Privacy Policy

Kliento (“we”, “us”, “our”) operates the freelancer invoicing platform at kliento.in. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).

By creating an account or using Kliento, you agree to the practices described here. If you do not agree, please do not use the service.

Kliento acts as the “Data Fiduciary” (under the DPDP Act) for the personal data you enter into the platform. You, in turn, act as Data Fiduciary for any data you upload about your clients (names, GSTINs, contact details, etc.); we act as your “Data Processor” for that subset.

We collect only what we need to deliver the service:

• Account data — email address, password (hashed), business name, owner name, phone number.
• Business data — GSTIN, state code, address, UPI ID, bank account details, invoice prefix, numbering preference.
• Client data you upload— your clients' names, companies, emails, phone numbers, GSTINs, addresses. You are responsible for the lawful basis of collecting this from your clients.
• Transactional data — invoices, quotes, line items, payment records, expenses, recurring schedules, client notes you write.
• Payment integration credentials — Razorpay key ID and key secret, encrypted at rest with AES-256-GCM before being stored.
• E-signature audit trail — when a client accepts a quotation, we record their typed name, email, IP address, browser user-agent, and timestamp.
• Usage data — basic logs (HTTP method, path, status code, response time) generated by Vercel and Supabase. We do not use third-party analytics that track you across other sites.

• To operate the platform — render your dashboard, generate invoices, calculate GST.
• To send transactional emails (invoices, reminders, quotes, account notifications) via Resend.
• To process payments via Razorpay (when you configure it) and reconcile incoming payments.
• To enable client portals (tokenised invoice/quote viewing without an account).
• To prevent abuse — rate-limiting, audit logging, anomaly detection.
• To respond to support requests and provide service updates.

We do notuse your data, your clients' data, or your invoice contents to train AI models, target advertising, or sell to third parties.

To deliver the service, we use a small set of trusted processors:

• Supabase — database hosting + authentication. Data resides in the AWS ap-south-1 (Mumbai) region.
• Vercel — application hosting and serverless compute.
• Resend — transactional email delivery.
• Razorpay— payment processing when you enable it. Payment-method details (card numbers, UPI VPAs) are entered directly into Razorpay's hosted forms; we never see or store them.
• Upstash — Redis for rate-limiting counters (ephemeral, no PII).

Each processor handles data only on our written instructions and only as needed to deliver their piece of the service. We do not sell or rent your data to anyone.

• While your account is active. All your data is retained to operate the service.
• After you delete your account. Personal data is purged within 30 days, except for records we are legally required to keep (e.g. tax invoices under Section 36 of the CGST Act must be retained for 72 months from the due date of the relevant return).
• Backups. Database backups roll on a 30-day window; deleted data is fully gone after that.

• TLS in transit on every request to kliento.in.
• Postgres Row-Level Security (RLS) enforces that you only ever read your own rows.
• Razorpay key secrets are encrypted at rest with AES-256-GCM.
• Server-side secrets (service-role keys, encryption keys) are stored in Vercel environment variables, never in the source repository.
• Rate-limiting protects against credential brute-force, cost-burn attacks, and abuse.
• Optional two-factor authentication via TOTP (rolling out shortly).

No system is perfectly secure. If you discover a vulnerability, please email security@kliento.in— we'll acknowledge within 48 hours.

The DPDP Act gives you the following rights regarding your personal data:

• Right to access. See what data we hold about you. Available from Settings, or by email request.
• Right to correction. Edit your profile, clients, invoices, and quotes at any time inside Kliento.
• Right to erasure. Delete your account from Settings → Danger Zone. Personal data is purged within 30 days (subject to legal retention obligations above).
• Right to grievance redressal. Raise a complaint with our Grievance Officer (below). If unresolved within 30 days, you may approach the Data Protection Board of India.
• Right to nominate. You may nominate another individual to exercise your rights in case of incapacity. Email us to set this up.

We use a small number of strictly-necessary cookies and local-storage entries:

• Authentication cookies — to keep you signed in (Supabase Auth).
• CSRF tokens — to protect against forged form submissions.
• UI preferences — e.g. sidebar collapsed state.

We do not use cookies for advertising, cross-site tracking, or analytics that identify you personally. No consent banner is shown because none of our cookies require consent under Indian law.

Kliento is not intended for users under 18 years of age. We do not knowingly collect data from children. If you believe a child has signed up, email us and we will delete the account.

We'll update this page if our practices change. Material changes will be notified by email and announced on the dashboard at least 14 days before they take effect. Continuing to use Kliento after the effective date means you accept the updated policy.

In compliance with the DPDP Act and the IT Rules, 2021:

This Privacy Policy is governed by the laws of India. Any disputes arising out of or relating to this policy will be subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka.