Privacy Policy

What we collect, and why

• Business identifiers — GST number, legal/business name, city — to verify that the account belongs to a real registered business and to display the business in the directory.
• Contact details — email address (and optionally a phone number) — used to send sign-in OTPs, account-critical notifications and support replies. We never display your phone or email next to ratings on a company's public profile.
• Ratings and replies you post about other businesses, and any reply you post as a claimed owner — needed to operate the trust network.
• Private evidence notes attached to "Bad payer" or "Avoid" ratings (e.g. invoice number, amount, month, an optional attachment) — used only for moderation and dispute resolution.
• Limited technical data — IP address, device/browser information, basic event logs — to keep the platform secure, debug issues and detect abuse.

What is shown publicly

• Your business name, city, and GST.
• The Good / Bad / Avoid tag you post on another company.
• The date a rating was posted (your identity is not shown next to individual ratings on a company's public profile).

What stays private

• Private evidence notes attached to a "Bad payer" or "Avoid" rating (invoice number, amount, month, optional note or attachment) are visible only to the member who wrote them and to HisaabScore administrators. They are never shown on the public company profile, never shared with the rated business, and never sold.
• Dispute reports you file about a rating are visible only to HisaabScore moderators and to you.
• Your phone number and email are used for authentication and account communication only; they are never displayed next to ratings and never sold.

We never sell your data

HisaabScore does not sell, rent, or trade personal data to advertisers, marketers, data brokers or any other third party. We share data only with the limited service providers we need to operate the platform (such as hosting, email delivery and GST verification), under contracts that restrict what they may do with it.

Your rights as a member

Under the DPDP Act you have the right to:

• Access — request a summary of the personal data we hold about you and how we process it;
• Correction & erasure — request that we correct inaccurate personal data, or delete personal data that is no longer necessary for the purpose for which it was collected (subject to lawful retention requirements);
• Withdraw consent — withdraw any consent you previously gave, by closing your account from your dashboard or by contacting us; and
• Grievance redressal — raise a grievance with our Grievance Officer (see below).

We will respond to verified requests in line with the timelines required by the DPDP Act and other applicable law.

Grievance Officer

Grievance Officer: Shelly
Email: info@hisaabscore.com
We acknowledge grievances within 24 hours of receipt and aim to dispose of them within 15 days, in line with the timelines prescribed by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

Security

We use industry-standard technical and organisational safeguards — including encrypted connections (HTTPS), encryption at rest of our managed database, OTP-only passwordless authentication, role-based access controls and audit logging — to protect personal data against unauthorised access, loss or misuse. No system can be made perfectly secure; members should keep their sign-in credentials confidential and notify us promptly of any suspected compromise.

Cookies and analytics

HisaabScore uses a small number of strictly necessary cookies and local-storage entries to keep you signed in and to remember your preferences. We use first-party, privacy-respecting analytics to understand which features are used and to fix bugs; we do not run third-party advertising trackers, and we do not build advertising profiles of members.

Account deletion

You can ask us to delete your account and your associated personal data at any time from your profile, or by contacting the Grievance Officer. Where applicable law requires us to retain certain records (for example, audit logs of moderation decisions or anti-abuse logs), we will retain only what is required, for only as long as required.