Legal
Privacy policy
Last updated:
This policy describes how Accura works today. It is being reviewed by our lawyer; if anything here is unclear, write to jkuldevllc@gmail.com.
1. Who we are and what this covers
Accura is a billing, stock and accounts app for every kind of business in Nepal — from a single counter to branches, godowns and wholesale — with Tally-style double-entry books and VAT and IRD registers. It is provided by jKulDev LLC (“we”, “us”). You can reach us about privacy at jkuldevllc@gmail.com.
This policy covers the Accura web app (the Nepal edition at accura-np.vercel.app; the global edition at useaccura.com and its shops' own addresses), the Accura desktop app for Windows and Mac, the shop websites we host, the emails we send, and this website.
It does not cover how your shop uses its own records about you — for example as its customer, supplier or staff member. The shop decides that.
2. Two roles: your shop's records and our own
Data protection law separates the one who decides why and how personal data is used (the controller) from a service provider that handles it on their instructions (the processor).
- Your shop is the controller of its records — customers and suppliers, bills, purchases, returns, receipts and payments, stock, staff and their roles, the activity log, and everything else people enter for the shop. We are its processor: we store and process those records only to run Accura for the shop, under our Terms and our Data processing addendum.
- We are the controller of the data we need to run our own business: your account and sign-in details, security logs, the shop's plan, payments to us, support conversations, and this website.
If you are a shop's customer, supplier or staff member and want to see, correct or delete what the shop holds about you, ask the shop first. If you write to us instead, we will pass your request to the shop and help it answer.
3. What we collect
| What | Details | Where it comes from |
|---|---|---|
| Account | Your name, email address and / or Nepal mobile number, and language. Your password is stored only as a scrypt hash. If a shop owner made your login with a temporary password, we note that you must change it. | You, or the shop owner who adds you |
| Invitations | The email address or mobile number invited, the role and branch, and a 6-digit code stored only as a SHA-256 hash, valid for 7 days. A code for an email address is sent by email (we log the address and whether it was sent, never the message). For a mobile number we send nothing — the owner shares the code, for example by SMS. | The shop owner |
| The shop and its plan | Shop name, legal name, PAN / VAT number, address, phone, email, logo and colour, its Accura address, branches and godowns, plan and paid-until date, payments to us (amount, VAT, the gateway's reference and status), AI requests and — if the owner links it for the Gossip price — a one-way fingerprint (SHA-256) of the Gossip account reference, with the last digits of the phone number and its country. | The shop's owner |
| Books and records (the shop's data) | Customers and suppliers (name, phone, address, PAN, credit limit and days, opening balances and old bills), items, prices, barcodes and stock, quotations, orders, delivery challans, bills (with the buyer's name and PAN), purchases, returns, receipts and payments, stock transfers and counts, day-close cash counts, VAT and IRD registers — with who did what and when (the activity log) and every print of a bill (the print log). | The people who use Accura for the shop |
| The shop's website | Only if the shop switches it on: what the owner publishes (details, pages, photos, catalogue) and, per day, how many pages were viewed and how much data was served. See “Shop websites” below. | The shop's owner; visitors' browsers |
| Sahayak (AI assistant) | Your typed question or voice recording, passed on to answer it. We keep only a usage line — who asked, when, typed or spoken, and the requests it used — not the question or the answer. | You |
| Counter PCs | For each counter PC registered for offline billing: its name and code, a SHA-256 hash of its key, and when it last synced. | The shop |
| Security logs | Sign-in sessions (your browser's description and the network part of your IP address only — IPv4 /24, IPv6 /48 — never the full address), and sign-in, look-up and invite-code attempts with the same network part, to slow down password guessing. | Your connection |
| Support and contact | What you write to us, and what we need to help. | You |
We do not collect your location, and we do not ask for special categories of data (such as health, religion or biometrics). Shops should record only what their books need.
4. Shop websites
Each shop can switch on a public website at its Accura address. It is off by default. When it is on, the shop decides what to publish: its details, pages and photos (stored in our database), and a catalogue of its items with or without prices. The catalogue never shows quantities in stock or costs.
For visitors we count, per shop and per day, how many pages were viewed and how much data was served. We keep no record of individual visitors. To stop abuse, the server counts requests from each IP address in memory for 5 minutes (at most 600) — this is not stored. Pages load fonts from Google Fonts; if the shop adds a map, it is shown from Google Maps; a light / dark choice is remembered in the visitor's own browser.
A “Chat on Gossip” button opens the shop's chat in the Gossip app (or the Gossip website if the app is not installed); WhatsApp, phone and email buttons open those apps. What a visitor sends there goes to the shop through that service, not through Accura.
5. Sahayak, the AI assistant
Sahayak answers questions about the shop — who owes money, today's sales, low stock, a customer or a bill — and can turn a dictated bill into a draft at the counter. It runs only when someone asks. It can only read, it checks the asker's own permissions before looking anything up, and it never saves or changes anything; a drafted bill is saved only when a person saves it.
To answer, your question (or voice recording) and the shop figures the answer needs — for example customer names and amounts owed — are sent through Gossip's AI service (another jKulDev LLC service) to an AI provider: Google (Gemini API) first, with OpenAI or Cloudflare Workers AI as fallbacks. Voice questions are turned into text the same way. Spoken replies are read aloud by your own device's voice, not sent anywhere.
We do not use your content to train AI models, and we do not keep the questions, recordings or answers. AI use is counted in requests for your plan.6. Offline billing and the desktop app
A shop can register a counter PC for offline billing. That PC keeps, in its browser's own storage (IndexedDB): the counter's key, a copy of the items, prices, units, barcodes and stock at that counter, the bills made while offline (with any buyer details typed in), and the last 300 synced bills so they can be reprinted. Bills are sent to our server in order as soon as the internet is back. This copy stays on that PC — anyone who can use the PC can see it — until the counter is removed from it.
The Accura desktop app for Windows and Mac is the same staff app in its own window. It remembers the shop's address and your printer settings on that computer and prints bills to your local printers. It may use the microphone only for Sahayak voice questions, and only on your shop's address.
7. Why we use data, and our legal grounds
| Purpose | Legal ground (where the law asks for one) |
|---|---|
| Providing Accura to the shop: storing its books and showing them to the right people, by role and branch | Our contract with the shop; for the shop's records, the shop's instructions (the shop chooses its own ground) |
| Your account, sign-in and invitations | Contract with you; our legitimate interest in keeping accounts secure |
| Keeping bills, cancelled bills and print logs as Nepal's billing rules require | The shop's legal obligations, which we support |
| Sahayak answers | Contract — only when someone asks |
| Plan limits, AI requests and payments to us | Contract; legal obligations (tax and accounting records) |
| Security, fraud and abuse prevention, keeping the service running | Legitimate interests; legal obligations |
| Running and improving Accura using counts and usage figures (never the content of records) | Legitimate interests |
| Answering legal requests and enforcing our terms | Legal obligations; legitimate interests |
We do not sell personal data, use it for advertising, or make decisions about people by automated means that have legal or similarly significant effects.
8. Who we share it with
Inside a shop, people see records according to the roles the owner gives them, for the branches they are given. Nobody outside the shop sees its books.
We use these service providers (“sub-processors”) to run Accura. Each gets only what it needs:
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the web app, the server, shop websites and this website | Our server runs in Singapore; Vercel's content delivery is worldwide and its own operations are mainly in the United States |
| Neon (Databricks, Inc.) | The database — including photos and logos | Singapore (AWS ap-southeast-1) |
| Resend (Plus Five Five, Inc.) | Sending invitation emails | United States |
| Gossip (jKulDev LLC) | The AI service for Sahayak (questions and voice), and the code and account check for the Gossip account link | United States |
| via Gossip: Google (Gemini API), OpenAI, Cloudflare (Workers AI) | AI answers and voice to text, only when someone asks Sahayak | United States / worldwide |
| via Gossip: SMS providers | Delivering the Gossip link code by SMS when the owner does not have the Gossip app | Nepal and other countries |
| Khalti · eSewa | Taking online payments for plans and AI request packs — they handle your wallet and card details; we keep the payment reference, status and amount | Nepal |
| Google (Google Fonts, Google Maps) | Fonts on this website, the web app and shop websites; a map on a shop website if the shop adds one — these receive your IP address when your browser loads them | Worldwide |
When paying, the owner's name and phone or email are passed to Khalti so it can show the payment. When linking a Gossip account, the owner's phone number is passed to Gossip to send the code and check the account. We also share data when the law requires it (a valid court order or legal request — we will tell the shop unless we are not allowed to), or when we sell or reorganise the business (the buyer must keep this policy's promises).
9. Where your data is stored and international transfers
The server and the database run in Singapore. Email and the AI service are in the United States, and AI providers may process requests in other countries. So your data is handled outside Nepal.
