Privacy policy

Last updated 14 November 2026. This page says what KamaiKit keeps about you, why, and who else handles it.

KamaiKit decides how your data is used and is responsible for it under Indian law. KamaiKit is for people aged 18 or over who run or act for a business; it is not meant for children.

What we keep

• Your account: your email address. If you sign in with Google, also the name and picture Google sends. Your password is stored only in scrambled form; we cannot read it.
• Your business: its name and GSTIN, read from your reports or typed in by you.
• Figures from your reports: orders, amounts, tax, Amazon's fees, refunds, and the state or pincode an order went to. For a sale to a business, that buyer's GSTIN. From your GSTR-2B, your suppliers' names and GSTINs. Product costs you type in.
• Payments: the plan, amount, date and status of each payment, and its invoice. We never see or keep your card or UPI details; Razorpay handles those.
• Messages you send us: the name, email address and message you type into the Contact us form.
• Your WhatsApp number: only if you give it and agree to reminders.
• Sign-in records: when you signed in, and the internet (IP) address and browser used. Our hosting provider's server logs hold the same for each page opened. These are kept to keep accounts safe and to find faults.

What we do not keep

• The report files themselves. Each file is deleted as soon as it has been read; one that was never read is deleted within a day.
• Your Amazon or GST portal passwords. We never ask for them.
• Names, phone numbers or street addresses of the people who buy from you.

Why we use it

• To build your GST files, find possible payment mistakes and work out profit.
• To sign you in and keep your account safe. If you switch on two-step sign-in, the key that links your authenticator app is stored with your account.
• To take payments, issue invoices and give refunds.
• To send the reminders you asked for, and emails about your account.

We do not sell your data, show adverts, or use your figures for anything other than your own account.

We handle your data because you ask us to: by creating an account, adding a report, paying, or switching reminders on. You can take that back at any time by deleting what you added or your whole account (see Your choices). Payment and invoice records are the one exception, because tax law makes us keep them.

Other people's details in your reports

Your reports can name other businesses: a buyer's GSTIN, a supplier's name and GSTIN. You are responsible for having the right to add them. We handle them only to work out your figures, on your behalf, and they are deleted with your account.

Who can see it

• You, and anyone you sign in as. A CA sees only the clients in their own account.
• Our support staff can see your email, plan, payments, whether two-step sign-in is on, and which files could not be read, so they can help you. They cannot see your orders, tax figures or profit.

Companies that handle data for us

• Supabase: stores the database and runs sign-in. The database is in Tokyo, Japan, so your data is kept outside India.
• Our hosting provider (Vercel): runs the website. Its servers may be outside India.
• Razorpay: takes payments.
• Google: only if you choose to sign in with Google.
• Cloudflare: checks that the Contact us form is filled in by a person, not a robot.
• Our email provider: delivers emails about your account.
• WhatsApp (Meta): only if you turn on WhatsApp reminders.

Cookies

We use only the cookies needed to keep you signed in and to remember which business you have open. Your choice of light or dark colours is kept in your browser. There are no advertising or tracking cookies.

Keeping it safe

Data is sent over an encrypted connection, each account can read only its own rows, and you can add a second step to sign-in. No service can promise it will never be broken into. If your data is ever exposed, we will tell you, and the Data Protection Board of India, without delay, as the law requires.

How long we keep it

We keep your data while your account is open. Ending a paid plan does not delete anything. Payment and invoice records are kept for as long as tax law requires (at present up to eight years), even after an account is closed.

Your choices

• Download a copy of your data on Settings → Data, or ask us for one, or for a mistake to be corrected.
• Delete your account and your data yourself on Settings → Data, or ask us to. Invoices for payments you made are kept as long as the law requires. If you tell us why you are leaving, we keep that note without your name or email.
• Turn WhatsApp reminders off at any time on Settings → Notifications.
• Name someone who may use these rights for you if you die or become unable to. Write to us to do so.

Questions and complaints

For any of these, or to raise a complaint about how your data is handled, write to our support email (not set yet). See also Contact us. We acknowledge a complaint within 48 hours and answer it within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Changes

If this policy changes in a way that matters, we will say so on this page and by email before the change applies.