Privacy Policy

1. Who we are

MGH Books ("MGH Books", "we", "us", "our") is a GST billing and accounting software service offered at books.mysticalglowhub.com. It is a product of Mystical Home Decor Products, a sole proprietorship operating in India.

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we act as the Data Fiduciary for the personal data you provide, and you are the Data Principal.

2. Scope & the laws we follow

This policy applies to personal data processed when you use MGH Books, our website, and related services. We endeavour to comply with applicable Indian law, including:

• The Digital Personal Data Protection Act, 2023 and rules made under it;
• The Information Technology Act, 2000, including Section 43A, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
• The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• The Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020.

3. What data we collect

a) Information you give us

• Account & contact data: name, mobile number, email address, business/company name, and (optionally) GSTIN.
• Business records you enter: invoices, parties (customers/suppliers), items, purchases, expenses, inventory and accounting entries. This is your business data — you control it.
• Payment data: when you buy a paid plan, payment is processed by our payment partner (Razorpay). We receive a payment confirmation, order ID and the billing details you enter. We do not collect or store your full card number, CVV or UPI PIN — these are handled directly by the PCI-DSS-compliant gateway.

b) Information collected automatically

• Basic technical data needed to run the service and keep it secure — e.g. log data, device/browser type, and a session/CSRF token. See our Cookie Policy.

4. How & why we use your data (purpose)

We only use your data for the purposes listed here, or for a purpose you have separately consented to. We do not sell your personal data, and we do not use your business records for advertising.

5. Legal basis & consent

We process your personal data on the basis of the consent you give when you create an account, make a purchase, or otherwise use the service, and for the "certain legitimate uses" permitted under the DPDP Act (such as providing a service you requested and meeting legal obligations). At or before the point of collection we provide notice of what we collect and why. You may withdraw consent at any time (see Your rights); withdrawal does not affect processing already carried out, and may mean we can no longer provide some or all of the service.

6. When we share data

We share personal data only with parties that help us run the service ("Data Processors"), under appropriate safeguards, and only as needed:

• Payment gateway — Razorpay, to process payments and refunds.
• Hosting / infrastructure — our hosting provider (servers located in India), to store and serve your data.
• Communication tools — to send you email/WhatsApp service messages.
• Legal / regulatory — where required by law, court order, or a lawful government request.

We do not share your data with advertisers or data brokers. Where the law requires, we put in place contracts that bind these parties to protect your data.

7. Where your data is stored

MGH Books is built "local-first": a copy of your business data is stored on your own device (in your browser's local storage) so the app works offline, and an encrypted copy is synced to our servers located in India. For full details, deletion and export options, see our Data Protection & Storage Policy.

8. How we protect your data

We follow reasonable security practices as required by Section 43A of the IT Act and the SPDI Rules, including: HTTPS/SSL encryption in transit, access controls, CSRF protection, secure handling of credentials, and restricting staff access on a need-to-know basis. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials and licence key confidential.

9. How long we keep your data

We keep your personal data for as long as your account is active and as needed to provide the service, and thereafter only as long as required to meet legal, tax (e.g. GST/Income-tax record-keeping), accounting or dispute-resolution obligations. When data is no longer needed, we delete or anonymise it. You can request deletion as described below.

10. Your rights under the DPDP Act

Subject to the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you;
• Correct, complete or update inaccurate data;
• Erase your data where it is no longer needed;
• Withdraw consent at any time;
• Grievance redressal — raise a complaint with us (see below) and, if unsatisfied, with the Data Protection Board of India;
• Nominate another person to exercise your rights in the event of death or incapacity.

To exercise any right, email support@mysticalglowhub.com or message us on WhatsApp. We may need to verify your identity first, and we will respond within the timelines required by law.

11. Children's data

MGH Books is intended for businesses and users aged 18 and above. We do not knowingly collect personal data of children (persons under 18) without verifiable parental/guardian consent as required by the DPDP Act. If you believe a child has provided us data, contact us and we will delete it.

12. Data breach handling

If a personal data breach occurs, we will take prompt remedial action and, where the DPDP Act and rules require, notify the affected Data Principals and the Data Protection Board of India in the prescribed manner and timeframe.

13. Grievance Officer

In accordance with the IT Act/Rules, the Consumer Protection (E-Commerce) Rules, 2020 and the DPDP Act, our Grievance Officer is:

We will acknowledge complaints within 48 hours and aim to resolve them within 15 days, or sooner where the law requires.

14. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will change, and material changes will be notified through the app or by email. Continued use after changes means you accept the updated policy.