OrgBooks — Privacy Policy
Last updated: 26 October 2026
OrgBooks ("OrgBooks", "we") is a personal-finance tool operated by Jatin Agrawal, Mumbai, India. This notice explains what OrgBooks does with information when you use OrgBooks, its beta website, OrgBooks on WhatsApp or OrgBooks by e-mail, and how to use your rights.
This notice is available in any Eighth Schedule language on request — write to support@orgbooks.in.
What OrgBooks' services hold, why, where and for how long
| Item | Why (purpose) | Where it is kept | How long |
|---|---|---|---|
| Your e-mail address | Sign-in to the beta site; your licence; the monthly count of GST calls; on WhatsApp, to show which OrgBooks account a number connects to (masked, e.g. j•••@example.com) | Cloudflare Access (sign-in); OrgBooks' licence store (Cloudflare D1); OrgBooks' WhatsApp store, sealed with a key of its own (Cloudflare KV) | While you use OrgBooks; deleted within 30 days of your asking |
| Your WhatsApp number | To receive what you send and to reply to you | OrgBooks' WhatsApp store, sealed (Cloudflare KV); on each stored item only masked (e.g. +91 98•••• 21); in plain only in that number's own reply state (Cloudflare Durable Objects, encrypted at rest by Cloudflare) | Until you disconnect (STOP, or Disconnect in OrgBooks); the reply state until you ask for it to be deleted |
| The WhatsApp ID Meta supplies (and the profile name) | The ID is kept beside the number, to reply; the profile name is received but not kept | That number's reply state (Cloudflare Durable Objects) | As the number |
| Your consent | To show when you agreed to connect, and to which version of this notice | Sealed with the connection (Cloudflare KV) | As long as the connection; deleted with it |
| The bills, documents and notes you send on WhatsApp | To bring them into your OrgBooks | Encrypted with your OrgBooks folder's own key (Cloudflare R2) — only your OrgBooks can open them | Until your OrgBooks brings them in, and at most 365 days |
| The short names of the OrgBooks users you tick On WhatsApp | To show WhatsApp's "who is this for?" list | Sealed (Cloudflare KV) | Until you change them or disconnect everything |
| Your OrgBooks e-mail address (one per account, e.g. k7q2m9x4vhtb@in.orgbooks.in), its aliases, the senders you allow, and the e-mail addresses you give your OrgBooks users | To receive the bills you send or forward by e-mail, and to file them under the right user | Sealed (Cloudflare KV); the address itself is kept only as a keyed hash | Until you revoke the address or disconnect everything |
| The e-mails you send or forward to that address: the attachments, your own words in the body, the sender's address, the subject and date | To bring them into your OrgBooks | Encrypted with your OrgBooks folder's own key (Cloudflare R2) — only your OrgBooks can open them; a stored item shows the sender only masked (e.g. b•••@example.com) | Until your OrgBooks brings them in, and at most 365 days |
| Your consent to the e-mail address | To show when you asked for it, and under which version of this notice | Sealed with the address (Cloudflare KV) | As long as the address; deleted with it |
| GST call counts | To apply the monthly limit | A count per e-mail address per month (Cloudflare D1) | Deleted within 30 days of your asking |
| Licence details: name, firm name and GSTIN (optional), your orders (plan, price, coupon) | Your licence and the exports' Licensed to … line; the record of a purchase | OrgBooks' licence store (Cloudflare D1) | While you hold a licence; orders as tax law requires |
| Your devices: public key, label (e.g. Mac · Chrome), check-ins (when, the OrgBooks version, the country Cloudflare reports) | To check the licence on each device | OrgBooks' licence store (Cloudflare D1) | Check-ins up to 12 months; devices until removed |
| Public GSTIN registration details | To answer a GSTIN search without asking the GST system again | OrgBooks' list (Cloudflare KV) — public data anyone can look up | Until replaced by a newer search, or removed on request |
We do not keep IP addresses, and none of OrgBooks' services receives your statements, books or returns.
1. Your books stay in your own folder
OrgBooks keeps your accounts, statements, documents and returns in your own folder — on your computer or in your own Google Drive (OrgBooks Database). OrgBooks' index is encrypted with your own passphrase. We do not hold a copy of your books, and we cannot read them.
2. The beta website
- Access is by invitation. Sign-in is handled by Cloudflare Access with a one-time code sent to your e-mail address; we see the e-mail address you sign in with.
- GST returns (if you use them): OrgBooks passes your read requests to our GST service provider (WhiteBooks) through the site, so it can fetch your returns from the GST system with the one-time password you enter. We keep only a count of calls per e-mail address per month (to apply a monthly limit) and public GSTIN registration details that anyone can look up. We do not log the requests or the returns.
- Licences (the beta's plans, its free trial and coupons): to issue and check your licence we keep your e-mail address, the name, firm name and GSTIN you give at checkout (optional — the name and firm appear on your exports' Licensed to … line), each device's public key and label (e.g. Mac · Chrome), when each device checked in, the OrgBooks version and the country the check-in came from (as Cloudflare reports it), and your orders (plan, price, coupon). We do not keep IP addresses, and the licence server never receives your statements, books or returns. Check-ins are kept up to 12 months.
3. OrgBooks on WhatsApp
When you send a bill, document or note to OrgBooks' WhatsApp number:
- Asked first: a number connects only when you tap Yes to OrgBooks' question in WhatsApp — whether the number was typed in OrgBooks or you sent OrgBooks' pairing code. The question says what is kept and for how long, and links this notice. When you tapped Yes, and the date of this notice, are kept with the connection.
- What we receive: your WhatsApp number, the WhatsApp profile name and ID Meta supplies, and the files or text you send.
- How it is kept: each file or note is encrypted on arrival with your OrgBooks folder's own public key and stored only in that encrypted form (Cloudflare R2 / KV). Only your OrgBooks, holding the matching private key, can open it. Your number, your account's e-mail address and the names of your OrgBooks users are stored sealed with a separate key; a stored item shows your number only masked.
- How long: until your OrgBooks brings the item in, and in any case no longer than 365 days, after which it is deleted automatically.
- Replies: OrgBooks on WhatsApp replies only to messages you send (for example, asking which user a bill is for). We do not send marketing messages.
- Withdraw consent and disconnect: send "STOP" in the chat, or remove the number in OrgBooks. Items already received stay until brought in or deleted as above.
- WhatsApp is provided by Meta and is subject to WhatsApp's own terms and privacy policy.
3A. OrgBooks by e-mail
OrgBooks can give your account one e-mail address of its own (for example k7q2m9x4vhtb@in.orgbooks.in). Bills you send or forward to it wait for your OrgBooks exactly as WhatsApp's do:
- Asked first: the address is issued only when you ask for it in OrgBooks; when you asked, and the date of this notice, are kept with it. Revoke it in OrgBooks at any time — mail to a revoked address is refused at the door.
- What we receive: the sender's address and name, the subject and date, the attachments, and the words you yourself wrote above any forwarded message. We do not keep the rest of the e-mail — not its other headers, not the forwarded message's own text, not the raw message.
- How it is kept: each attachment, and your words, are encrypted on arrival with your OrgBooks folder's own public key (Cloudflare R2), as on WhatsApp. A stored item shows the sender only masked. The address itself, its aliases, the senders you allow and the e-mail addresses you give your users are sealed with a separate key.
- Third parties' data: a forwarded invoice carries your supplier's name and contact details. What you forward is yours; OrgBooks keeps it for you alone, sealed, and cannot read it.
- How long: until your OrgBooks brings the item in, and in any case no longer than 365 days. Mail that is refused (too large, too many in a day, or not from an allowed sender) is not kept at all.
- No replies: OrgBooks sends no e-mail of its own — no acknowledgements, no marketing. Anything claiming to be an e-mail from OrgBooks is not.
- Withdraw consent: revoke the address in OrgBooks, or disconnect everything. Items already received stay until brought in or deleted as above.
4. Your rights under the DPDP Act, 2023
Under India's Digital Personal Data Protection Act, 2023 you may:
- Know what is held: ask for a summary of the personal data OrgBooks' services hold about you, what it is used for, and who it is shared with (the service providers below).
- Correct or erase it: ask for anything wrong to be corrected, completed or brought up to date, and for what is no longer needed to be erased.
- Withdraw consent — as easily as you gave it: send "STOP" on WhatsApp, remove the number in OrgBooks, revoke your OrgBooks e-mail address in OrgBooks, or write to us. Withdrawing does not undo what was done before it.
- Grievance redressal: write to Jatin Agrawal, the person who answers for OrgBooks, at support@orgbooks.in, from the e-mail address or WhatsApp number concerned. We answer within 30 days.
- Nominate: name someone to use these rights for you if you die or cannot act yourself — tell us who, in writing.
- Complain to the Data Protection Board of India if you are not satisfied with our answer.
5. What we never do
- We do not sell, rent or share your information with anyone for advertising or marketing.
- We do not use your information to train AI models.
- We do not log the contents of your messages, files, statements or returns.
6. Service providers
Cloudflare (website, sign-in, storage, receiving e-mail), Meta / WhatsApp (messaging), WhiteBooks (GST data access, only when you fetch returns), Google (only if you keep your OrgBooks folder in your own Google Drive — under your own Google account).
7. Your choices and deletion
You can stop using OrgBooks at any time; your folder remains yours. To have anything we hold deleted — your licence record, devices and check-ins (orders are kept as tax law requires), your call counts, WhatsApp or e-mail items not yet brought in, your number's link, or your OrgBooks e-mail address — write to support@orgbooks.in from the e-mail address or WhatsApp number concerned. We act within 30 days.
8. Security
Encryption at rest with your own keys, your number, your e-mail address and your OrgBooks e-mail address sealed in OrgBooks' store, sign-in through Cloudflare Access, signed webhooks from Meta, and no request logging. No system is perfectly secure; tell us at support@orgbooks.in if you suspect a problem.
9. Children
OrgBooks is not meant for children under 18.
10. Changes
We will update this page and its date when this notice changes.
11. Contact
Jatin Agrawal · Mumbai, India · support@orgbooks.in