba users and, for public pages, by anyone. You decide whether prices are shown.
• Your connected customers, if you choose. A customer sees their credit balance only after you connect with them and switch on credit sharing for them.
• Your team. Members of a business see that business's data according to the role an admin gives them.
• Anyone with a share link. If you create a share link for a quotation, anyone who has the link can open its PDF until the link expires (30 days).
• Service providers who help us run Cawoba, such as cloud hosting, email delivery and error monitoring. They may use the data only to provide their service to us.
• Authorities, where the law requires it.
• A successor, if Cawoba is merged or acquired. This policy would continue to apply to your data.

Our staff can access account data only where needed to support you, keep the platform safe or meet legal obligations. Staff actions on customer accounts are recorded in an audit log.

Tally and Zoho Books

• Integrations are read-only. Cawoba never creates, edits or deletes anything in your accounting software.
• Zoho Books: you authorise access through Zoho. We store the access tokens encrypted and read data when it is needed to show a balance or document.
• Tally Prime: the Cawoba bridge on your computer sends data only for customers you have linked and chosen to share. If you stop sharing a customer, their synced data is removed after a short grace period.
• You can disconnect an integration at any time. Your use of Zoho Books or Tally is also governed by their own terms and privacy policies.

Cookies and local storage

We use only what the service needs to work:

• a secure, HTTP-only cookie that keeps you signed in and lets you move between the Cawoba apps without signing in again;
• browser storage that remembers which business you last worked in.

We do not use advertising cookies. If we add analytics in future, we will update this policy first. Blocking these cookies will stop you from signing in.

How long we keep data

• Account and business data: while your account is active. When you ask us to delete your account, we delete or anonymise your personal data, except what we must keep as described below.
• Quotations and their history: a quotation belongs to both businesses involved. If one party leaves, we keep the record for the other party, and remove the leaving person's identifying details where we can.
• One-time codes: expire after 10 minutes.
• Security logs: kept for as long as needed to investigate and prevent abuse, and no longer than the law allows.
• Records we must keep by law, for example for tax or legal claims: for the period the law requires.

How we protect it

We use encryption in transit (HTTPS), hashed passwords, encrypted integration tokens, short-lived sign-in tokens, limits on repeated sign-in and code attempts, role-based access inside each business, and strict separation between businesses' data. No system is perfectly secure. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the DPDP Act requires.

Please keep your password private and tell us straight away if you suspect someone has accessed your account.

Your rights

Under the DPDP Act you can:

• access a summary of the personal data we hold about you and how it is processed;
• correct, complete or update it. Most details can be edited directly in your profile;
• erase it, subject to the records we must keep;
• withdraw consent at any time. This does not affect processing already done, and some features may stop working;
• nominate another person to exercise these rights if you die or become unable to;
• raise a grievance with us, and if you are not satisfied with our response, complain to the Data Protection Board of India.

To use any of these rights, contact us using the details below. We may need to confirm your identity first. If your request is about data a business added about you (for example as one of its contacts), we will pass it to that business or ask you to contact them.

Children

Cawoba is for businesses and adults. You must be at least 18 years old to use it. We do not knowingly collect personal data of children. If you believe a child has created an account, contact us and we will delete it.

Where data is processed

Our hosting and some service providers, such as email delivery, may store or process data outside India. Any such transfer will follow the DPDP Act and any restrictions notified by the Government of India.

Changes to this policy

We will update this page when our practices change, and change the date at the top. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.

Contact and grievances

For questions, requests about your data, or complaints, contact our Grievance Officer. We aim to acknowledge grievances promptly and resolve them within the timelines set by applicable law.