Privacy Policy

Effective Date: October 26, 2026

Last Updated: October 26, 2026

Website: https://hisab-in.com

Support Contact: help@hisab-in.com

Welcome to Hisab-in (“we,” “our,” or “us”). Hisab-in provides a web-based and offline-capable financial ledger, invoicing, client management, and business operations workspace designed for freelancers and independent professionals at https://hisab-in.com.

This Privacy Policy explains what information we collect, how we use and protect it, how our Google Drive and Google Docs integration handles your Google user data, and the choices you have regarding your data.

1. Information We Collect

A. Account & Authentication Information

• Direct Registration: When you create an account, we collect your name, email address, and account consent timestamp. Passwords are stored exclusively as one-way cryptographic hashes managed by WordPress authentication; we never store or view plaintext passwords.
• Two-Factor Authentication (2FA): If you enable Time-based One-Time Password (TOTP) protection, your authenticator secret and hashed one-time recovery codes are encrypted on our server using AES-256-GCM.
• Google Sign-In (openid, email, profile): If you choose to sign in or link your account with Google, we receive your verified Google email address, display name, and unique Google account identifier (sub) to authenticate your account.

B. Workspace, Financial & Business Records

• Ledger & Business Data: We store the income entries, expenses, client profiles, projects, proposals, agreements, time logs, retainers, invoices, and payment records that you enter into your Personal or Freelancer workspace.
• Proof Vault & Sensitive Documents: Payment receipts (PNG, JPEG, WebP, or PDF files up to 2 MB) and agreement documents saved in your workspace are encrypted at rest on our server using AES-256-GCM authenticated encryption prior to database storage.
• Access Payment Verification: When you submit the one-time PKR 500 workspace activation payment, we collect the payer name, transaction reference number, payment date, and optional payment receipt screenshot solely to verify your transfer and activate your account.

C. Local Device Storage (Offline-First PWA)

• To enable offline functionality, your browser stores a local copy of your workspace records inside IndexedDB and caches application assets via a Service Worker on your device.
• Local device data remains on your browser until it syncs with our server or until you sign out. When you click Sign out and clear this device, local IndexedDB records on that browser are permanently erased.

2. Google API Services & Google User Data Policy (Google Drive & Docs Integration)

Hisab-in’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A. Google Scopes We Request

When you use 1-Click Connect Google Drive or Continue with Google, we request only the following narrow, non-restricted permissions:

• openid, email, profile: To verify your identity and link your Hisab-in account.
• https://www.googleapis.com/auth/drive.file: To create and update only the specific backup folder (Hisab-in backups), JSON backup file (Hisab-in-full-backup.json), and Google Document (Hisab-in financial backup or a specific Google Doc you explicitly select via the Google Picker) created or opened by Hisab-in.

B. How We Use Your Google Data

• Strict One-Way Backup: Hisab-in uses drive.file access strictly to write and update your financial backup files in your personal Google Drive and Google Docs.
• Zero Access to Other Drive Files: Hisab-in cannot see, list, read, modify, or delete any other files, photos, or documents in your Google Drive.
• No Advertising or Third-Party Sharing: We never sell, rent, share, or transfer your Google user data or Google Drive content to third parties, advertisers, data brokers, or AI model training pipelines.
• Token Security & Revocation: Your OAuth refresh and access tokens are encrypted on our server using AES-256-GCM and are never exposed to client browsers. You can disconnect Google Drive at any time from Dashboard → Google backup → Disconnect Google Drive, which deletes your stored OAuth tokens from our server and revokes the token with Google.

3. Optional AI Business Assistant

• Hisab-in includes an optional Business Assistant and AI Agreement / Reminder Drafter powered by the OpenAI API.
• Explicit Opt-In Consent Required: No workspace data is ever sent to the AI provider automatically. Data is transmitted only when you explicitly check the consent box or confirm the prompt and click the AI action button.
• Data Minimization: When you approve an AI request, only your question and the calculated financial summary or draft fields shown on screen are sent over HTTPS with store: false so your data is not stored by the AI provider for model training. Encrypted proof files, passwords, and OAuth tokens are never sent to AI.

4. How We Use Your Information

We use the information we collect solely to:

1. Provide, maintain, sync, and back up your Hisab-in workspace across your devices.
2. Verify your one-time PKR 500 access payment and send account status notifications.
3. Send transactional emails (password setup/reset links, sign-in security alerts, and opt-in invoice due-date reminders) via our configured SMTP provider.
4. Provide customer support, account recovery, and security auditing when requested by you.

5. Data Sharing, Administrator Access & Security

• No Sale of Personal Data: We do not sell, rent, or trade your personal or financial records to any third party.
• Administrator Support Access: Synced ledger and workspace records are stored on Hisab-in.com’s hosting database. While passwords are hashed and proof files, contracts, 2FA secrets, and OAuth tokens are encrypted using AES-256-GCM tied to site security keys, the website administrator can view customer account metadata and read-only ledger records for technical support, payment verification, and account recovery. All administrator support actions are logged in an internal audit trail.
• Team Access (Optional): If you explicitly grant Team Access (view, edit, or financial role) to another active Hisab-in user, that user will be able to view or edit the specific client, project, or financial records permitted by the role you assigned until you revoke their access.

6. Data Retention, Export & Deletion

• Full Data Portability: You can download a complete, restorable JSON backup (hisab-backup-YYYY-MM-DD.json) or CSV report of your workspace at any time from your Account or Reports screen.
• Account & Data Deletion: You may request complete deletion of your Hisab-in account at any time by emailing help@hisab-in.com from your registered email address. When your WordPress user account is deleted, all associated Hisab-in database records (entries, resources, payments, access, and stored Google OAuth tokens) are permanently deleted from our server. Backups already saved inside your personal Google Drive remain in your Google account under your control.

7. Changes to This Privacy Policy & Contact Us

We may update this Privacy Policy from time to time to reflect security, legal, or product improvements. The updated version will always be posted on this page with a revised “Last Updated” date.

If you have any questions, privacy requests, or account deletion requests, please contact us at:

Email: help@hisab-in.com

Website: https://hisab-in.com