Bahiyo · Legal

Privacy Policy

Last updated: 19 June 2026

Version: 1.0 | Last Updated: 19 June 2026 | Effective Date: 19 June 2026

This Privacy Policy explains how Picasa Exhibition Private Limited (“Picasa Exhibition”, “Company”, “we”, “us” or “our”) collects, uses, stores, shares and protects your personal data when you use Bahiyo, our cloud-based (SaaS) accounting and bookkeeping application available at https://bahiyo.com and https://app.bahiyo.com (together, the “Service”).

Bahiyo helps Indian small businesses create accounting vouchers by typing or speaking in Hinglish, lets an AI read and draft entries from purchase bills (photo/PDF), and provides inventory, GST tax invoices, ledgers and reports.

We are committed to handling your data responsibly and in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and other applicable Indian laws.

Please read this Policy together with our Terms of Use and our Refund & Cancellation Policy. By creating an account or using the Service, you confirm that you have read and understood this Policy.

Language: This Policy is published in English. Where required under Section 5(3) of the DPDP Act, we will make this Policy (or a summary of it) available in Hindi or another language specified in the Eighth Schedule to the Constitution of India. In case of any conflict, the English version prevails for legal interpretation.

1. Who We Are (Data Fiduciary)

Picasa Exhibition Private Limited is the entity that owns and operates Bahiyo and decides the purposes and means of processing your personal data. Under the DPDP Act, we act as the Data Fiduciary in respect of the personal data described in this Policy.

Registered Address: C-217, Sector-63, Noida, Gautam Buddha Nagar, Uttar Pradesh - 201301
CIN: U82300UP2025PTC216737
GSTIN: 09AAPCP4417J1ZY
Contact Email: info@picasaexhibition.com
Support Phone: +91 99997 65167

1.1 Customer-Uploaded Third-Party Data (We Act as Data Processor)

When you enter or upload personal data about other individuals (for example, your customers, suppliers or employees) into Bahiyo, you remain the Data Fiduciary for that data and we act as a Data Processor processing it on your behalf, under and as governed by our Terms of Use and/or a Data Processing Agreement.

In that capacity:

We process such third-party personal data only on your documented instructions and only to provide the Service, as required under Section 8(2) of the DPDP Act (engagement of a Data Processor under a valid contract).
You are responsible for having a lawful basis — including any necessary consent, notice or other lawful ground — for collecting and uploading the personal data of your suppliers, employees, customers or other third parties into the Service.
You are responsible for responding to any rights requests or grievances those individuals raise in respect of the data you control, and we will provide you reasonable assistance to do so.

2. Notice of Collection (DPDP Act, Section 5)

This section provides the notice required under Section 5 of the DPDP Act. In summary:

What personal data we collect: the categories described in Section 3 below (account and contact information, accounting and business data you enter or upload, voice recordings, usage and activity logs, and cookies/session data).
The purpose of processing: the purposes described in Section 4 below (to create and secure your account, provide the Service, run AI-assisted entry drafting, process billing, send transactional communications, secure and improve the Service, and meet legal obligations).
How you can exercise your rights: you may exercise your rights as a Data Principal (access, correction, erasure, withdrawal of consent, grievance redressal and nomination) as described in Section 10.
How to make a complaint: you may complain to our Grievance Officer (Section 11) and, if unsatisfied, to the Data Protection Board of India.

This notice and this Policy are published in English and will be made available in Hindi or another Eighth-Schedule language in accordance with Section 5(3) of the DPDP Act, as noted above.

3. Data We Collect

We collect the following categories of data.

3.1 Account and Contact Information

Your name, business/firm name, email address and (if provided) phone number.
Authentication details associated with email one-time-password (OTP) login and Google sign-in.
Your chosen subscription plan and billing-related details (note: payments are processed by our payment sub-processor; we do not store your card or UPI credentials — see Section 7).