Where the law requires a safeguard for this, we rely on our providers' contractual commitments and the measures in our Data processing addendum.
10. How long we keep it
| Data | How long |
|---|---|
| Your account | While you have it, until you ask us to delete it (see below). |
| A shop's books and records | As long as the shop uses Accura, and after that until the shop's owner asks us to delete them — except what the law requires to be kept. Bills, including cancelled ones, and the print log are never deleted while the shop's books are kept. |
| Sahayak questions, recordings and answers | Not stored. The usage line is kept with the shop's plan records. |
| Website visitor counts | Per-day totals, kept with the shop's records. Per-IP request counts: 5 minutes, in memory only. |
| Sign-in sessions | A sign-in lasts up to 30 days, or until you sign out or change your password. |
| Invite codes | 7 days (the owner can renew one). |
| Payments to us | As long as tax and accounting law requires. |
| Backups | Overwritten on a rolling basis by our database provider. |
11. How we protect it
- Everything is encrypted in transit (HTTPS) and stored with providers that encrypt data at rest.
- Passwords are stored only as scrypt hashes; sign-in sessions, invite codes and counter-PC keys only as SHA-256 hashes.
- Every request is checked against the person's roles in the shop and branch, in the data layer itself; one shop can never reach another shop's records.
- Repeated wrong passwords or invite codes make the next try wait 15 minutes, even with the right password.
- Bills cannot be edited once saved — a mistake is cancelled with a reason and the number stays used. The activity log and the print log cannot be changed or deleted, by anyone, including us.
- We have no screen for looking inside a shop. A few of our people can reach the database to run the service (for example to set a plan or check the books' health); they do so only for that.
- Uploaded photos are checked for their real file type.
No system is perfectly secure. If a breach affects your personal data we will tell the shop, and you where the law requires, without undue delay.
12. Your rights
Depending on where you live you may have the right to: know what we hold and get a copy; correct it; delete it; object to some uses; withdraw consent you gave; and complain to a regulator or court.
How to use them:- Correct — change your name or password in the app; a shop's owner can correct customer and supplier details.
- Copy of the books — a shop's owner or accountant can download the books for Tally (XML) and the VAT and IRD registers (CSV) at any time.
- A copy of your own data, or deletion — write to jkuldevllc@gmail.com.
We may need to confirm it is you. We answer within 30 days and do not charge for it. For a shop's records we pass the request to the shop, which decides (see “Two roles”).
In Nepal
- Under the Privacy Act, 2075 (2018) and the Privacy Regulation, 2077, personal information may be collected only with consent (or as the law allows) and used only for the purpose it was collected for, and electronic records and correspondence are private. You can ask us about your data and correct it, and you may complain to the District Court under that Act.
13. For shops: your duties to the people you record
When your shop records people in Accura — customers, suppliers, staff — your shop decides what to record about them and is responsible for doing it lawfully. In particular:
- Tell your staff that their work in Accura is recorded under their name (bills, cancels, prints, cash counts) and who can see it.
- Record only what your books need about customers — name, phone, PAN and address are usually enough.
- Give logins and roles only to people who need them, remove people who leave, and keep counter PCs and the desktop app on computers only your staff use.
- Answer people's requests about their records (we will help), and keep your bills and tax records as your tax law requires.
14. Cookies and browser storage
This website sets no cookies and uses no analytics, trackers or advertising. It loads fonts from Google Fonts. The web app uses one strictly necessary cookie,hw_session, to keep you signed in (up to 30 days, HttpOnly, secure, only for the address you signed in at). It keeps a few things in your browser: the shop and branch you last opened, your paper size, a copy of your own profile so the app can open without internet (removed when you sign out), an unsaved counter bill for the current tab and, on a registered counter PC, the offline store described above. The camera, if you use it to scan barcodes, is read inside your browser — no pictures are sent. We do not use cookies for advertising or tracking, so there is no cookie banner.
15. Children
Accura is a business tool for adults. It is not meant for anyone under 18. Shops must not give a login to anyone under 18 without a parent's or guardian's consent where the law requires it. If you believe a child has an account, write to us and we will remove it.
16. Changes to this policy
If we change this policy in a way that matters, we will tell shop owners by email or in the app before the change takes effect, and update the date at the top. Previous versions are available on request.
17. Contact
jKulDev LLC — privacy questions and requests: jkuldevllc@gmail.com. Shops that need our processor terms: see the Data processing addendum.