Get started

Privacy notice

What this service collects, why, who else sees it, how long it is kept, and your rights.

Who we are

Clor is operated by Clor Applications Pvt Ltd, No. 8, Ground Floor, 5th Cross, Veerasagara Main Road, Meneshwara Layout, Attur, Yelahanka, Bengaluru 560064, Karnataka, India. In this notice “we” means the operator. Questions about your data go to [email protected]; complaints go to our grievance officer, Suresh Kumar, at [email protected].

Two kinds of data, two roles

Your account. Your name, email address and sign-in records are collected by us so you can use Clor. For these we decide why and how they are used.

Your business’s records. The customers, suppliers, employees, invoices, payments and other records a business keeps in Clor belong to that business. It decides what goes in and what it is used for; we store and process them on its behalf, to provide the service. If you are a customer, supplier or employee of a business that uses Clor and want to exercise your rights over those records, ask that business first — we will help it answer you.

What we collect

  • Account: name, email address, password (stored only as a one-way bcrypt hash, never in readable form), and — if you add them — first and last name, username, phone number and profile picture.
  • Company set-up: company name, state, GSTIN, PAN, addresses and contact details entered by the business.
  • Business records entered by users: customers and suppliers (names, GSTIN, PAN, contact people, email addresses, phone numbers, addresses), invoices, bills, payments, stock and accounts. Where a business uses Payroll: employee names and contact details, PAN, UAN, PF and ESI numbers, bank account number and IFSC, and salary, deduction and loan details.
  • Sign-in and security records: for each sign-in session and each sign-in attempt (including failed ones), the IP address and the browser’s identifying string (user agent), and the time. The IP address from which a password reset is requested. A log of changes made in each company, with who made them.
  • Emails we send you: a copy of each account email (email verification, password reset, invitations, approval requests) is kept with its recipient and subject. Sign-in links in those copies are removed once the email has been sent.
  • Server request log: the type of each request, the address requested (with share links, GSTINs and search terms removed), the result and the time it took.

We do not use analytics, advertising, tracking pixels, session recording or third-party cookies, and we do not sell personal data or use it to build profiles.

Why we use it

  • To provide the service: keep the books, documents and reports a business asks Clor to keep.
  • To sign you in, keep accounts secure, detect misuse and lock an account after repeated failed attempts.
  • To send the account emails listed above. We do not send marketing email.
  • To meet legal obligations that apply to us.

By creating an account you consent to this processing of your account data. You can withdraw that consent by asking us to close your account (see “Your rights”); processing that has already happened is not affected, and we may need to keep some records where the law requires it.

Who else receives it

  • Hosting: the servers and database run with Google Cloud, Mumbai region.
  • Email delivery: account emails go through an email (SMTP) server — ours, or one the business configures for its own company.
  • Only when a business switches them on:
    • a GST Suvidha Provider, which receives a GSTIN being looked up;
    • the government Invoice Registration Portal or a GST Suvidha Provider chosen by the business, which receives e-invoice data (both parties’ GSTINs, names and addresses, items and amounts);
    • an AI service (TypeSafe) that suggests a role for a new user from the job title and duties an administrator types — no financial or customer data is sent.
  • Payment reminders sent over WhatsApp or email are sent from the user’s own device and accounts, not by us.
  • Anyone we are required by law to disclose data to.

How long we keep it

  • Password-reset and email-verification records: deleted 7 days after they expire or are used.
  • Ended sign-in sessions, with their IP address and browser: deleted 90 days after they end.
  • Sign-in attempt history: [retention period to be decided by the operator].
  • Account data: while the account is open, and afterwards only as long as the law requires. When a business closes its company, the company is deleted after a 30-day notice period, and backups that hold it expire within 7 days after that.
  • Business records: as the business instructs. Tax and company law can require a business to keep its accounting records for several years; that obligation is the business’s.
  • Backups: overwritten on a rolling basis (the most recent 30 daily copies by default).

How we protect it

Passwords are stored as bcrypt hashes. The long-lived sign-in token is kept in a cookie scripts cannot read, and if an old copy of it is ever replayed, every session on the account is signed out. Stored credentials for email servers and e-invoice portals are encrypted (AES-256-GCM). Access inside a company is limited by roles and permissions, and changes are logged. Payroll bank account numbers and PAN are masked from people without permission to see them. Repeated failed sign-ins lock the account for a time. Backup files are readable only by the server’s administrator.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

Your rights

  • See your data: download everything held about your account from Profile → Your data and privacy. A business can export its own records from Settings → Backup in Accounting, or ask us for an export.
  • Correct it: edit your name, username, phone and picture in your profile; ask us, or your company’s administrator, to change your email address.
  • Erase it / withdraw consent: write to [email protected]. Closing an account is not yet self-service; we will act on the request within the time the law allows and tell you what, if anything, must be kept and why.
  • Nominate someone to exercise these rights if you die or become unable to: write to us.
  • Complain: to our grievance officer first (above). If you are not satisfied, you may complain to the Data Protection Board of India.

Children

Clor is a tool for businesses and is not meant for anyone under 18. We do not knowingly create accounts for children.

Changes to this notice

We will post any change here with a new effective date, and tell account holders by email before a change that affects how their data is used.