This Privacy Policy ("Policy") is published by S & S Associates, a tax, compliance and advisory firm having its place of business at Ashok Nagar, Medahalli, Bengaluru, Karnataka, India ("S&S Associates", "we", "us", "our"), in accordance with the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology Act, 2000 and the rules made thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable.
This Policy applies to S&S Billing Suite ("the Software", "the App"), a Windows desktop application licensed by S&S Associates to its clients for GST-compliant invoicing and related business record-keeping. It describes what personal data the Software and its supporting services process, why, where that data lives, and the rights available to individuals whose personal data is processed ("Data Principals" under the DPDPA).
This Policy governs only the Software described here. It does not govern the S&S Associates website (s-and-s-associates.in) or any other S&S Associates service, which are covered by separate policies.
The Software is designed so that the business data a client enters — invoices, customers, product/service catalogues, and business profile details — is stored exclusively in a file on that client's own computer and is never transmitted to, or accessible by, S&S Associates. S&S Associates operates no server that receives, stores, views, or processes this business data. The only data S&S Associates can see is limited account and licensing information, described in Section 3.1 below.
3.1 Account, Sign-In and Licence Data
Sign-in to the Software (email and password) is handled by Supabase, an independent third-party authentication provider. S&S Associates does not receive or store a client's raw password. Sign-in produces a cryptographically signed session token, verified on the client's own device against Supabase's public signing keys, that carries the client's licence status (active or expired, and the paid-until date) as part of its signed contents.
Through its own Supabase project, S&S Associates can see: the client's account email, and licence/subscription status (the product key used, activation and expiry dates, and active/inactive state). This is billing and account-administration data, necessary to operate the subscription. S&S Associates does not have access, through Supabase or otherwise, to any client's invoices, customers, products, or business profile.
Purpose: account authentication and licence administration.
Legal basis: performance of the licensing/subscription contract between S&S Associates and the client, and the client's consent given at sign-up.
3.2 Business Data Entered Into the Software
Invoices, customer records, product/service catalogues, and business profile details (legal name, GSTIN, address, phone, email, bank details, UPI ID, logo) are stored in a single SQLite database file on the client's own machine, under %LOCALAPPDATA%\S&S Associates\Billing\. This data is never transmitted anywhere by the Software, except where the client explicitly enables the optional Google Drive backup described in Section 3.3.
Where this business data includes personal data of the client's own customers (for example, a B2C customer's name and state, entered by the client for GST purposes), that data is processed by the client as a data fiduciary in its own right for its own business and compliance purposes. S&S Associates has no visibility into, and exercises no control over, this data — it never leaves the client's device through the Software.
3.3 Google Drive Backup (Optional, Client-Controlled)
A client may optionally connect their own Google Drive account, via Google's OAuth sign-in, to back up their data. This feature uses the narrowest available Google permission scope (drive.file), meaning the Software can only see or manage files it has itself created — it cannot browse or access any other file already in the client's Drive.
When a client runs "Backup Now", a full snapshot of the local database and any invoice PDFs not already backed up are uploaded directly from the client's own machine to the client's own Google Drive, in a folder named "S&S Billing Backups". This transfer occurs directly between the client's device and Google — it does not pass through, and is not visible to, S&S Associates. S&S Associates' role is limited to a one-time technical registration of the application with Google; S&S Associates has no access to the connection, the client's Drive account, or the backed-up data.
This feature is entirely optional. A client who does not connect Google Drive is unaffected, and local-only operation works identically either way.
3.4 UPI QR Code Generation
Where a client configures a UPI ID for payment collection, the QR code shown on a generated invoice is produced by calling a third-party public API, api.qrserver.com, with the payment amount, the business's UPI ID, and the relevant trade name. No customer personal data is included in this call.
Purpose: generating a scannable payment QR code on the client's own invoices.
Legal basis: necessary to provide a feature the client has actively configured (consent by configuration).
3.5 What Is Never Collected
No analytics, telemetry, or usage tracking of any kind.
No advertising identifiers, and no data is used or shared for advertising.
