Sampada Privacy Policy
Effective date: October 4, 2026 · Prabin Singh Thakuri
1. Introduction
This Privacy Policy explains what information the Sampada mobile app (“Sampada”, “the app”, “we”, “us”) collects, how we use and share it, and the choices you have. It applies to the Sampada Android app and the Sampada servers it connects to.
Sampada is an invoicing, billing and bookkeeping app for small and medium businesses in Nepal. It is published by Prabin Singh Thakuri, based in Nepal.
By using Sampada you agree to this policy. If you do not agree, please do not use the app.
Effective date: October 4, 2026
2. Information We Collect
We collect only what the app needs to create invoices, keep your books and keep your account secure. You can use Sampada in guest mode without an account; in that case your data stays on your device and is not sent to our servers.
| Category | What we collect | Source | Required? |
|---|---|---|---|
| Account information | Name, mobile phone number, email address (optional), password (stored only as a one-way hash), team role (Owner, Cashier, Accountant, Order Taker) | You | Phone and password required to create an account |
| Business information | Business name, address, PAN/VAT number, registration status, fiscal year setting, business type, logo, signature image, payment QR image, bank account name, number and branch | You | Business name required; the rest optional |
| Records you create | Invoices, credit notes, payments, items and stock, expenses, suppliers, purchase bills, fixed assets, journal entries | You | Needed for the app to work |
| Your customers' and suppliers' details | Name, phone, email, address, PAN/VAT number of people and businesses you bill or buy from | You | Optional, entered by you |
| Device identifier | An app-generated device ID used to lock each account to one device | App | Required for signed-in use |
| App usage analytics | Screens viewed and in-app actions (for example, "invoice created"), your role and business type, approximate country, device model, OS version, app version, and an app-instance identifier | Google Analytics for Firebase | Automatic |
| Photos | Images you choose from your gallery (logo, signature, payment QR, invoice attachments) | You | Optional |
What we do not collect: precise location, contacts, call logs, SMS, or payment card data. Sampada does not process payments; a customer who pays by scanning your QR code pays through their own wallet or bank app.
Camera: the barcode scanner uses your camera only to read a barcode on your device. Camera images are not stored or uploaded.
Analytics limits: we never send customer names, phone numbers, PAN/VAT numbers, invoice numbers or business names to analytics.
3. How We Use Your Information
We use your information only to run and improve Sampada. We do not sell your data and we do not use it for advertising.
- Provide the service: create, number, store and sync invoices and other records; generate invoice PDFs and reports; back up your data so it survives a reinstall or a new phone.
- Meet tax rules: assign sequential invoice numbers and keep records in the format Nepal’s VAT rules require.
- Secure your account: sign you in, enforce team roles, limit each account to one device, and block repeated failed login attempts.
- Support you: reply when you contact us, including password-reset help over WhatsApp.
- Improve the app: use aggregated analytics to understand which features are used and where the app needs fixing.
- Legal obligations: comply with applicable law and respond to lawful requests from authorities.
Offline use: records you create offline are stored on your device first and sent to our servers when you are back online.
4. How We Share Information and Third-Party Services
We do not sell or rent your personal information. We share it only with the service providers below, who process it on our behalf to run the app, and only as much as they need.
| Purpose | Data involved | Privacy policy |
|---|---|---|
| App usage analytics (Google Analytics for Firebase) | Usage events, device and app info, app-instance ID | |
| Database hosting, to store and back up your records | Account, business and record data | MongoDB |
| Server hosting, to run the app's API | All data sent between the app and our servers | Render |
| Image storage, for images shown on invoices | Logo, signature and payment QR images | Cloudflare |
| Customer support and invoice sharing by chat | Only what you choose to send |
These providers may store data on servers outside Nepal. We choose providers that protect data with industry-standard security.
Images are publicly reachable by link. Your business logo, signature and payment QR image are stored at an unlisted web address so they can appear on the invoices you share. Anyone who has that address can view the image.
Sharing you start. When you share an invoice by WhatsApp, email or another app, that app’s own privacy policy applies to what you send.
Your team. If you add team members, they can see business records according to their role.
Legal reasons. We may disclose information if required by law, court order or a lawful request from a government authority, such as Nepal’s Inland Revenue Department.
Business transfer. If Sampada is merged or sold, your information may transfer to the new owner under this policy, and we will notify you first.
5. Data Retention
We keep your data only as long as needed for the purposes in this policy or as the law requires.
| Data | How long we keep it |
|---|---|
| Account and business profile | While your account is active; deleted within 30 days of a deletion request, except as below |
| Invoices, credit notes, payments and other accounting records | 6 years from the end of the fiscal year they belong to, as Nepal's VAT and income tax rules require |
| Customer and supplier details on those records | Same as the records they appear on |
| Analytics data | Up to 14 months in Google Analytics, then deleted automatically |
| Server security logs | Up to 90 days |
| Guest-mode data | On your device only, until you clear app data or uninstall |
When the retention period ends, we delete the data or make it anonymous.
6. Account and Data Deletion
You can ask us to delete your account and data at any time.
- Email prabinsingh750@gmail.com from the email address on your account, or message our support on WhatsApp from the app’s Help menu, with the subject “Delete my account”.
- Include your business name and the mobile number you sign in with.
- We will confirm your identity and complete the deletion within 30 days.
What we delete: your user account, business profile, uploaded images, customer and supplier lists, items, and analytics data linked to your app instance.
What we must keep: issued invoices, credit notes and related accounting records are kept for 6 years as required by Nepal tax law (see Section 5). They are kept securely, used for nothing else, and deleted when that period ends.
Team members: an Owner can remove a team member’s access at any time from the Team screen.
Guest mode: data you created without an account is only on your device. Uninstalling the app or clearing its data deletes it.
You can also ask for a copy of your data before deletion. Reports and invoices can be exported as PDF from within the app.
7. Data Security
All data sent between the app and our servers is encrypted in transit using HTTPS. Passwords are stored only as salted one-way hashes. Access is controlled by sign-in tokens, team roles and a one-device lock per account, and login attempts are rate-limited.
No system is perfectly secure. If a breach affects your personal data, we will notify you as required by law.
8. Children’s Privacy
Sampada is a business tool for adults. It is not directed to children under 13, or under 16 where local law sets a higher age, and we do not knowingly collect personal information from them. This is consistent with the US Children’s Online Privacy Protection Act (COPPA).
If you believe a child has given us personal information, contact us at prabinsingh750@gmail.com and we will delete it promptly.
9. Your Rights and Choices
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct it. Most details can be edited in the app under Business Profile and Settings.
- Delete it, subject to the legal retention in Section 5.
- Object to or limit certain processing, such as analytics.
- Withdraw consent where processing is based on consent.
To use any of these rights, email prabinsingh750@gmail.com. We will reply within 30 days.
You can revoke the app’s photo or camera permission at any time in your Android settings. You can reset your Android advertising ID or opt out of personalization in your device’s Google settings.
10. Changes to This Policy
We may update this policy from time to time. We will post the new version in the app and at this page and update the effective date. For significant changes, we will notify you in the app before they take effect.
11. Contact Us
For questions about this policy or your data:
- Developer: Prabin Singh Thakuri
- Email: prabinsingh750@gmail.com
- Phone / WhatsApp: +977 9866498278
- Location: Nepal