Privacy Policy
Hisab Dost · Version 1.2 · September 2026
Contents
- Overview
- What Data We Collect
- Notification Access and UPI Auto-Capture
- How Your Data Is Processed
- Why We Use Your Data
- Data Sharing and Service Providers
- Data Security
- Your Privacy Rights
- Consent and Withdrawal
- Data Retention and Account Deletion
- Your Control
- Audit Records and Service Integrity
- Personal Data Breaches and Security Incidents
- Children and Age Eligibility
- Changes to This Privacy Policy
- Related Legal Pages
- Privacy and Grievance Contact
1 Overview
Hisab Dost is a bookkeeping service operated by Michio Systems Private Limited. It helps users record and review income, expenses, credit transactions, and related financial activity through the Hisab Dost Android app and supported messaging channels such as Telegram and WhatsApp.
The Android companion app may also process eligible payment notifications on the user's device to support optional UPI Auto-Capture and payment voice announcements.
For personal data processed for Hisab Dost, Michio Systems Private Limited acts as the Data Fiduciary where applicable under India's Digital Personal Data Protection Act, 2023.
Our aim is to provide a useful bookkeeping service while collecting and processing only information reasonably required for service delivery, security, account management, billing, support, and legal compliance.
2 What Data We Collect
We collect or process only data relevant to providing and operating Hisab Dost.
- Mobile phone number
- Telegram identifier or WhatsApp identifier, where applicable
- App-generated install identifier and device/security token used for authentication, account linking, security, service integrity, and abuse prevention
- Selected app language, selected service channel, and basic account configuration required to provide the service
- Transaction amount
- Transaction type, such as income, expense, credit given, or credit received
- Transaction date and time
- Party or merchant name, where available or entered by you
- Notes or descriptions that you intentionally submit to Hisab Dost
- UPI or transaction reference in hashed form where supported; raw UTR values are not stored by Hisab Dost
- Ledger entries, corrections, and deletion actions needed to maintain your bookkeeping history
- Information needed to generate summaries and reports
- When you intentionally send a bookkeeping command, entry, report request, or other service-related message to the Hisab Dost Telegram bot or WhatsApp account, Hisab Dost processes that message as necessary to understand and respond to your request.
- We do not intentionally collect unrelated personal chats, messages, or notifications that you do not send to Hisab Dost.
- Subscription status and plan
- Google Play product and subscription identifiers
- Purchase verification and subscription lifecycle information
- Payment, refund, reversal, payment-dispute, and chargeback information where applicable
- Records needed for billing reconciliation, support, fraud prevention, and dispute handling
- IP address
- Request date and time
- Limited API request and response metadata
- Authentication and device-token events
- Security, rate-limit, and abuse-prevention events
- Limited error and diagnostic information
- Account, consent, withdrawal, deletion, and security audit events
- Bank account numbers
- Credit or debit card numbers
- Banking passwords, MPINs, or OTPs
- Your bank account balance
- Hardware or advertising identifiers such as IMEI, Android Advertising ID, or device serial number
- GPS or precise location information
- Photos, documents, or other files stored on your device through the companion app's notification-access feature
Telegram, WhatsApp, Google Play, banks, and other third-party platforms may separately process and retain information according to their own terms and privacy policies.
3 Notification Access and UPI Auto-Capture
UPI Auto-Capture is an optional feature of the Hisab Dost Android app.
If you enable Android Notification Access, the app uses Android's Notification Listener Service to identify supported bank and payment notifications. Filtering and extraction are performed on the device before information is sent to Hisab Dost.
- Transaction amount
- Whether money was received or paid
- Transaction time
- Hashed transaction reference
- Merchant or party information where available
Raw payment-notification text is not transmitted to Hisab Dost servers through the UPI Auto-Capture process. Notifications that do not meet the app's supported payment filters are discarded from this processing flow.
Notification Access is controlled separately by Android. You can disable it at any time through the Hisab Dost app or Android Settings.
4 How Your Data Is Processed
For UPI Auto-Capture, the normal processing flow is:
| Step | What Happens | Where |
|---|---|---|
| 1 | Notification received | Your device |
| 2 | Filtered to determine whether it is a supported payment notification | Your device |
| 3 | Non-relevant notifications discarded from this processing flow | Your device |
| 4 | Limited structured transaction information extracted | Your device |
| 5 | Structured data transmitted securely via HTTPS | In transit |
| 6 | Eligible transaction stored in your ledger | Server |
For entries submitted through Telegram, WhatsApp, or the Hisab Dost app, the information you intentionally submit is processed to interpret the request, update your ledger, generate a report, or perform another service action you requested.
