Privacy Policy
Last updated: 2026-09-28
This Privacy Policy explains how 399apps ("we", "us", "our") — operated by shabuilds (shabuilds.tech) — collects, uses and protects information when you visit 399apps.com, use any of our products (Nidhi Books, Nidhi Inventory, Nidhi POS and the other Nidhi apps), or use our Android app.
We sell business software to small and growing businesses, communities and operators — primarily in India, but also internationally. We try to keep this policy short, plain-spoken and honest. If something here is unclear, write to us and we will explain.
Who we are
399apps is a small catalogue of business SaaS — GST-ready accounting and inventory — built and run by shabuilds. We sell our products either as a managed cloud service on 399apps.com, or as a self-hosted licence that you deploy on your own server.
When we say "you" in this policy we mean either a visitor to our website, a customer using one of our products, or — for white-label and self-hosted deployments — an organisation operating a 399apps product under its own brand.
What information we collect
We collect only what we actually need to run the service:
- Account & contact details. Name, work email, company, phone or WhatsApp number, country — collected when you fill the contact form, sign up for a cloud account, request a demo, or write to us.
- Product data on cloud. The business data you put into our products on the 399apps cloud — invoices, GST and TDS records, stock items — is stored on our managed infrastructure on your behalf. We treat it as confidential customer data.
- Product data on self-host. When you self-host a 399apps product, your business and customer data lives entirely on your server. We do not receive it, do not back it up and cannot access it. Optional anonymous product telemetry (whether a deployment is healthy, version numbers) can be turned off.
- Payment information. Cloud subscriptions are billed via UPI, NEFT/RTGS, or via Razorpay/Stripe/Cashfree for cards. We never see or store your full card number; only the cardholder name, last four digits and an opaque token from the payment provider.
- Usage logs. Standard server logs — IP address, user agent, pages visited, timestamps — used for security, debugging and aggregate analytics. We do not run any advertising or ad-profiling trackers on our websites.
- Support conversations. Emails, WhatsApp messages and support tickets you send us, kept for the period required to help you and to improve the product.
How we use your information
We use the information above only for specific, narrow purposes:
- To deliver the products. Host your cloud workspace, run backups, serve your invoices, send transactional emails (account, password, billing, alerts).
- To support you. Respond to questions, debug issues, run guided migrations from Tally / Zoho / QuickBooks when you ask, and help you scope self-host or white-label deployments.
- To keep things safe. Detect abuse, prevent fraud, investigate suspicious activity, and meet our security commitments to you.
- To improve the product. Aggregate usage analytics to understand what features are used, what is broken and what to build next. We do not profile you for advertising.
- To meet legal obligations. GST invoicing, TDS reporting, statutory record-keeping and lawful requests from authorities — only to the extent required.
Cloud vs self-hosted — what changes
This is the most important practical distinction in our service.
On the 399apps cloud, your business data is hosted on infrastructure operated by us using Cloudflare and AWS, with the India region as the default. We are the data fiduciary for your account-level data, and a data processor for the customer-records you put into the apps (your customers, members, candidates, vendors).
On self-host, your data never leaves your server. We do not have credentials, we do not back it up, and you decide who in your team has access. Our role is limited to providing the licensed software, version updates, security patches and (optionally) managed support that you have asked for.
Our Android app
This section covers our Android app, distributed on Google Play under the package name com.varisya and shown on your phone as "Varisya". The app is a native shell around the same cloud products described above: when you open it, it loads your 399apps workspace at books.399apps.com. Everything else in this policy applies to the app in the same way it applies to the website.
The app has no advertising SDKs, no third-party analytics or crash-reporting SDKs, and no ad identifiers. We do not sell or share data collected through the app with advertisers or data brokers.
The app asks for these device permissions, and only for the reason given. Each runtime permission is requested only when you first use the feature that needs it, and the app keeps working if you say no. Only that feature stops working.
- Internet. To load your 399apps workspace. All traffic goes over HTTPS; the app blocks unencrypted (cleartext) connections.
- Camera. To scan QR codes and barcodes at the point of sale, and to take a photo when you attach an image (for example a product photo or bill). Scanning happens on your device. Only a photo you choose to attach is uploaded to your workspace. We never record video or take pictures in the background.
- Nearby devices (Bluetooth). To find and connect to a Bluetooth thermal printer when you print barcode labels or receipts. We use Bluetooth only to talk to your printer. We do not use it to work out your location, and we do not collect or upload the list of nearby devices.
- Location (Android 11 and older only). On Android 9, 10 and 11, the system treats a Bluetooth printer scan as a location request, so those versions ask for location permission before a printer scan can work. We do not read, store or send your location. The permission is not requested at all on Android 12 and newer.
- Downloads. When you export a report, invoice or purchase-order PDF, CSV or Excel file, it is saved to your phone's Downloads folder by the Android download manager. No storage permission is requested.
- WhatsApp and other apps. When you tap "Send receipt" or a similar share action, the app opens WhatsApp (or your browser) with a pre-filled message. Nothing is sent until you press send inside WhatsApp, and from that point WhatsApp's own privacy policy applies.
Data the Android app handles
The app handles the same data as our cloud products. It collects nothing extra.
- Account details. Your name, email address or Indian mobile number, and password, used to sign up and sign in. We send a one-time code by email or SMS to verify the address or number you signed up with.
- Business data. The invoices, customers, items, stock, payments and other records you enter. These are stored in your cloud workspace, not on the phone, and are handled as described in "Cloud vs self-hosted" above.
- Photos and files you choose. Only images or documents you pick or capture yourself to attach to a record.
- On the device. A sign-in session cookie and small app preferences (such as your theme and menu layout). These stay on your phone, and Android's own backup can include them if you have device backup turned on. Signing out or uninstalling the app removes them.
- Technical logs. Our servers record standard request logs (IP address, device and app version as sent in the user agent, and timestamps) for security and debugging, as described in "What information we collect".
Deleting your account and data
You can ask us to delete your 399apps account and its data at any time, whether you signed up on the web or in the Android app. Email [email protected] from the email address on your account (or include the mobile number you signed up with) with the subject "Delete my account". We reply within 7 working days to confirm the request.
Deletion removes your user account, your organisation's workspace and the business data in it from our active systems within 90 days, and from backups within a further 30 days, the same timeline as a cancelled subscription. The only records we keep are ones the law requires, such as GST invoices we issued to you for your subscription, and we keep them only for as long as the law requires. If you want a copy of your data first, export it as CSV or PDF from the app before you ask us to delete it.
Uninstalling the app does not delete your account. It only removes the app and its local data from your phone.
Your rights
You have rights over the personal information we hold about you. Under the Digital Personal Data Protection Act, 2023 (DPDPA) and equivalent laws in other jurisdictions, these include:
- Access. Ask for a copy of the personal data we hold about you and what we do with it.
- Correction. Update or correct anything inaccurate.
- Erasure. Ask us to delete your personal data, subject to records we must keep for legal or tax reasons.
- Portability. Get your data in a standard, machine-readable format. Every 399apps app already supports unlimited CSV / PDF exports of the data you have entered.
- Withdraw consent. Where we rely on your consent (e.g. marketing emails) you can withdraw it at any time without affecting past lawful processing.
- Grievance. Raise a concern with our grievance officer (details at the end of this policy) and, if unresolved, escalate to the relevant data protection authority.
How long we keep information
Account and contact information is kept for as long as you are a customer, and for a reasonable period afterwards to meet legal, billing and audit requirements. Cloud product data is kept while your subscription is active; if you cancel, your data is removed from active systems within 90 days and from backups within a further 30 days.
Anonymous aggregate analytics (e.g. how many invoices were generated last quarter) may be retained without time limit, as it cannot be linked back to you.
On self-host, retention is entirely under your control.
How we keep information safe
We take security seriously because every customer here is running their actual business on our software. Concretely:
- Encryption in transit. All traffic to 399apps.com and our cloud products is served over HTTPS.
- Encryption at rest. Cloud customer data is encrypted at rest on managed infrastructure.
- Daily backups. Cloud customer data is backed up daily and retained for 30 days.
- Access controls. Only a small number of named engineers have production access. Production access is logged and reviewed.
- Self-host. The same product code ships as your self-hosted licence, with versioned releases, signed binaries / images, and migration scripts you can review.
Children's data
399apps products are intended for businesses, professional users and adults. We do not knowingly collect personal data from anyone under 18 for our own purposes.
If you use one of our products to handle data about minors, you are responsible for following applicable laws on the collection and use of children's data, including obtaining valid consent from parents or guardians where required.
International data transfers
Our cloud is India-region by default. For customers outside India, or when we use sub-processors operated from other regions (e.g. Cloudflare edge nodes worldwide), data may be transferred outside India. We use contractual safeguards with these sub-processors to make sure your data remains protected.
White-label and reseller deployments
When you white-label one of our products under your own brand, you are the data fiduciary for your end-customers. 399apps acts as a data processor for the customer data your platform collects. Your end-customers should look at your privacy policy, not ours.
We will sign a data-processing agreement on request. White-label deployments do not change the security and retention commitments we make in this policy.
Changes to this policy
We may update this policy as we add products, change sub-processors or to reflect changes in the law. When we make material changes, we will update the "last updated" date above and, for active customers, send an email to the primary address on the account.
Continued use of our products after the effective date means you accept the updated policy.
Grievance officer & contact
For any privacy question, access or deletion request, or concern about how we are handling your data — please write to us. We aim to respond within 7 working days.
- shabuilds (operator of 399apps)
- India
- Email: [email protected]