3.2 Accounting and Business Data You Enter or Upload

Accounting, financial and GST data, including vouchers, ledgers, tax invoices, inventory records and reports.
Purchase bills and similar documents you upload as photos or PDFs for the AI to read and draft entries from.
Any personal data of third parties (such as your customers, suppliers or employees) contained in the above records (see Section 1.1).

This is sensitive financial and business data, and we treat it accordingly.

3.3 Voice Recordings

When you use voice entry, we collect the voice recording and the text transcribed from it solely to create the corresponding accounting entry.
Voice recordings are used only for transcription into an accounting entry. They are not used as a biometric identifier, are not used to identify you, and are not used to train any AI model.
We retain a voice recording only for as long as needed to generate and let you confirm the entry, and we delete the voice recording file within 30 days of capture. The resulting accounting entry (text) is retained as part of your accounting records under Section 9.

3.4 Usage and Activity Logs

Login and logout events, features used, session duration and similar activity.
IP address, device and browser information, and diagnostic/log data.

3.5 Cookies and Session Data

We use cookies and similar technologies to keep you signed in, maintain your session, remember preferences and operate the Service securely. You can control cookies through your browser settings, though disabling essential cookies may affect functionality.

4. How We Use Your Data (Purposes and Lawful Basis)

We use your data only for lawful purposes. Under the DPDP Act, we process personal data only on the basis of (a) your consent or (b) certain legitimate uses permitted under Section 7 of the DPDP Act (in particular, the specified purpose for which you have voluntarily provided your data and have not indicated that you object). The table below ties each purpose to its lawful basis.

#	Purpose	Lawful Basis under DPDP Act
1	Create, authenticate and secure your account (OTP and Google sign-in).	Consent / specified purpose voluntarily provided (s.7)
2	Provide the core Service — generating vouchers, reading bills, and maintaining inventory, GST invoices, ledgers and reports.	Consent / specified purpose voluntarily provided (s.7)
3	Process your typed text, voice and bill content through AI to draft accounting entries for your review.	Consent
4	Process your subscription, billing, invoices and applicable taxes (INR plus 18% GST).	Consent / specified purpose voluntarily provided (s.7)
5	Send you transactional communications, such as OTPs, invoices, service notices and policy documents.	Specified purpose voluntarily provided (s.7)
6	Operate, maintain, secure, debug and improve the Service, and prevent fraud and misuse.	Specified purpose voluntarily provided (s.7) / legitimate use
7	Respond to your support requests and grievances.	Specified purpose voluntarily provided (s.7)
8	Comply with applicable law and enforce our Terms.	Compliance with law / legitimate use (s.7)

We do not use your accounting, financial, bill or voice data to build advertising profiles, and we do not sell your personal data.

We process your personal data for the lawful purposes described in this Policy and, where consent is the basis, on the basis of your consent, which you give when you create your account, submit data, or click to accept this Policy.

Your consent is free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and is limited to the personal data necessary for the specified purpose.
You may withdraw your consent at any time, as easily as it was given (see Section 10). Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If you withdraw consent necessary to provide the Service, we may be unable to continue providing some or all of the Service to you.
We maintain records of the consent you provide, including the timestamp and the version of this Policy you accepted, so that we can demonstrate valid consent.
Consent Manager: Where applicable, you may be able to give, manage, review and withdraw your consent through a Consent Manager registered with the Data Protection Board of India, in accordance with Section 6(7) of the DPDP Act, if and when such facility is made available.

6. How AI Processing Works

A core feature of Bahiyo is the use of artificial intelligence to turn your input into draft accounting entries.

When you type text, record a voice entry, or upload a bill (photo/PDF), the relevant text, voice and/or bill content is sent to our AI sub-processor, Sarvam AI (an Indian AI company), to generate the corresponding accounting entries.
Processing within India: Sarvam AI processes this content within India. We do not transfer this content outside India for AI processing.
No model training on your content: We do not permit our AI sub-processor to use your content (text, voice or bills) to train or improve its AI models.
Ephemeral processing: AI processing is carried out only to generate your requested accounting entry. Your content is not retained by the AI sub-processor for its own purposes after the entry is generated.
The output is presented to you as a draft. AI-generated entries are assistive and must be reviewed and confirmed by you before you rely on them.

Bahiyo is assistive bookkeeping software. It is not a substitute for advice from a Chartered Accountant or a tax/legal professional. You remain responsible for the accuracy of your data and for your statutory filings.

We do not sell your personal data and we do not share it for third-party advertising. We disclose your data only to the following categories of trusted sub-processors, strictly to provide the Service, and only under a written contract with each of them as required by Section 8(2) of the DPDP Act:

Payment processing — Razorpay Software Private Limited. Used to process your subscription payments. We never store your card or UPI credentials; these are handled directly by the payment processor under its own merchant policies.
AI processing — Sarvam AI (an Indian AI company). Receives the text, voice and bill content you submit, in order to generate accounting entries (see Section 6), within India and without using your content to train its models.
Transactional email service provider. Used to send OTPs, invoices and policy documents. This provider’s identity is maintained on our sub-processor list (see below).

Sub-processor list and changes. We maintain an up-to-date list of our sub-processors and will make it available on request or on our website. Where we add or change a sub-processor that processes your personal data, we will update that list and, where appropriate, notify you.

Cross-border transfers. Your accounting data is hosted in India (see Section 8). We do not transfer your personal data outside India for the core Service or for AI processing. Should any sub-processor (for example, a transactional email provider) process limited personal data outside India, any such transfer will comply with Section 16 of the DPDP Act (transfers are permitted except to countries or territories restricted by the Central Government of India).

We may also disclose data:

to comply with applicable law, legal process, or a lawful request from a government or regulatory authority; or
to protect the rights, safety and security of the Company, our users or the public; or
in connection with a merger, acquisition or reorganisation, subject to this Policy.

We require our sub-processors to protect your data and to use it only for the purposes for which it is shared.

8. Where Your Data Is Stored (Data Location)

All customer data is stored on servers located in India (Bengaluru). We do not host your accounting data outside India.

9. Data Security, Breach Notification and Retention

9.1 Security Measures

We implement reasonable security practices and procedures to protect your data, including as required under Rule 8 of the SPDI Rules and aligned with a recognised security standard such as IS/ISO/IEC 27001 or an equivalent documented security programme. Our measures include:

Encryption in transit using HTTPS/TLS.
Encryption at rest for sensitive financial data.
Per-tenant isolation — each customer’s accounting data is kept isolated in its own database.
Access controls and access logging designed to restrict and record access to personal data.
Backups of data to support recovery and continuity.
Operational safeguards designed to protect against unauthorised access, alteration, disclosure or destruction.

No method of transmission or storage is completely secure; however, we work to protect your data using measures appropriate to its sensitivity.

9.2 Personal Data Breach Notification

In the event of a personal data breach, we will notify the affected Data Principals and the Data Protection Board of India in the manner and within the timelines prescribed under the DPDP Act and the rules made under it (Section 8(6)).

9.3 Retention and Deletion

We retain your personal data for as long as your account is active and as needed to provide the Service.
On account closure, you will have a 30-day window to export your data (consistent with our Terms of Use). After this window, we will delete or anonymise your personal data within 30 days, except where retention is required or permitted by law. Once your data is deleted, it may not be recoverable.
Voice recordings are deleted on the shorter timeline stated in Section 3.3.
We may retain certain data for longer where required to comply with legal, tax, accounting or regulatory obligations, resolve disputes, or enforce our agreements.
Statutory retention of your accounting records is your responsibility. Indian law (for example, the Income-tax Act, 1961 and the Companies Act, 2013) may require you to preserve books of account and related records for several years (commonly 6 to 8 years). You, not Picasa Exhibition, are responsible for retaining and preserving your own accounting records to meet those obligations, including by exporting your data before closure.
You may request deletion of your data as described in Section 10.

10. Your Rights as a Data Principal

Subject to the DPDP Act and applicable law, you have the following rights in respect of your personal data:

Right to access — to obtain a summary of the personal data we process about you and the processing activities.
Right to correction and updating — to have inaccurate or incomplete data corrected, completed or updated.
Right to erasure — to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention requirements.
Right to withdraw consent — to withdraw consent you previously gave, at any time, as easily as it was given.
Right to grievance redressal — to a readily available means of raising and resolving grievances (see Section 11).
Right to nominate — to nominate another individual to exercise your rights in the event of your death or incapacity.

How to nominate: to exercise the right to nominate, send a written request to our Grievance Officer (Section 11) identifying your nominee and their contact details; we will record the nomination against your account.

How to exercise your rights: You can manage much of your account data directly within the app. For other requests, contact us at info@picasaexhibition.com or contact the Grievance Officer (Section 11). We may need to verify your identity (for example, by confirming control of your registered email) before acting on your request, to protect your data. We do not charge a fee for exercising your rights, except that we may charge a reasonable fee for manifestly unfounded or excessive/repetitive requests. We will respond within the timelines prescribed under the DPDP Act and the rules made under it.

11. Grievance Officer

In accordance with the DPDP Act and the Information Technology Act, 2000, we have appointed a Grievance Officer to address your concerns regarding your personal data and this Policy. The same individual serves as our Grievance Officer for both data-protection (DPDP) matters and consumer/e-commerce matters.

Grievance Officer: Prateek Mittal (must be a named individual based in India; to be filled before go-live)
Grievance Email: info@picasaexhibition.com (dedicated grievance channel; until activated, use info@picasaexhibition.com)
Phone: +91 99997 65167
Address: C-217, Sector-63, Noida, Gautam Buddha Nagar, Uttar Pradesh - 201301

We will acknowledge your grievance within 24–48 hours and resolve it within the period prescribed under applicable law (including the timelines under the DPDP Act and rules, and the one-month timeline under the Consumer Protection (E-Commerce) Rules, 2020 for consumer grievances). If you are not satisfied with our response, you have the right to register a complaint with the Data Protection Board of India.

12. Children’s Data

The Service is intended for use by businesses and individuals who are 18 years of age or older.

We do not knowingly collect or process the personal data of children (as defined under the DPDP Act).
Consistent with Section 9 of the DPDP Act, we do not undertake any tracking, behavioural monitoring or targeted advertising directed at children, and we would process a child’s personal data only with verifiable consent of a parent or lawful guardian where the law so requires.
Where feasible, we take steps to confirm that account holders are 18 or older at signup.
If we become aware that we have collected a child’s personal data without the required parental consent, we will delete it. If you believe a child’s personal data has been provided to us, please contact us so that we can take appropriate action.

13. Compliance with SPDI Rules (Published Privacy Policy)

This Policy also serves as our published privacy policy under Rule 4 of the SPDI Rules. It is published and accessible on our website and addresses: (i) the types of personal and sensitive personal data we collect (Section 3); (ii) the purposes of collection and use (Section 4); (iii) disclosure of information to third parties and sub-processors (Section 7); (iv) our reasonable security practices and procedures (Section 9.1); and (v) the means to contact us and the Grievance Officer (Sections 11 and 14).

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the Version and Effective Date above and, where appropriate, notify you through the Service or by email. We maintain an archive of prior versions for reference. Your continued use of the Service after the changes take effect constitutes your acceptance of the updated Policy.

15. Contact Us

If you have any questions, requests or concerns about this Privacy Policy or your personal data, please contact us:

Picasa Exhibition Private Limited
Email: info@picasaexhibition.com
Support Phone: +91 99997 65167
Registered Address: C-217, Sector-63, Noida, Gautam Buddha Nagar, Uttar Pradesh - 201301
Grievance Officer: Prateek Mittal — info@picasaexhibition.com

This Privacy Policy is governed by the laws of India. The courts at Gautam Buddha Nagar (Noida), Uttar Pradesh shall have exclusive jurisdiction over any disputes arising out of or relating to this Policy.

This Policy should be read together with our Terms of Use and our Refund & Cancellation Policy. In case of conflict on data-protection matters, this Privacy Policy prevails.

← Bahiyo home