Sathi Vyapar · Phone Care

Privacy Policy

Last updated: 14 October 2026

Your shop’s data belongs to your shop. This policy explains what we collect, how it is kept secure and the limited cases in which it is shared – and confirms that we never sell it or share it for marketing.

1. Who we are and what this policy covers

Sathi Vyapar (സതി വ്യാപാർ) is billing, inventory, accounting and service-desk software for shops and small businesses. It is owned and operated by Phone Care, Phone Care, Kattappana P.O, Kattappana, Idukki District, Kerala, India – 685508 (“Phone Care”, “we”, “us”, “our”).

This Privacy Policy explains what information we collect, why, how it is stored and protected, who it is shared with and the rights available to you. It applies to:

• this website, myworksphere.in;
• the Sathi Vyapar web application at app.myworksphere.in, including when it is installed as a Progressive Web App (PWA);
• the Sathi Vyapar Windows desktop application; and
• the Sathi Vyapar Android application

(together, the “Service”). It is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”), to the extent they apply.

2. Two kinds of data, two different roles

The Service holds two different kinds of information, and our responsibility differs for each.

2.1 Account information – we decide how it is used

Information about the business that subscribes to Sathi Vyapar (the “Shop”), its owner and the staff it adds as users: names, mobile numbers, roles, the shop’s name, address and registration details, and the subscription and payments made to us. For this information we act as the Data Fiduciary under the DPDP Act.

2.2 Business data – it belongs to the Shop

Everything a Shop records while running its business through the Service: its customers, suppliers and staff, items and stock, invoices, payments, expenses, job sheets and reports (“Business Data”).

3. Information we collect

3.1 Information you give us

• Account and sign-in: the owner’s and staff members’ names, mobile numbers and roles; passwords or screen-lock PINs if you set them (stored only as one-way hashes – see section 7).
• Shop profile: shop or legal name, address, phone, email, GSTIN, PAN, state, logo, signature, bank and UPI details that you choose to print on invoices, and your tax and print settings.
• Business Data you enter: customer and supplier names, phone numbers, addresses, GSTINs and balances; items, prices and stock; sale, purchase, return and expense documents; payments; job sheets for repairs (device brand and model, IMEI or serial number, the condition and accessories noted at intake, photographs of the device, and any device passcode the Shop chooses to record); staff attendance and salary records.
• Field and route features (only if the Shop turns them on): the location of a salesperson or technician while they record visits, trips or field attendance during working hours, and the attendance photograph (selfie) they take.
• Payments to us: the plan bought, the amount, the date and the payment reference (such as a UPI transaction / UTR number or a payment-gateway reference).
• Support and requests: what you tell us by WhatsApp, phone or email, and feature requests sent from inside the app.

3.2 Information collected automatically

• Technical and security data: IP address, a device identifier created by the app, the browser or app version, sign-in times, and error reports from the app – used to keep accounts secure, apply the number of devices allowed by your plan, keep computers in sync and fix faults.
• Data stored on your device: the web and mobile apps keep your sign-in session and screen preferences in your browser’s storage. The Windows desktop application keeps a full working copy of the Shop’s data on that computer so that billing continues without the internet, and synchronises it with our servers when online.

3.3 What this website does not do

myworksphere.in uses no advertising cookies, no third-party analytics and no tracking pixels. Its pages load only from our own server.

4. How we use information

• to provide, operate and maintain the Service, and to keep a Shop’s computers, phones and web sessions in sync;
• to verify sign-ins – one-time codes are sent on WhatsApp – and to protect accounts against misuse;
• to send the messages a Shop asks the Service to send, such as invoices, job-sheet updates and payment reminders to its own customers;
• to activate and manage subscriptions, record payments and issue receipts;
• to answer support requests and tell you about changes that affect your account (service notices are not marketing);
• to detect, investigate and prevent fraud, abuse, security incidents and violations of our Terms and Conditions;
• to improve the Service using aggregated or de-identified information that does not identify any Shop or person; and
• to comply with law and with lawful requests of courts and government authorities.

We do not make automated decisions that produce legal effects about any individual, and we do not build advertising profiles.

