Privacy Policy
This Privacy Policy explains what personal data Indo Trade (the "app", on the phone and on the web) collects, why, who can see it, how long it is kept, and what you can do about it. Indo Trade is run by Twocompo ("we", "us"). If anything here is unclear, write to ashish@twocompo.com.
1. What the app is, and who is responsible for which data
Indo Trade is a record-keeping tool for businesses that trade commodities. A business registers an organisation; its owner decides who gets a login (owners, accountants, salespeople). The app does not move money, hold funds or connect to a bank. It records what the business enters.
- Account and sign-in data (your name, email, password and the technical data described below): we decide how it is used, so we are responsible for it.
- Business data an organisation enters (trades, buyers, suppliers, payments, documents): the organisation decides what is entered and why. We store and process it on the organisation's behalf and only to provide the service. The organisation is responsible for having the right to enter other people's details, for example a buyer's contact person.
2. What we collect
Data you give us
- Account: your name, email address, optional phone number, role, the organisation's name and country, and your password. The password is stored only as a one-way hash; nobody, including us, can read it. An optional signature image if you add one.
- Business records you enter: companies, trades, quantities and prices, buyers, suppliers, transporters and agents (names, contact persons, phone and WhatsApp numbers, email and postal addresses, tax numbers), truck and driver details, expenses, payments and receipts, salary and commission records of employees, exchange rates, and the contracts, invoices and delivery notes the app generates from them.
- Bank and cash account details that you choose to record (account name and number, bank, SWIFT, IBAN) so that they can be printed on your invoices. We never ask for card numbers or online banking passwords.
- Files: photos of delivery proof and receipts, PDFs, and your company logo, stamp and signature images. The app reads the camera or photo library only when you choose to attach something, through the phone's own camera and photo picker.
- Messages: when you email a document from the app, the recipient's address and your optional message.
Data created when you use the app
- Sign-in and security data: the time of each sign-in, the kind of device (for example "android" or "web"), your IP address, and a sign-in token that keeps you signed in. On the phone the token is kept in the system's secure storage (Keychain or Keystore).
- Activity log: a record of who created, changed, approved or deleted what, and when, with the user's name and IP address. Organisation owners can read it. It exists for accountability and security.
- Entries waiting to be sent: if there is no signal when you save a trade, payment or expense, the phone keeps it on the device until it can be sent.
- Server logs (requests, errors, time, IP address) used to keep the service running and safe.
What we do not collect: your location, contacts, microphone, advertising identifier or browsing history. We use no advertising, no analytics and no tracking technology, and the app does not contain third-party advertising or analytics code.
3. Why we use it
- To provide the service you asked for: sign you in, store and show your records, generate and share documents, calculate totals and balances from what you entered.
- To review and approve new organisations, support you, and keep the service secure (prevent misuse, investigate problems).
- To meet legal obligations and to protect our rights.
- To improve and maintain the service, using the operational data above and not by profiling you.
Where the law asks for a legal basis, we rely on performing our agreement with you and your organisation, our legitimate interests in running a secure service, legal obligations, and your consent for optional things such as attaching photos.
4. Who can see your data
- Inside your organisation: other users of the same organisation see the business data according to their role (for example a salesperson sees their own trades; owners and accountants see accounts and payments). Organisations cannot see each other's data.
- Documents you share: "Share" creates a link with a long random code. Anyone who has the link can open that document, so send it only to the person it is meant for. The same applies to a document you send by WhatsApp, email or any other app you choose; those services have their own privacy policies.
- Us: our platform administrators can see organisation and account details to approve registrations, give support and keep the service safe. They enter an organisation's data only for those purposes.
- Service providers: the hosting and email delivery services that run the servers and send the emails you ask for, under confidentiality and only for this purpose.
- Authorities and legal requests: if a law or a valid legal request requires it, or to protect rights, safety and the service.
- Business changes: if the service is transferred to another operator, your data moves with it under the same protections.
We do not sell your personal data and we do not share it for advertising.
5. Where it is stored and how it is protected
Data is stored on servers operated by us or by our hosting provider, which may be in a country other than yours. We protect it with encrypted connections (HTTPS), hashed passwords, secure token storage on the phone, separation between organisations, role-based access, an activity log and regular backups. No system is perfectly secure; if a breach affecting you occurs we will tell you and the authorities as the law requires.
6. How long we keep it
- Your account and business data are kept while the account and organisation exist.
- When you delete your account (section 7) the data described there is deleted at once. Nightly backups are kept for 14 days and are overwritten after that, so deleted data leaves the backups within 14 days.
- Records that other people in your organisation entered, which carry your name, stay in the organisation's books after you leave, but your name is replaced with "Deleted user".
- Some laws require businesses to keep accounting records for years. That duty belongs to the organisation. Download the reports you need before you delete an organisation.
7. Your choices and rights
- See and correct your details in the app (Masters › Users) or ask your organisation's owner.
- Delete your account yourself, in the app (More › Delete my account) or on the web at https://trade.twocompo.com/delete-account. If you are the last owner, this deletes the whole organisation and everything in it for good. Anyone else is erased as a person: name, email, phone, signature, sign-ins and notifications are deleted.
- Export your business data through the reports and the PDF documents.
- Ask us at ashish@twocompo.com to access, correct, delete or restrict the use of your personal data, or to object to it. We answer within a reasonable time and may need to confirm who you are. If you are a contact person of an organisation's buyer or supplier, please contact that organisation first, because it decides what it records.
- You may complain to the data protection authority of your country.
8. Children
The app is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children. If you think a child has registered, write to us and we will delete the account.
9. Cookies on the web portal
The web portal uses only the cookies it needs to work: a session cookie that keeps you signed in and a security token that protects forms. It uses no advertising or analytics cookies.
10. Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change is important we will tell you in the app or by email before it applies.
11. Contact
Twocompo
Email: ashish@twocompo.com