Privacy Policy
Last updated: 10 August 2026
This policy explains what information we collect when you use Onetap Business OS, and how we use and protect it.
Information we collect
Account and business details you provide (name, email, phone, business name, GST where given), the business data you enter into the product, and basic usage/analytics events needed to operate and improve the Service.
How we use it
To create and run your workspace, process payments, provide support, secure the platform, and improve the product. We do not sell your personal data.
Payments
Payments are processed by Razorpay. We store a record of your subscription/license and payment status; we do not store full card details on our servers.
Data separation
Your business data is isolated to your own tenant and is not shared with other customers.
Retention
We retain your data while your account is active. You can export core records; on account closure, data is handled in line with applicable law.
AI features
Some features use AI. When you use one, the content it is acting on — which can include customer names, phone numbers, product and price data, or document text — is sent to our AI provider to produce the result. AI output is a suggestion for you to check, not a decision made for you, and AI never changes your records without an explicit action by one of your users. See the Sub-processors page for who our AI providers are.
Who else processes your data
We use third-party services to host the product, take payments, send messages and provide AI features. Each one, what it is used for, and what data reaches it, is listed on our Sub-processors page.
Where your data is processed
Our hosting, database and several service providers operate from regions we do not restate here, because we will not make a data-residency commitment we have not verified. If your business needs a specific processing region, contact us before purchasing and we will confirm what we can actually offer in writing.
Retention
We keep your account and business data while your account is active. Some records — invoices, payment records and audit logs — are kept for longer where tax, accounting or legal obligations require it, and are not deleted on request while those obligations apply. Our full retention schedule is available on request.
Marketing messages
If you receive marketing from a business that uses our product, every message carries a way to stop it, and stopping applies to that business only. We honour it on our side automatically.
Your rights
Subject to applicable law you can ask us to give you a copy of your personal data, correct it, or delete it. Tenant administrators can export their organisation's records and request account deletion from Settings → Privacy in the product. For anything else, contact support@onetapos.com.
If your data is with one of our customers
When a business uses our product to manage its own customers, employees or suppliers, that business decides what is collected and why — we process it on their instructions. If your details are held by one of our customers, contact that business directly; we will pass on a request that reaches us and assist them in answering it.
Complaints
If you are not satisfied with how we have handled a privacy request, tell us at support@onetapos.com and we will escalate it internally. You may also complain to the relevant data protection authority.
Security incidents
We maintain an incident response process. If a breach affects your personal data we will act to contain it and notify affected customers and any authority we are required to notify, without undue delay.