Privacy Policy

Effective and last updated: July 5, 2026

Lorvix Solutions operates Lorvix Billing ("Lorvix Billing", "we", "us", or "our"). This Policy explains how we collect, use, disclose, retain, and protect personal data when you visit or use Lorvix Billing. It should be read with our Terms and Cookie Policy.

1. Our role and your responsibility

We are responsible for personal data used to create, secure, bill, and administer Lorvix Billing accounts. Businesses using the service determine the customer, supplier, invoice, payment, product, and employee information they enter. For that business data, the account owner is responsible for having a lawful reason to collect it, giving required notices, and responding to the rights of those individuals; we process it to provide the service.

2. Information we collect

  • Account and verification data: email, password hash, OTP and verification state, account status, referral relationships, and registration date.
  • Business profile data: company and contact names, phone, address, state, GST number, logo, payment QR image, bank details, invoice terms, GST preferences, and selected invoice template.
  • Business records: customers and their contact/GST details, products, invoices and line items, notes, payments, purchases, suppliers, expenses, and reports.
  • Subscription data: plan, subscription dates and status, autopay state, referral rewards, and Razorpay order, payment, and subscription identifiers. We do not receive or store full card, UPI PIN, or banking credentials.
  • Security and technical data: IP address, login attempts, timestamps, session information, browser/device request data, error logs, and security events.
  • Communications: support requests and transactional email delivery information.
  • Usage and campaign data: aggregate counts, activity dates, page views, campaign source information, pricing/register interest, checkout-start events, and similar analytics used for administration, service limits, reliability, product analytics, and advertising measurement.

3. How and why we use data

  • Register, verify, authenticate, secure, and administer accounts.
  • Provide invoicing, product, customer, purchase, payment, GST, reporting, export, and PDF features.
  • Process subscriptions, verify payments, support autopay, prevent duplicate benefits, and apply referral rewards.
  • Send OTPs, password-reset, registration, payment, referral, security, administrative, and support emails.
  • Enforce plan limits, investigate abuse, prevent fraud, rate-limit attempts, diagnose failures, and protect tenants.
  • Maintain, measure, troubleshoot, and improve performance and usability.
  • Measure marketing campaigns, understand which pages or ads led to visits or plan interest, and improve our advertising after optional marketing consent.
  • Comply with applicable tax, accounting, consumer, payment, legal, and regulatory obligations and respond to valid legal requests.

Depending on applicable law, these activities rely on performing our agreement with you, your consent, compliance with law, and legitimate uses necessary to operate and secure the service. You may withdraw consent where processing depends on consent, but this does not affect earlier lawful processing and may prevent us from providing the affected feature.

4. Payments and recurring billing

Razorpay processes checkout and recurring payment authorization under its own privacy terms. Razorpay may collect payment, device, fraud-prevention, and transaction data directly. We receive identifiers and status information needed to verify payments, activate plans, reconcile transactions, provide support, and manage subscription renewals.

5. Service providers and disclosure

We disclose only what is reasonably needed to:

  • Hosting and database providers that run the application and store tenant data.
  • Cloudinary for uploaded business logos, payment QR images, and application images.
  • Razorpay for payment processing, verification, subscriptions, fraud prevention, and payment support.
  • Email providers for OTPs and other transactional messages.
  • Meta Pixel and Google Analytics for optional campaign measurement, page analytics, and advertising performance reporting after marketing consent.
  • Infrastructure libraries and content-delivery providers needed to deliver interface assets.
  • Professional advisers, auditors, an acquiring business, or authorities where reasonably necessary or legally required.

We do not sell or rent personal data and do not use tenant business records, invoice contents, customer records, supplier records, payment register contents, or product catalog data for third-party advertising. Providers may process data in countries where they operate and are subject to their own legal obligations.

6. Tenant isolation and administrative access

Application controls are designed so each tenant can access only its own business records. Authorized administrators may access account, subscription, security, aggregate usage, and high-level financial summary information such as invoice counts, customer counts, product counts, payment counts, plan status, last activity, and total invoiced value for support, safety, billing, product improvement, abuse prevention, and platform administration. We do not use this administrative analytics access to read or target individual tenant business records for advertising. We restrict access to people and providers who need it, but no technical control can eliminate every risk.

7. Retention and deletion

We retain data while an account is active and afterward only for legitimate operational, backup, fraud-prevention, dispute, accounting, tax, and legal purposes. Retention varies by record type and applicable law. Deleted records may remain temporarily in backups and logs until they are overwritten through normal cycles. Payment and legal records may be retained even after an account closes. When retention is no longer justified, data is deleted, de-identified, or aggregated. Contact support to request account deletion or an available data export before closure.

8. Security

Measures include password hashing, OTP verification, HTTPS-only secure and HttpOnly cookies, tenant-level authorization, CSRF protections, rate limiting, security headers, payment signature verification, upload validation, access controls, and logging. Internet services cannot be guaranteed completely secure. Keep credentials confidential, use a unique password, sign out on shared devices, verify exported files before sharing, and report suspected misuse promptly.

9. Cookies and similar storage

We use essential authentication/session cookies, an optional remember-me cookie when selected, and browser storage for theme and notice preferences. Payment providers may use their own storage during checkout. With marketing consent, Meta Pixel and Google Analytics may be used to measure visits, campaigns, pricing/register interest, and checkout-start events. Details and controls are provided in our Cookie Policy.

10. Your choices and rights

Subject to applicable law and verification of your request, you may:

  • Access, correct, or update account information.
  • Request information about processing and recipients.
  • Request deletion of personal data that is no longer lawfully required.
  • Withdraw consent, object, restrict processing, or request portability where those rights apply.
  • Raise a grievance and, where applicable, nominate another individual or complain to a competent data-protection authority.

Requests involving data entered by one of our business customers should first be directed to that business. We may need to verify identity, preserve another person's rights, or retain data where law permits or requires it.

11. Cross-border processing

Providers may process or store data outside your state or country. Where required, we use reasonable contractual, organizational, and technical safeguards and comply with applicable transfer restrictions.

12. Users under 18

Lorvix Billing is intended for business use. A person under 18 may use the service only with the supervision and authorization of a parent, legal guardian, or authorized adult who is responsible for the account, submitted data, and payments. Do not submit a child's personal data unless it is lawfully necessary and supported by all required permissions.

13. Changes

We may update this Policy as the service, vendors, or law changes. We will post the revised version and effective date and provide additional notice where required. Material changes apply prospectively unless law permits otherwise.

14. Contact and grievance requests

Contact Lorvix Solutions at support@lorvixsolutions.in for privacy, account deletion, security, or grievance requests. Include the account email and enough detail for us to verify and respond to the request; never send your password or OTP.