Privacy Policy

1. Who we are and what this covers

A2B Software builds business software products, including A2B Insights and A2B ERP, along with other products we may launch (together, the "Products"). This Privacy Policy explains how A2B Software LLC ("A2B Software", "we", "us") collects, uses, shares and protects personal data when you visit a2bsoftware.com, sign up for or use our Products, or contact us.

Our customers are businesses and organisations from around the world. This policy is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and also covers rights under the EU and UK General Data Protection Regulation ("GDPR") and US state privacy laws such as the California Consumer Privacy Act ("CCPA"), where they apply.

We play two roles. For website visitors, account holders and billing contacts, we decide how data is used, so we are the Data Fiduciary / Controller. For the business data our customers store in our Products, our customer is in charge and we process it only on their instructions, so we are the Data Processor. Section 5 explains this.

2. Data we collect

• Account data: name, work email, phone number, company name, job title, password (stored in encrypted form) and account settings.
• Billing data: billing contact, address, tax ID (such as GSTIN or VAT number) and payment history. Card and bank details are handled directly by our payment providers. We do not store full card numbers.
• Customer data: the information you and your team enter, upload or connect to our Products, such as financial records, invoices, inventory, sales, customer and supplier details, employee records, and data from connected apps. See section 5.
• Usage and device data: IP address, browser and device type, operating system, log-in times, features used, pages visited, error logs and performance data.
• Support and communications: messages, calls, emails and feedback you send us, including screen recordings or files you share with our support team.
• Website data: information you submit through forms, such as demo requests and newsletter sign-ups, and data from cookies (section 11).
• Data from others: information from single sign-on providers (such as Google or Microsoft), integrations you connect, resellers or partners, and publicly available business sources.

3. How we use your data

Under India's DPDP Act, we rely on your consent, or on legitimate uses the Act permits, such as when you share data with us for a specific purpose. We do not sell personal data, and we do not use customer data for advertising.

4. Consent and how to withdraw it

Where we rely on consent, we ask for it clearly and separately, for example through a checkbox at sign-up or a cookie banner. You can withdraw consent at any time by changing your settings, using the unsubscribe link in our emails, or writing to work@a2bsoftware.com. Withdrawing consent does not affect processing already done.

5. Customer data inside our Products

Businesses that use A2B Insights, A2B ERP and our other Products may store personal data of their own employees, customers, suppliers and contacts in them. For this customer data:

• Our customer owns the data and decides how it is used. We process it only to provide, secure, support and improve the Products, and as the customer instructs.
• Our staff access customer data only when needed to provide support, fix a problem, keep the service secure, or meet a legal requirement, and access is logged.
• We do not use customer data to train general AI models or share it with other customers.
• We may use aggregated, anonymised data that cannot identify any person or customer to measure and improve performance.
• Our customers are responsible for giving their own privacy notices and getting any consents needed from the people whose data they store. A Data Processing Agreement is available on request.

If your data is stored in our Products by a business you deal with, please contact that business first to exercise your rights. We will help them respond.

6. AI and automated features

Some Product features may use artificial intelligence, for example to generate reports, forecasts or summaries in A2B Insights. These features process customer data only to produce results for that customer. Where we use third-party AI providers, they process the data under contract, and are not allowed to use it to train their own models.

7. Who we share data with

We share personal data only with:

• Service providers (sub-processors) who help us run our business, such as cloud hosting, payment processing, email delivery, customer support tools, analytics, error monitoring and AI services. They must protect the data and use it only for the work we give them. A list of sub-processors is available on request.
• Integrations you choose, such as accounting, payment or messaging apps you connect to our Products.
• Resellers or implementation partners, if you bought or set up our Products through them.
• Authorities, when required by law, court order or a valid government request.
• A buyer or successor, if our business is merged, acquired or restructured, under the same protections.

8. International data transfers

We serve customers worldwide, so personal data may be stored or processed in India and in other countries where we or our service providers operate. We will update you on our primary hosting location once finalized.

When we transfer data from the EU, UK or other regions with transfer rules, we use legal safeguards such as the European Commission's Standard Contractual Clauses. We do not transfer data to countries restricted by the Government of India.

9. How long we keep data

• Account and customer data: for as long as your subscription is active. After your account is closed, you will have time to export your data, and we then delete it from live systems and backups. We will update you on the exact timelines once finalized.
• Billing records: as long as tax and company laws require.
• Usage logs: for a limited period, unless needed longer for security investigations.
• Marketing contacts: until you unsubscribe, or after a period without engagement.

10. How we protect data

We use technical and organisational safeguards suited to business data, including encryption in transit (TLS) and at rest, role-based access controls, multi-factor authentication for our staff, separation of customer data, regular backups, continuous monitoring and logging, vulnerability testing, and security training for our team. No system is completely secure, but we work continuously to protect your data.

11. Cookies

Our website and Products use essential cookies to keep you signed in and keep the service secure. With your consent, we also use analytics cookies to understand how our website is used. You can change your choices at any time through our cookie settings or your browser.

12. Your rights

Depending on where you live, you have some or all of these rights:

• India (DPDP Act): get a summary of your data and how it is processed, correct or update it, have it erased, withdraw consent, nominate another person to act for you, and raise a grievance with us and then with the Data Protection Board of India.
• EU and UK (GDPR): access, correct or delete your data, restrict or object to processing, receive your data in a portable format, withdraw consent, and complain to your local data protection authority.
• California and other US states: know what data we collect and how we use it, access, correct or delete it, and not be treated differently for using these rights. We do not sell or share personal data for cross-context behavioural advertising.

To use your rights, email work@a2bsoftware.com. We may need to verify your identity. We will reply within the time required by applicable law.

13. Children's data

Our Products are made for businesses and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

14. Data breaches

If a personal data breach occurs, we will act quickly to contain it, and notify affected customers, individuals and regulators as required by applicable law, including the Data Protection Board of India and, where relevant, EU and UK authorities.

15. Changes to this policy

We may update this policy as our Products and the law change. We will post the new version here with a new "Last updated" date. For significant changes, we will notify account admins by email or in the Product before the changes take effect.

16. Contact and grievance officer

For questions, requests or complaints about your personal data, contact our Grievance Officer:

Please also read our Terms of Service.