Privacy policy

Version 1.0 · in force from 20 September 2026

In short: Vastra is business software. We hold the books you keep in it and the account you sign in with. We do not sell that to anybody, we do not advertise in it, and there is no tracking of any kind in the Android app.

1. Who this policy is from

Keycode Technology Pvt. Ltd. ("we"), which publishes KeyCodeVastra: this website, the Vastra Android app, and the server the app talks to. If you use any of them, this policy applies to you.

2. Two different people appear below

You, the shopkeeper. You hold an account, you sign in, and you run your shop in Vastra.
The customers and suppliers you enter. Their names, phone numbers and account balances are your records. We hold them on your behalf so that your software works. We do not use them for anything of our own.

3. What we hold about you

Your account: your name, your email address, your password, and the times you signed in. The password is never kept as you typed it - only a one-way cryptographic hash, which cannot be turned back into your password.
Your shop: the company details you register - trading name, GSTIN, address, the branches and counters you set up.
Your books: items, barcodes, purchases, sales, returns, payments, receipts, customers, suppliers and everything else you enter or scan. This is the substance of the service.
If you write to us: the name, email, phone number and message you send through the contact form or the account deletion form.

4. What the Android app collects

Less than you may expect, and this is the part a Google Play reviewer is asking about.

It asks for one permission: internet access. No location, no camera, no contacts, no files, no phone state.
It contains no advertising, no analytics and no third-party software kit of any kind - not one external library. Nothing in it reports to anyone but our own server.
It does not collect a device identifier or an advertising ID.
When you sign in, your email and password are sent to our server over an encrypted connection and exchanged for a sign-in token. Your password is never stored on the phone. The token is kept in the app's own private storage, expires by itself, and is erased when you sign out.
The reports you look at are fetched when you open them, and are not copied anywhere else.

5. What we use it for

To run the service: to show you your books, and to keep one shop's data apart from every other shop's.
To let you in, and to keep other people out.
To answer you when you write to us.
To bill you for your subscription, and to tell you about the service you pay for - a renewal, a fault, a change to these terms.

6. What we never do

We do not sell or rent your information, or your customers' information, to anybody.
We do not use your books to advertise to you or to anyone else.
We do not share your data with another customer of ours. Each shop's records sit in its own database, and a sign-in reaches that database and no other.

7. Who else can see it

Our hosting and database providers, who keep the servers the software runs on. They hold the data; they do not use it.
Our own staff, only so far as is needed to support you or to fix a fault, and only when there is a reason.
A public authority, if the law requires it of us.

Nobody else.

8. How it is protected

Everything between the app or your browser and our server travels over HTTPS, encrypted in transit.
Passwords are stored only as salted one-way hashes.
Each shop has its own database. The sign-in token carries which one, and a request that does not name one is refused rather than sent somewhere by default.
Within your shop, what each of your own users may see and do is yours to set.

9. How long we keep it

Your books stay for as long as your account is open, and after it closes for as long as Indian tax law requires books of account to be kept (at present at least six years from the end of the financial year). We cannot delete invoices earlier than that, even if asked.
Your sign-in account is deleted when you ask - see below.
Messages you send us are kept while the matter is open, and then while we may still need to show what was agreed.

10. Deleting your account

You can ask for your account to be deleted at any time, from the phone or from a browser: the account deletion page. It says exactly what is removed, what has to be kept, and how long it takes.

11. What else you may ask for

A copy of what we hold about you.
A correction, if something is wrong.
An export of your books, which you can also take yourself from the reports in the software.

Write to us at the address below and we will answer within 30 days.

12. Children

Vastra is software for running a business. It is not meant for children, and we do not knowingly hold information about anyone under 18.

13. Changes to this policy

If this policy changes, the new version appears on this page with a new version number and date. The version you agreed to stays readable - a superseded version is retired, never overwritten.