Privacy Policy

1. Scope & Operating Entity

This Privacy Policy governs the collection, processing, storage, transmission, and deletion of user information by the ENX Money mobile application and associated backend application programming interfaces (APIs), owned and operated by Enterprenex Solutions Pvt Ltd ("Company", "we", "us", or "our"), headquartered in Hyderabad, Telangana, India.

ENX Money is a dedicated digital business bookkeeping, customer Khata ledger, and GST invoicing software utility designed for micro, small, and medium enterprises (MSMEs), independent professionals, and merchants. We operate on a strict privacy-by-default architecture: we process only the minimum information necessary to calculate ledger balances, store customer dues, and authenticate user accounts.

2. The Critical Consistency Rule

In adherence to Google Play Developer Policy and global privacy best practices, this Privacy Policy enforces absolute consistency across three operational pillars:

• Actual App Implementation: Audited directly from client Android permissions (client/android/app/src/main/AndroidManifest.xml), Flutter dependencies (client/pubspec.yaml), and backend controllers.
• Google Play Console Data Safety: Fully synchronized with our mandatory Data Safety declaration and compliance audit files.
• Google Play Store Listing: Reflecting the true operational scope of ENX Money as a business accounting software tool.

3. Explicit 12-Category Data Safety Audit

Google Play requires clear, transparent disclosures regarding whether specific data categories are collected or shared. The following master audit details our practices across all mandated categories:

4. How We Use Collected Data

Every data element processed by ENX Money is utilized solely for explicit, legitimate business accounting purposes:

• Ledger & Khata Operations: Calculating customer balances, running accounts, outstanding receivables, and payables.
• GST Invoicing & Statements: Generating client-side PDF and Excel invoices with user-provided business details and tax breakdown.
• Authentication & Security: Verifying email ownership via 6-digit OTPs, issuing signed JWT session tokens, and enforcing session revocation.
• EMI & Loan Amortization: Calculating payment schedules, principal/interest breakdowns, and optional due date reminders.
• Service Reliability & Abuse Defense: Detecting brute-force attempts, enforcing API rate limits, and preventing unauthorized cross-tenant data access.

Commercial Sale Prohibition: We NEVER sell, rent, monetize, or disclose your personal or financial data to data brokers, advertising networks, lending companies, or credit bureaus.

5. Storage, Infrastructure & Multi-Tenant Data Isolation

We implement a robust, isolated data architecture:

• Private Relational Database: User data and transaction records are stored in private MySQL databases hosted in secure cloud infrastructure with parameterization and encrypted connections.
• Strict Multi-Tenant Isolation (IDOR Protection): Every database query in our backend enforces tenant scoping (WHERE user_id = ?). It is programmatically impossible for one user to access, view, or alter another user's Khata entries, customers, or invoices.
• Client-Side Local Storage: SharedPreferences is utilized strictly for active session JWT storage, theme preferences, and offline ledger queues.
• Zero Server-Side Biometrics: If you enable App Lock on your device (Fingerprint / Face Unlock), it is processed exclusively via the operating system's hardware security enclave (TEE) through the local_auth framework. Biometric data is never transmitted to or stored on our servers.

6. 10 Verified Security Controls

In accordance with Google Play Developer Policy, we document only the security measures actually implemented and verified in our codebase:

• 1. HTTPS / TLS 1.3 Encryption in Transit: 100% of network requests between the Flutter mobile app and backend APIs are encrypted using modern Transport Layer Security (TLS 1.2/1.3). Insecure HTTP is blocked.
• 2. Cryptographic Password Hashing: Passwords are never stored in plaintext. They are irreversibly hashed using bcrypt with 10 salt rounds prior to database insertion.
• 3. JWT Session Authorization: Protected endpoints require an Authorization: Bearer <token> header verified by custom middleware. Tokens carry a strict 7-day TTL and are verified cryptographically.
• 4. Server-Side Token Blacklisting: Logging out or requesting account deletion immediately adds the active token to a server-side blacklist, preventing token reuse.
• 5. Single-Use 5-Minute OTPs: One-time login passcodes expire automatically after 5 minutes and are purged after successful verification or maximum 5 failed attempts.
• 6. Multi-Tenant User Isolation: Enforced user ownership verification on every route prevents Insecure Direct Object Reference (IDOR) attacks.
• 7. Parameterized Queries & Input Sanitization: All database queries utilize parameterized SQL placeholders (?), preventing SQL injection vulnerabilities. Inputs are sanitized against XSS.
• 8. Rate Limiting & Abuse Defense: Public endpoints (login, OTP dispatch, account creation) are protected by express-rate-limit to thwart brute-force attacks and credential stuffing.
• 9. Secure Secret Management: Database credentials, JWT signing keys, and SMTP secrets are stored exclusively in environment variables (.env) and never committed to source control.
• 10. Never-Log Secret Redaction: Backend loggers and client network interceptors automatically redact passwords, tokens, OTP codes, and personal financial figures from server console logs.

7. Data Retention & Permanent Deletion Protocols

We maintain an explicit, transparent data retention schedule:

Dual Deletion Pathways (Google Play Account Deletion Policy Compliant):

• In-App Deletion: Open ENX Money → Navigate to Profile & Settings → Tap Data & Privacy Dashboard → Tap Delete Account & Data → Confirm. The app executes DELETE /api/users/account, wiping personal credentials, revoking tokens, and purging local storage.
• Public Web Deletion Portal: If you uninstalled the app or lost your device, visit our standalone public web page at Account & Data Deletion Portal to submit a deletion request via POST /api/users/request-deletion.

8. Third-Party Services & SDK Audit

ENX Money maintains a minimal third-party footprint. The following table lists all third-party services and client libraries evaluated during our codebase audit:

9. In-App Navigation & Privacy Settings

All legal policies and privacy tools are easily accessible inside the mobile application through the following verified paths:

• Settings → Privacy Policy: Opens the full in-app policy viewer dialog with an option to launch this public web document.
• Settings → Data & Privacy Dashboard: Provides a comprehensive overview of data rights, privacy contacts, data export options, and the permanent account deletion trigger.
• Settings → Terms & Conditions: Outlines our 33-section non-marketplace accounting user agreement.
• Settings → Refund & Cancellation Policy: Details billing and cancellation terms consistent with Google Play policy.
• Settings → Delete Account & Data: Directly initiates the permanent account and personal data erasure workflow.

10. User Rights & Legal Bases

Depending on your location, you possess statutory rights regarding your personal information under the Indian Digital Personal Data Protection Act, 2023 (DPDP), the European Union General Data Protection Regulation (GDPR), and other global frameworks:

• Right to Access & Inspect: You may view all account details, counterparty ledgers, and transactions inside the app.
• Right to Rectification: You may edit your profile, business address, and ledger records at any time.
• Right to Data Portability: You may export customer statements and transactions as PDF or Excel spreadsheets directly to your device storage.
• Right to Erasure (Right to Be Forgotten): You may permanently purge your personal data and account via in-app settings or our public web portal.
• Right to Withdraw Consent: You may stop using the application and delete your account at any time without fees or penalties.
• Lawful Basis (GDPR / EEA): For EEA users, data processing is conducted under contractual necessity (delivering bookkeeping utilities) and legitimate interest (security and fraud prevention).

11. Children's Privacy (Strictly 18+ Only)

ENX Money is an enterprise and business accounting tool designed exclusively for adults aged 18 years or older. We do not market to, solicit, or knowingly collect personal data from minors under 18 (or under 13 depending on regional jurisdiction). If we discover that an account has been registered by a minor, all personal details will be purged from our database immediately. Parents or guardians may contact us at privacy@enxmoney.com.

12. International Data Transfers

ENX Money's primary databases and API servers are hosted in secure data centers located in India and the Asia-Pacific region. If you access our services internationally, your data is transmitted, processed, and stored under modern cryptographic encryption protocols (TLS 1.3) in full compliance with international standards.

13. Policy Updates & Notifications

We may periodically update this Privacy Policy to reflect enhancements to our service, changes in legislation, or Google Play Developer Policy updates. When updates occur, we will revise the "Last Updated" timestamp at the top of this document. For substantial modifications impacting personal data handling, registered users will receive notice within the mobile application.

14. Privacy Officer & Company Contacts

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our Data Protection and Compliance team:

Enterprenex Solutions Pvt Ltd
Attention: Data Protection & Privacy Officer
Privacy Contact Email: privacy@enxmoney.com
Customer Support Email: support@enxmoney.com
Registered Office Address: Hyderabad, Telangana, India

15. Final Google Play Compliance Verification Checklist

This Privacy Policy has been formally verified against Google Play Developer Program policies and production codebase reality: