Privacy policy
This policy explains how DukaanMatic by SkoolMatic handles information across its website, business ERP, local installations, cloud services, communications and support.
Last updated: 26 October 2026Who this policy covers
This policy applies to business owners, authorised employees, website visitors and people who contact DukaanMatic. Businesses decide which customer, supplier and employee records to enter and who may use them. We process those records to provide the requested service and handle account, billing, security and support information to operate DukaanMatic.
Information we handle
Depending on the features you use, information includes account and business contact details, addresses, GSTIN and other business identifiers, customer and supplier details, products, stock, purchases, sales, invoices, returns, payments, balances, rewards and employee access records. We also handle support messages, uploaded files, payment references, device and sign-in information, diagnostics and communication delivery records needed for connected services.
How we use information
We use information to run billing, inventory, accounting and business workflows; authenticate users; manage subscriptions; deliver requested messages and integrations; reconcile charges; protect accounts; diagnose problems; provide support; and meet applicable legal obligations. Provide only information necessary for your business purpose and ensure you have the required authority, notices and permissions. We retain activation dates, service periods and hashed business-identity matches, using GSTIN and combinations of business name, address, PIN code and verified contacts, to detect repeat registration and prevent restarting the included local year. We do not match on a business name alone or disclose another account’s contact details. If a match is incorrect, contact account recovery for review.
Local storage and your devices
In Local mode, operational records are stored on your device. The installed desktop application maintains a local database; browser storage also holds application data and preferences. Local storage is not automatically a cloud backup. Only records successfully sent through an enabled backup, sync, migration or other connected feature reach that service. Local mode may still send account, activation, payment, support or messaging information when you use those services. Clearing browser or application data, uninstalling, device loss or disk failure can remove local records.
Cloud storage, sync and backups
Cloud access and Cloud Backup are separate services. Cloud access stores and synchronises business records for authorised connected use; Cloud Backup stores recovery snapshots when enabled under an eligible plan or add-on. Automatic desktop backup requires the application to be open, online and signed in, with the service active and configured. Check successful backup completion rather than assuming an upload occurred. Cloud Backup currently retains the latest seven distinct snapshots per business, replacing older snapshots as new ones are saved.
Backup contents and recovery limits
ERP snapshots contain supported business records, not every server record or separately uploaded file. A backup created from the cloud workspace does not include desktop changes that have not synchronised. Cloud backup snapshots are encrypted at rest; downloaded local JSON backups are readable files and must be protected by you. Keep secure, separate daily copies and periodically verify restoration. A device-only record cannot be recovered by DukaanMatic without a usable backup or successfully transferred cloud copy; cloud backups also cannot guarantee recovery after every incident.
Limited access to cloud records
Authorised DukaanMatic personnel may access relevant cloud records and settings only as reasonably necessary for support, troubleshooting, security, service quality and improvement of the contracted service. Access must be limited to the task and personnel who need it, subject to confidentiality and applicable law. Aggregated or de-identified information should be used where it serves the purpose. This does not authorise unrelated marketing or unrestricted browsing of business records.
Permission before staff change records
Your business retains control of its operational records. DukaanMatic personnel will not manually edit or delete those records without prior written authorisation from an authorised business representative, except where legally required. A verified support request or registered business email must identify the requested changes. Your users’ actions, configured workflows and the retention or backup cycles described here remain part of your service instructions. Quality review alone does not authorise changes.
Sharing and connected services
We do not sell personal or business information or share business records for third-party advertising. Necessary information is processed by hosting, storage, payment, security, support, SMS, WhatsApp, calling or other integration providers to deliver selected features, subject to applicable confidentiality and data-protection requirements. Messages require recipient details and message content; enabled GST integrations require relevant business and transaction information. We may also disclose information with your authorisation or where required by law. Provider processing is limited to the service being used.
Website, demos and communications
Browser storage is used for preferences, sign-in and application state. When you request a demo or contact support, we use the business and contact details you submit to respond, arrange the session and follow up on that request. Enabled calling or meeting features may process audio, transcripts, recordings and session details as disclosed in the relevant feature. Businesses must provide any required recipient notices and permissions before sending communications or recording people.
Security and your responsibilities
We use access controls, encrypted transport and reasonable technical and organisational safeguards for hosted services. No storage system is risk-free. Restrict employee permissions, protect credentials and devices, use device encryption where available, and store exports separately with restricted access. Do not send passwords, OTPs or full payment credentials to support.
Retention and deletion
Hosted information is retained as needed to provide the service, maintain security, resolve disputes and meet applicable accounting or legal requirements. Backup rotation can remove older snapshots. Cancelling a subscription does not itself delete records, and account deletion does not erase copies on your devices, exported backups or recipients’ systems. Eligible hosted records can be requested for deletion under our Data deletion request policy; legally required records may be retained. Export records you need before requesting closure.
Choices, requests and contact
Contact [email protected] for access, correction, deletion, consent withdrawal where applicable, or a privacy complaint. We verify identity and authority before acting. Customers, suppliers and employees should normally contact the business that controls their records first; we can assist with service-held information as appropriate. Withdrawing permission for an optional feature may prevent that feature from working. We will handle requests under applicable law and explain any required retention or other limitations.
Policy updates
We publish the revision date on this page and may communicate material changes through the service or registered contact details. This policy concerns DukaanMatic’s business services; separate SkoolMatic education services have their own policies.