No network calls are made by the Software other than to: Supabase (sign-in and licence status), Google (Drive backup, only if connected), and api.qrserver.com (only when generating an invoice with a UPI ID configured).
| Data | Location | Accessible to S&S? |
|---|---|---|
| Invoices, customers, products, business profile | Client's own device (local SQLite file) | No |
| Account email, licence status | Supabase (third-party, cloud) | Yes — limited to this data only |
| Optional backups (full database + PDFs) | Client's own Google Drive account | No |
| UPI ID, amount, trade name (per invoice, if UPI configured) | Sent to api.qrserver.com to render QR image | No — third party, not S&S |
Supabase and Google Drive may store or process data on servers located outside India. To the extent the DPDPA restricts or conditions transfer of personal data outside India, S&S Associates relies on these providers' respective data-processing terms and safeguards, and will comply with any country-specific restrictions notified by the Central Government under the DPDPA as and when applicable. In the case of Google Drive, the client — not S&S Associates — is the party initiating and controlling any such transfer, as it occurs from the client's own device to the client's own Google account under the client's own Google account terms.
Account and licence data (Section 3.1) is retained by Supabase for as long as the client's account remains active, and for a reasonable period thereafter as needed for billing records, dispute resolution, and legal compliance.
Business data (Section 3.2) resides solely on the client's device and is retained for as long as the client chooses to keep it. It is not affected by, and does not depend on, the status of the client's subscription. If a licence lapses, existing data remains fully viewable and exportable; only new create/edit/delete actions are blocked until renewal.
Backup data on Google Drive (Section 3.3) is retained until the client deletes it from their own Drive account; S&S Associates has no ability to retain, restore, or delete this data on the client's behalf.
The Software's internal audit trail (a log of invoice, trade name, customer, and profile changes) is append-only and has no in-app deletion mechanism, by design, for accounting-integrity and audit purposes.
| Service | Purpose | What It Receives |
|---|---|---|
| Supabase | Sign-in, licence/subscription status | Account email, password (authentication only, not stored by S&S), licence claims |
| Google Drive (client's own account) | Optional cloud backup, controlled by the client | Full local database and invoice PDFs — only if the client connects and initiates a backup |
| api.qrserver.com | UPI QR code generation on invoices | UPI ID, invoice amount, trade name — only when a UPI ID is configured |
S&S Associates does not sell, rent, or share personal data with any party for marketing purposes. Data is shared with the third parties above only to the extent necessary to operate the specific feature described.
Sign-in session tokens are cryptographically signature-verified against Supabase's public keys, so a copied or hand-crafted session file cannot be used to authenticate.
Google Drive tokens, where the client connects that feature, are stored encrypted at rest on the client's own machine.
All monetary calculations use fixed-point decimal arithmetic (never floating-point), to prevent rounding drift in tax and billing figures.
The audit trail is append-only, with no in-app mechanism to alter or delete a historical entry.
The Software currently ships unsigned (not code-signed); see the accompanying Terms of Use & Disclaimer for what this means for a client running the executable file.
In respect of the limited personal data that S&S Associates itself processes (Section 3.1 — account email and licence status), a client may, subject to verification of identity:
Request access to, and a summary of, the personal data S&S Associates holds about them and its processing;
Request correction or updating of inaccurate or incomplete personal data;
Request erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to any legal or contractual retention requirement (for example, billing records);
Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before such withdrawal — noting that withdrawing account consent will mean the client can no longer sign in to or use the Software;
Nominate another individual to exercise these rights on their behalf in the event of death or incapacity;
Register a grievance with S&S Associates in the first instance, as described in Section 11 below, and thereafter with the Data Protection Board of India, if the grievance is not resolved satisfactorily.
Because business data (Section 3.2) never reaches S&S Associates, requests concerning that data — for example, a request by a client's own customer to access or correct their details held in an invoice — must be directed to the client (as the data fiduciary for that data), not to S&S Associates.
The Software is a business tool intended for use by adults operating or employed by a business entity. It is not directed at, and S&S Associates does not knowingly collect personal data from, children.
Any question, request, or grievance regarding this Policy or the processing of personal data described in it may be directed to:
S & S Associates
Ashok Nagar, Medahalli, Bengaluru, Karnataka, India
Website: s-and-s-associates.in
Grievance Officer: Shashikala
Email: info@s-and-s-associates.in
We will endeavour to acknowledge and address grievances within the timelines prescribed under the DPDPA and its rules.
S&S Associates may update this Policy from time to time to reflect changes in the Software, applicable law, or our practices. The "Effective Date" above will be updated accordingly, and material changes will be notified to clients through the Software or by email where appropriate. Continued use of the Software after such notice constitutes acceptance of the revised Policy.
This Policy is governed by the laws of India. Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka.