Privacy Policy & Security Disclosures

1. Introduction

Welcome to VERISTOCK PRO, owned and operated by SM Technologies ("we", "us", or "our"). VeriStock Pro is a Hybrid Offline-First Business Management and ERP system designed for mobile retailers, repair centers, pharmacy stores, garments merchants, and small businesses in India and worldwide.

We respect your data privacy and autonomy. VeriStock Pro operates on a Hybrid Offline-First Architecture. Your core financial ledgers, inventory records, customer contacts, and repair tickets are processed and encrypted locally on your Android device (`android-database-sqlcipher`). When enabled for multi-user store management or CA audit, transactional records are synchronized securely to private Firestore cloud databases over encrypted TLS 1.3 channels.

2. Information We Collect

We strictly limit data collection to what is necessary for managing account authentication, multi-user store synchronization, app performance diagnostics, and subscription licensing:

• Account & Profile Identifiers: Name, Email Address, Mobile Phone Number, Business Name, and Staff Role (Owner, Manager, Biller, Technician, CA Auditor).
• Transactional Records for Cloud Sync: Encrypted transaction outbox payloads (Sales, Purchases, Repair Jobs, Expenses) synchronized to private multi-tenant Firestore security rules (`businesses/{bizId}/shops/{shopId}/*`).
• Device Identifiers: Firebase Installation ID, Android OS Version, Device Model (used for sync conflict resolution and security logging).
• Diagnostic & Performance Logs: Anonymized app crash logs, stack traces, and feature performance metrics via Firebase Crashlytics.

3. How Information Is Used

Your information is used strictly to provide and improve the VeriStock Pro application:

• To authenticate your user session and manage multi-device licensing.
• To send push notifications for low-stock alerts, repair status milestones, and payment reminders.
• To diagnose software crashes and maintain high stability on budget Android hardware.
• To enable user-initiated Google Drive encrypted database backups.

4. Firebase Authentication

We use Google Firebase Authentication (`com.google.firebase:firebase-auth`) to verify user credentials and secure user account sessions. Your email address, encrypted authentication token, and account creation timestamp are transmitted securely over TLS 1.3 to Firebase servers. We do not sell or share your account credentials with third parties.

5. Business Information

Information regarding your shop name, store address, GSTIN, PAN, and business logo is entered locally during shop onboarding (`SetupScreen.kt`). This data is stored on your device's local database and printed on your sales receipts. It is NOT published to any public index or sold to data brokers.

6. Customer Data

Customer names, phone numbers, delivery addresses, and outstanding balance ledgers (Udhari) entered into VeriStock Pro are encrypted locally on your device (`android-database-sqlcipher`). In cloud-synchronized deployments, customer records sync over encrypted TLS 1.3 to your private Firestore namespace (businesses/{bizId}/shops/{shopId}/customers) so all store counters remain updated. When you send a WhatsApp bill or SMS receipt, data is dispatched directly via standard Android System Intents (`WhatsAppUtil.kt`) under your explicit user action.

7. Supplier Data

Vendor profiles, purchase bills, and payables ledgers are maintained locally and synchronized within your private business tenant for multi-counter stock receiving. We do not sell or monitor your supplier pricing, wholesale discounts, or vendor contact lists.

8. Inventory Data

Your product catalog, HSN codes, cost prices, selling margins, batch numbers, expiry dates, and IMEI / Serial numbers are confidential business assets. They are stored locally in Room database encrypted via SQLCipher and synchronized to your private Firestore store partition (businesses/{bizId}/shops/{shopId}/products). Role-Based Access Control strictly prevents staff roles (such as Salesmen) from viewing purchase cost prices.

9. Repair Records

Repair job tickets, device lock patterns, diagnostic checklists, technician assignments, and estimated repair costs are stored locally. Diagnostic logs are used on-device to compute repair delivery deadlines.

10. Documents & Images

Images captured using CameraX (such as shop logo, inventory product photos, repair intake condition photos, and used phone seller ID proofs) are saved in app-specific private storage (`Context.filesDir`). They are not scanned or harvested for machine learning model training.

11. Invoices & Accounting

All invoice math (CGST, SGST, IGST, discounts, double-entry financial posting) is executed on-device using exact integer paise math. Transaction records are queued in an on-device write-ahead outbox and synchronized to your cloud business tenant in Firestore. Tax summaries generated for GSTR-1 and GSTR-3B exports can be downloaded directly as CSV/Excel or reviewed by your accountant via the read-only CA Web Portal.

12. Local SQLCipher Storage

VeriStock Pro uses Zetetic SQLCipher (`android-database-sqlcipher:4.5.4`) paired with AndroidX Security Crypto (`androidx.security.crypto`). Your SQLite database file (`encrypted.db`) is encrypted using 256-bit AES encryption at rest. Even if a physical device is lost, the database cannot be read without your private encryption key.

13. Cloud Sync & Backups

VeriStock Pro features a background Write-Ahead Cloud Sync engine using Google Cloud & Firebase Firestore (`businesses/{bizId}/shops/{shopId}/*`). When online, transactions and inventory changes sync automatically across all store devices. In addition, users can execute manual database snapshots or export encrypted backups directly to their personal Google Drive account scope (`drive.appdata` / `drive.file`). SM Technologies does NOT sell, monetize, or harvest your business records.

14. Third-Party Services

The app incorporates trusted Google Play Services SDKs. The table below lists all third-party libraries and their data handling:

15. Permissions Used

Every Android permission declared in `AndroidManifest.xml` serves a specific operational purpose:

• android.permission.CAMERA: Barcode scanning for billing & device photo intake for repair claims.
• android.permission.ACCESS_FINE_LOCATION: Geotagging KYC records for regulatory compliance.
• android.permission.READ_MEDIA_IMAGES: Importing product images, logos, and signatures.
• android.permission.POST_NOTIFICATIONS: Dispatching low-stock alerts, repair deadlines, and due date reminders.
• android.permission.BLUETOOTH: Connecting ESC/POS thermal printers and triggering local Smart Clone migration.

16. Data Security

We employ rigorous technical safeguards to protect your business data: 256-bit AES database encryption at rest via SQLCipher, mandatory HTTPS / TLS 1.3 transport security for network requests, and sandboxed app storage.

17. Data Retention

Local database records remain on your device for as long as the application is installed. Uninstalling the app erases local private databases from that device. Cloud synchronized records and Firebase authentication profiles are retained under your tenant ownership until you initiate an account deletion request.

18. User Rights

You retain full rights to access, export, or erase your business data at any time. Local database records can be exported directly as CSV files. Cloud auth profiles can be deleted self-serve or via written request.

19. Account Deletion

Under Google Play User Data Policy, we provide two pathways to request permanent account deletion:

1. In-App Self-Serve Deletion: Open VeriStock Pro -> Settings -> About App -> Click Delete Account.
2. Web Portal Request: Visit our Account Deletion Portal and submit your registered email address.

Upon request, cloud auth tokens and account metadata are permanently purged within 7 business days.

20. Children's Privacy

VeriStock Pro is a commercial B2B ERP system intended strictly for adult business operators (18+). We do not knowingly collect personal information from children under 13.

21. International Users

While primary compliance maps to Indian tax and trade guidelines (GST/HSN), local encryption and offline-first principles comply with international data autonomy standards including GDPR and CCPA.

22. Policy Updates

We may update this Privacy Policy periodically to reflect app enhancements or regulatory changes. The "Last Updated" timestamp at the top of this page indicates the latest revision date.

23. Contact Information

For questions, privacy inquiries, or data deletion assistance, contact our legal and support team: