ErpAI

Privacy Policy

Last updated: 12 November 2026

ErpAI is built and operated by BeyondBoxAI Technologies Pvt. Ltd. (“we”, “us”), an Indian company. This policy explains what personal data we handle, in which role, and what you can ask us to do about it.

The two roles we play

  • For website visitors and trial signups (people who browse this site or start a trial), we decide what is collected and why. We are the data fiduciary, and you deal with us directly.
  • For the people inside a customer's account, the customer is the data fiduciary and we process on their instructions. That covers their staff and workers, and the vendors, customers and contacts they record. Ask the company first; we will help them answer.

What we collect, and why

From website visitors and signups

  • What you give us: your company or plant name, your name, work email, mobile number and, if you add them, your website and approximate headcount. We collect these when you start a trial. We use them to create your workspace, send the verification code to your mobile on WhatsApp, and follow up on your trial. Your password is stored only as a one-way hash.
  • What the site records: pages viewed and referrers, tied to a session cookie rather than to an advertising profile. You can switch this off for your browser at /analytics-optout. A two-year cookie then remembers your choice, and that is its only job.

Inside a customer account

  • Business records: purchase requests, orders, receipts, stock, production, quality and maintenance records, and the vendor and customer details that go with them, all entered by the customer.
  • Documents you upload: invoices, purchase orders, challans and similar papers, uploaded so that AI can read them and draft the record.
  • People records, where the customer uses them: the worker register, shifts, attendance and positions of the customer's own staff. Location is recorded only where the employer has switched it on and the employee has given consent, and the employee can withdraw that consent in the app.
  • Sensitive fields are encrypted at rest: bank account numbers and IFSC codes, PAN, national ID and travel-document numbers are stored encrypted, so a copy of the database alone does not expose them.

What we never do

  • We do not sell personal data, to anyone, for anything.
  • We do not use one customer's data to benefit another. Each company's data is kept separate by a tenancy boundary enforced in the software.
  • We do not let AI write to records on its own. Every AI-drafted entry waits for a person to confirm it. That is the product's founding rule, and it is also a privacy control.

AI, honestly described

When you upload a document for ErpAI to read, the document is sent to an external AI model provider, currently Anthropic (Claude) or Google (Gemini), which drafts the record. Only the content needed for that task is sent. Nothing is saved until a person confirms the draft. We use these providers under their API terms, and not to train models on our customers' data.

Who else touches the data (sub-processors)

These are the only third parties that handle personal data on our behalf, each for one job:

  • Hosting: the application and database run on managed servers operated by Hostinger.
  • Messaging: verification codes and notifications sent on WhatsApp go through Meta's WhatsApp Business platform via our messaging provider. Email is sent through the customer's own configured mailbox where they set one, or through ours.
  • AI model providers: as described above, only for the AI features and only the content needed for the task.
  • Payments: when you pay online, card and bank details are entered directly with an RBI-authorised payment gateway (Razorpay or Paytm). We never see or store card numbers.

How long we keep it, and how you leave

  • Records inside an account stay for as long as the account is active, plus any period the customer is required by law to retain them (accounting and GST records, for example). Retention is the customer's decision, not ours.
  • You can always leave. A customer can export their data at any time, in usable formats, without asking us.
  • Backups for disaster recovery are kept for a limited period. Deleted data drops out of the backups as they expire.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask us to access, correct or erase your personal data, and you may withdraw a consent you gave. For records kept by your employer, ask your employer, and we will help them answer. Write to the address below. We do not make you prove more than your identity to exercise a right.

If something goes wrong

If a breach affects your personal data, we will notify the affected customers and the Data Protection Board as the DPDP Act requires. We will tell you in plain language what happened and what we are doing about it. Changes to records in ErpAI are written to an activity log, which is what makes an honest account of any incident possible.

Children

ErpAI is business software for companies and their staff. It is not directed at children, and we do not knowingly collect their data.

Grievances and contact

Grievance contact under the DPDP Act:
Amreesh Nehra, BeyondBoxAI Technologies Pvt. Ltd.
sales@beyondboxai.com · +91 81304 68801

We reply to privacy grievances within the timelines the law sets, and usually much faster.

Changes to this policy

When we change this policy, we change the date at the top. For material changes, we tell account owners directly. We do not weaken a commitment quietly.