5. Who information is shared with

We share information only as described below, and only as much as each purpose needs:

• Hosting: our servers are rented from DigitalOcean and are located in Bengaluru, India.
• WhatsApp (Meta Platforms): sign-in codes are sent through the WhatsApp Business Platform. When a Shop links its own WhatsApp number to send invoices and updates, those messages go from the Shop’s number through WhatsApp under WhatsApp’s own terms and privacy policy.
• Payments: banks, UPI apps and payment gateways process the payments you make to us. They collect your card, bank or UPI details directly; we never receive or store card numbers, CVV, UPI PIN or net-banking passwords.
• Product look-ups: the compatibility finder may ask a web-search provider about device models; only the model names typed are sent, never personal data.
• The Shop’s own people and customers: staff see what their role permits; documents reach the Shop’s customers when the Shop sends or shares them.
• Legal requirements: when required by law, a court order, or a lawful request of a government or regulatory authority in India, or to protect the rights, property or safety of Phone Care, our users or the public.
• Business transfer: if Sathi Vyapar is sold or merged, information may move to the new owner, who must keep honouring this policy; we will tell Shops before that happens.

We never sell or rent personal data or Business Data, and we never share it with anyone for their marketing.

6. Where data is stored

Data on our servers is stored in India (Bengaluru). The desktop application stores the Shop’s data on the Shop’s own computer, and the mobile app may keep limited data on the phone to work quickly; that data stays under the Shop’s control and protection.

7. How data is protected

• Encryption in transit: all traffic between your browser or app and our servers is encrypted with HTTPS / TLS.
• Passwords and PINs: never stored in readable form – only as salted one-way hashes (bcrypt), which even we cannot read back.
• Access control: every request is checked against the signed-in user’s Shop and role; technicians and other limited roles see only what the Shop allows, and customer phone numbers can be masked from them.
• Separation: each Shop’s records are kept apart by the Shop’s identity on every query; one Shop cannot read another Shop’s data.
• Restricted servers: server access is limited to authorised personnel using key-based authentication, and the database is not reachable from the public internet.
• Backups: the database is backed up before every update of the Service, so a fault can be undone.
• Device limits and sign-in codes: sign-in uses one-time codes, and a plan’s device limit stops an account being opened on unlimited machines.

The Shop is responsible for the security of its own computers, phones, staff logins and printed or exported documents. No method of transmission or storage is completely secure; we follow reasonable security practices and keep improving them. If a personal-data breach affects you, we will inform the affected Shops and the authorities as the law requires.

8. How long data is kept

• Account and Business Data: for as long as the Shop’s account exists, so that the Shop can keep working, renew and export its records. An expired plan does not by itself delete any data.
• Device photographs on job sheets: kept for a limited period (currently 15 days) and then deleted automatically.
• Deletion on request: when a Shop’s owner asks us in writing to delete the Shop’s account and data after the subscription ends, we delete it from our servers within 30 days, except what we must keep to meet a legal obligation, resolve disputes or enforce our agreements. Copies on the Shop’s own computers are deleted by the Shop.
• Payment records: kept for as long as tax and accounting laws require.

Each Shop remains responsible for keeping its own business records for the periods required by GST and other laws, and can export them at any time (Export to Excel, Backup to Computer).

9. Your rights

Subject to the DPDP Act and other applicable law, you may ask us to:

• tell you what personal data about you we process and with whom it has been shared;
• correct, complete or update it;
• erase it, where it is no longer needed or you withdraw a consent the processing relied on;
• address a grievance about how it was handled; and
• nominate another person to exercise these rights in case of your death or incapacity.

If you are a customer of a Shop that uses Sathi Vyapar, that Shop controls your records: please contact the Shop first. If you contact us, we will pass your request to the Shop and help it respond.

We may need to verify your identity before acting on a request. Withdrawing consent or deleting an account may mean the Service can no longer be provided.

10. Messages a Shop sends to its customers

Invoices, job-sheet updates, reminders and other messages a Shop sends through the Service are composed and sent on the Shop’s instructions. The Shop is responsible for having a lawful basis, including any consent required, to message its customers, and for complying with WhatsApp’s terms when it links its own number.

11. Children

The Service is meant for businesses and is not directed at children. Accounts must be created and managed by persons aged 18 or over.

12. Changes to this policy

We may update this policy as the Service or the law changes. The “Last updated” date above shows the current version; material changes will be notified in the app or by WhatsApp or email before they take effect. Continuing to use the Service after the change means you accept it.

13. Grievance Officer and contact

Questions, requests and complaints about privacy may be sent to our Grievance Officer. We will acknowledge a complaint within 48 hours and aim to resolve it within 30 days of receiving it.