Privacy Policy

Last updated: 11 September 2026

MB Hisab AI is managed by MB Developer Apps from Nagpur, Maharashtra, India. MB Hisab AI is a Google-login-first accounting application for small businesses. This policy explains the categories of information the product handles, why they are used and the safeguards used or required across Android, iOS and Web.

Send privacy questions, corrections, grievances and deletion assistance to support@mbhisabai.com.

Account and business records

Google sign-in through Supabase Auth identifies the account owner and maintains the session. MB Hisab AI can store business profiles, customers, ledger entries, sales, expenses, invoices, inventory, imported bank rows, reconciliation decisions, settings and subscription status. Cloud rows use owner-based access controls that restrict records to the authenticated owner or an explicitly authorised collaboration scope.

The app also uses a local Drift database for responsive operation and caching. On shared devices, local records are scoped to their authenticated account. Backup export, restore and deletion operate on the current account scope. Legacy records whose ownership cannot be established are not silently assigned to a newly signed-in user.

Employee Khata and payroll

Employee Khata can store employee profile details, attendance and leave status, salary configuration, overtime, advances, loans, bonus or incentive entries, deductions, reimbursements, payroll calculations, salary payments, salary slips and employee-ledger history. These are records inside the owner's business. Creating an employee record does not create a login or grant that employee access to the business.

Shared Expenses and collaboration

Shared Expenses can store group details, active or previous memberships, participants, payer contributions, allocated shares, expenses, balances derived from those records, settlements and group activity. A manual participant can later be linked to an invited account without treating a matching display name as proof of identity.

Invitations contain a time-limited token in the link sent to the recipient. The cloud service stores a hash of the invitation token rather than the raw token. Anyone receiving an invitation link should treat it as private until it expires or is revoked. When a user chooses WhatsApp, SMS, Copy Link or the system share sheet, the device passes the group name and invitation URL to that selected app or clipboard so the user can send it.

Joining a Shared Expense group does not make the invited user a member of the owner's business. Active group membership authorises access only to that exact shared group and its collaborative records. It does not grant access to the owner's customers, Customer Udhar, employees, Employee Khata, attendance, payroll, bank records, inventory, invoices, business reports, settings or unrelated Shared Expense groups.

Payments and subscriptions

Supported Web and direct-distribution Android purchases use Razorpay when production payments are enabled. Google Play and iOS in-app purchases are not currently implemented. The client can receive a public key ID and order information, while secret keys remain on the backend. Premium is activated only after server verification or trusted webhook processing. MB Hisab AI may retain payment references, plan details and verification status needed for support, reconciliation and entitlement checks. It does not need card credentials, UPI PINs or bank passwords.

AI and receipt processing

AI features may process the minimum text or receipt content needed for the action. Output is presented for review before an accounting record is saved. AI actions do not need Aadhaar or ID-proof images, bank credentials, passwords, UPI PINs or unnecessary private customer datasets. Provider configuration and availability can vary by platform and environment.

Optional ID proof

Customer ID proof is optional and consent-based. ID-proof images are stored in app-private encrypted local storage where supported and are excluded from normal cloud sync. They are not included in default exports and are not sent to AI. Deletion workflows treat the associated encrypted file and key metadata as part of the owning customer or account data.

Advertising

The signed-in web application contains no AdSense units. AdSense requests on public pages are currently disabled while the site's content is reviewed. The site's publisher verification metadata and ads.txt identify its Google advertising account but do not themselves load ads. Before public ads resume, each eligible guide must pass the publisher's review gate and applicable consent requirements must be satisfied. Ad code must not load before required consent is obtained.

When Google advertising is enabled, Google and its partners may use cookies, device identifiers, web beacons or similar technologies to deliver, measure and protect advertising, subject to consent and regional requirements. Read how Google uses data when you use partners' sites or apps. Consent choices may affect whether personalised or non-personalised advertising is available.

The public business worksheets calculate only in the current browser tab. Their inputs are not saved, uploaded or included in account sync. Page hosting can still involve ordinary access logs; the worksheet calculations do not send financial inputs to the host.

Free users of supported Android or iOS builds may see Google AdMob banners or limited interstitial ads on eligible non-sensitive screens. Rewarded ads are optional and user initiated. Ads are not used for sensitive flows such as adding udhar, receiving payment, creating an invoice, payment checkout, ID proof, privacy controls or AI review. Verified paid users do not see eligible in-app ads. If subscription status cannot be verified, ads are hidden rather than assuming the user is Free.

Bank data and notifications

Bank statement import is a manual file workflow. MB Hisab AI does not ask for net-banking passwords, OTPs or UPI PINs and does not scrape a bank account. Imported rows are reviewed before they become records. Notification copy is kept limited for privacy-sensitive events.

Sharing and service providers

Information is shared only with service providers needed to operate selected features, such as Supabase for authentication and cloud records, Google for sign-in and approved advertising, Razorpay for payments, and configured AI infrastructure for an initiated AI action. Each provider handles data under its own terms and legal obligations. MB Hisab AI does not sell customer ledger data.

Retention, access and deletion

Records are retained while needed to provide the account, meet legitimate operational or legal obligations, resolve payment disputes and support requested backups. A user can access account controls in the app and request assistance at support@mbhisabai.com. Account deletion separates local data deletion, cloud application-data deletion and authentication-account deletion. The interface must not claim a cloud or Auth deletion succeeded until the backend confirms it.

Security and responsibility

MB Hisab AI uses authenticated sessions, owner-only access rules, encrypted local handling for especially sensitive images and server-side payment verification. No system is completely risk free. Users are responsible for securing their Google account, device lock and recovery methods, and for reporting suspected unauthorised access promptly.

Children and changes

MB Hisab AI is a business accounting product and is not directed to children. This policy may change when features, providers or legal requirements change. Material updates will change the visible last-updated date.

Contact

For privacy questions, corrections, grievances or deletion support, email support@mbhisabai.com. Do not include passwords, OTPs, UPI PINs or full ID-proof images.