5 Why We Use Your Data
Your data is used only for identified Hisab Dost purposes. We do not use your personal or financial data for behavioural advertising or unrelated profiling.
| Data | Main Purpose |
|---|---|
| Mobile number | Account creation, linking, identification, and account management |
| Telegram or WhatsApp identifier | Delivering the selected messaging service and linking requests to the correct account |
| Ledger entries and transaction information | Bookkeeping, summaries, reports, corrections, and transaction management |
| Structured UPI data | Optional UPI Auto-Capture, duplicate detection, and eligible ledger creation |
| Device/security token | Authentication, account security, and prevention of unauthorised access |
| App language and settings | Providing the service in the selected configuration |
| Subscription and purchase information | Entitlement checks, billing reconciliation, refunds, disputes, and subscription support |
| IP and technical metadata | Security, abuse prevention, troubleshooting, and reliable service operation |
| Consent and legal acceptance records | Managing consent and maintaining evidence of the legal information accepted |
| Deletion and audit records | Account administration, security, legal compliance, and service integrity |
6 Data Sharing and Service Providers
We do not sell, rent, or trade your personal or financial data. We do not share Hisab Dost user data with advertisers or data brokers for advertising purposes.
We may use infrastructure and service providers where reasonably necessary to operate Hisab Dost, including providers of hosting and server infrastructure, database infrastructure, Telegram or WhatsApp communication services, Google Play distribution and billing, network and security services, and professional or regulatory support where required.
Only information reasonably necessary for the relevant service should be made available to a service provider. Where a provider processes personal data on our behalf, we seek to use appropriate contractual, technical, and organisational safeguards.
Some third-party platforms may independently process information under their own terms and privacy policies. Where data is processed or transferred outside India, applicable legal requirements and restrictions will apply.
We may also disclose personal data where required or authorised by applicable law, legal process, regulatory requirements, fraud prevention, security investigation, or enforcement obligations.
7 Data Security
- HTTPS/TLS encryption for data in transit
- Encryption of sensitive stored information
- SHA-256 hashed transaction references instead of storage of raw UTR values
- App-generated device/security-token authentication
- Restricted database access and least-privilege access controls
- API rate limiting and abuse protection
- Security and audit logging
- Infrastructure-level storage protection and encrypted backups
- Measures intended to keep raw notification text, OTPs, complete payment messages, and unnecessary financial information out of production Android logs
No electronic service can guarantee absolute security. We maintain safeguards designed to be appropriate to the nature of the data and the service.
8 Your Privacy Rights
Subject to applicable law, including the relevant provisions of India's Digital Personal Data Protection Act, 2023 as they come into force, you may have the right to:
- Information about personal data being processed about you
- Correction of inaccurate or misleading personal data
- Completion of incomplete personal data
- Updating of personal data
- Erasure of eligible personal data
- Withdrawal of consent for processing that depends on your consent
- Use of our grievance-redressal mechanism
- Nomination of another individual to exercise applicable rights in the event of your death or incapacity, in the manner provided by applicable law
You may contact us using the details in Section 17 to exercise applicable rights. Where required, we may ask for limited information necessary to verify that a request relates to the correct account.
Where applicable under the DPDP framework, you should first use Hisab Dost's grievance-redressal mechanism before approaching the Data Protection Board of India.
9 Consent and Withdrawal
Bookkeeping processing that relies on your consent can be stopped by withdrawing that consent.
You can use the consent controls provided in the Hisab Dost app to withdraw your bookkeeping consent.
- New consent-based bookkeeping processing stops.
- New bookkeeping entries and consent-based reports are disabled.
- UPI Auto-Capture processing is disabled.
- Telegram and WhatsApp bookkeeping processing that relies on the withdrawn consent is disabled.
- Bookkeeping and ledger data retained for that consent-based purpose is erased from active Hisab Dost systems, unless retention of specific information is necessary for compliance with applicable law.
- Your Hisab Dost account itself is not automatically deleted. Limited account, security, billing, legal, consent, withdrawal, and compliance records may remain where they are required for account administration or another lawful purpose.
Processing carried out lawfully before withdrawal is not made unlawful by the later withdrawal.
Withdrawing consent is different from requesting account deletion.
You may later give fresh consent again through the Hisab Dost app. Fresh consent must relate to the legal notice and purposes presented to you at that time. After fresh consent, bookkeeping starts with a new, empty ledger; bookkeeping data erased following the earlier withdrawal is not restored.
Where encrypted backups are used, residual copies of erased bookkeeping data may remain for up to 30 days before removal through backup rotation. Such residual backup copies are not used for normal bookkeeping processing.
10 Data Retention and Account Deletion
We retain personal data only for as long as necessary for the purposes for which it is lawfully processed, or for a period required or permitted by applicable law.
Moving between the Free Limited Plan and Paid Plan, expiry of a paid subscription, or uninstalling the Android app does not by itself constitute an account-deletion request.
- Account deletion applies to eligible data controlled and stored by Hisab Dost.
- It does not delete copies of messages or information independently retained by Telegram, WhatsApp, banks, Google, or other third parties.
- If deletion is cancelled during the pending window, the account is restored in accordance with the product process.
- Where encrypted backups are used, residual copies of deleted account data may remain for up to 30 days before removal through backup rotation.
- Limited information may be retained longer only where necessary for legal, accounting, tax, billing, refund, fraud-prevention, security, audit, payment-dispute, chargeback, or regulatory purposes, and only for the applicable purpose and period.
11 Your Control
You can control several aspects of Hisab Dost processing.
- Withdraw bookkeeping consent through the Hisab Dost app
- Give fresh consent again where available
- Disable Android Notification Access
- Stop using Hisab Dost at any time
- Uninstall the Android app
- Request correction, completion, updating, or erasure of eligible personal data where applicable
- Request complete account deletion using the supported deletion process
- Cancel a pending deletion request within the available cancellation window
- Use your device screen lock and Hisab Dost PIN or biometric App Lock to help protect local access
Uninstalling the app stops the app from accessing notifications on that installation, but does not by itself delete your Hisab Dost server-side account.
12 Audit Records and Service Integrity
We may maintain limited records necessary for security, authentication, consent and withdrawal evidence, legal-document acceptance, account deletion, subscription and billing administration, refund or payment-dispute handling, fraud and abuse prevention, and service integrity.
Audit records are designed to avoid storing unnecessary raw notification text, raw SMS content, OTPs, or complete payment messages.
Where applicable law requires certain records to be retained independently of your bookkeeping consent or account state, those records may be retained only for the required purpose and period.
13 Personal Data Breaches and Security Incidents
If we become aware of a personal data breach, we will investigate the incident and take reasonable steps to contain and mitigate it.
Where required by applicable law, we will notify affected users and the Data Protection Board of India or another competent authority, as applicable.
Such notification may include information about the nature and extent of the breach, possible consequences, measures taken or proposed by us, recommended steps that affected users may take, and contact information for further assistance.
14 Children and Age Eligibility
Hisab Dost is intended only for individuals who are 18 years of age or older. During onboarding, users are required to confirm that they are 18 years of age or older.
We do not knowingly provide Hisab Dost as a service for individuals under 18. If you believe that personal data relating to a person under 18 has been provided to Hisab Dost, please contact us so that we can review the matter and take appropriate action.
15 Changes to This Privacy Policy
We may update this Privacy Policy when Hisab Dost features, processing activities, legal requirements, or service providers materially change.
The current version and effective date will be displayed on this page.
Where a change materially affects consent-based processing or requires fresh consent under applicable law, we will provide appropriate notice and obtain fresh consent before relying on that consent for the changed processing.
Historical legal-document versions associated with consent records may be preserved where necessary to maintain evidence of what was presented and accepted at the relevant time.
16 Related Legal Pages
Terms of Service: michio.in/terms.html
Data Deletion Policy: michio.in/data-deletion.html
The current Consent Notice is presented in the Hisab Dost app before consent is recorded.
17 Privacy and Grievance Contact
Hisab Dost is operated by Michio Systems Private Limited.
For privacy-related questions, requests to exercise applicable data rights, consent matters, account deletion, or grievances, contact:
📧 Email: support@michio.in
🌐 Website: michio.in
We may request limited information necessary to verify that a request relates to the correct Hisab Dost account.
Privacy and data-rights requests will be handled within the period required by applicable law. Where the DPDP grievance-response requirement applies, Hisab Dost will publish and follow a grievance-response period not exceeding 90 days.
Where applicable under the DPDP framework, you should first use Hisab Dost's grievance-redressal mechanism before approaching the Data Protection Board of India.