Privacy Policy

1. Who we are

Charky Labs Pvt Ltd operates Ledger. We are the data fiduciary under India's Digital Personal Data Protection Act, 2023 for your account details. For the financial data your company puts into Ledger, your company is the data fiduciary and we process it on its behalf under the Data Processing Addendum.

4 Thendral Nagar, Vilankurichi P.O., Coimbatore 641035, Tamil Nadu, India. Email privacy@character.xyz. Telephone +91 72005 80713.

2. What we collect

• Your account: your name, email address and sign-in details. You sign in with a Character XYZ account, which is also operated by us.
• Your company's data: whatever you or your colleagues put into Ledger or connect to it, such as invoices, customers, deals, plans, bank statements and the notes on them. This can include personal data about other people, such as your customers' contact details.
• Activity: what each member and each connected AI assistant does in Ledger, recorded in an audit log that your company can see. It is how Ledger shows who proposed and who approved each change.
• Billing: your company name, billing address, GSTIN, and the payment reference from our gateway. We never see card, UPI or bank details.
• Technical: the information any web server receives, such as your IP address and browser type, kept in server logs for security.

3. Why we use it, and for how long

We use your account details to let you sign in, to tell you about your account, and to answer you. We use your company's data only to provide Ledger to your company, never for any purpose of our own.

Your company's data is kept while its account is open. After an account is closed, it stays available to export for 30 days, and is then deleted within a further 30 days. Backups that contain it expire within 35 days after that. Billing and tax records are kept for 8 years, because Indian law requires it. Server logs are kept for 90 days.

4. Cookies

Ledger sets only the cookies it needs to keep you signed in and to keep your session secure. This site runs no advertising cookies, no analytics cookies and no tracking pixels.

5. Who else processes it

These services help us run Ledger. Each acts on our instructions and may use the data only to provide their service to us.

• Amazon Web Services, in Mumbai, India, which hosts Ledger's application and database, and runs Ledger's built-in AI through Amazon Bedrock in the same region.
• Vercel, which serves the Ledger website and passes requests between your browser and the application.
• Razorpay, which takes payments.
• Google Workspace, for the email we exchange with you.

6. Where it is kept

Your company's financial data is stored and processed in India, on Amazon Web Services, Mumbai (ap-south-1), India. It leaves India only when your company connects a service that is operated elsewhere, as section 7 explains, or when you export it.

7. AI assistants you connect

If a member connects Claude, ChatGPT or another assistant to Ledger, the assistant can read what that member can read. What it reads is sent to the company that runs the assistant, under your company's own agreement with that company, and may be processed outside India. Ledger shows every connection, and any member can disconnect their own at any time.

Ledger's built-in AI runs on Amazon Bedrock in Mumbai. Amazon does not use the prompts or answers to train models, and neither do we.

8. What we never do

• We do not sell personal data or your company's data to anyone.
• We do not use your company's data to train an AI model.
• We do not look at your company's data except to provide support you have asked for, to keep the service secure, or when the law requires it.

9. Security

Data is encrypted in transit and at rest. Each company's data is kept apart at the database level, so one company's query cannot return another's. Access by our staff is limited and logged. If a breach affects your data, we will tell your company without undue delay.

10. Your rights

You can ask us to show you the personal data we hold about you, correct it, or delete it. Under the DPDP Act you may also nominate someone to exercise these rights for you, and complain to the Data Protection Board of India.

If your request is about data your company put into Ledger (for example, you are one of its customers), we will pass it to that company and help it respond, because it decides what happens to that data.

11. How to reach us, and how to complain

Write to privacy@character.xyz. We acknowledge within 2 working days and resolve within 15, as India's IT Rules 2021 require for a grievance.

Our Grievance Officer is Zeno Saviour, reachable at privacy@character.xyz or by post at 4 Thendral Nagar, Vilankurichi P.O., Coimbatore 641035, Tamil Nadu, India.

12. Changes

When this policy changes in a way that matters, the date at the top of this page changes, and we email account owners. If a change adds a service that receives your data, we will name it.