1. About Sonaro and This Policy

This Privacy Policy applies to the Sonaro software application (available on mobile and desktop platforms) and our official website located at https://sonaro.in, operated and maintained by VRSONI Soft ("we", "us", or "our"), headquartered in Jodhpur, Rajasthan, India.

We are dedicated to safeguarding the privacy, confidentiality, and integrity of your commercial data. This policy details how our application collects, uses, stores, and protects information when you operate our software.

2. Offline-First Architecture & Data Ownership

Sonaro is engineered as an offline-first local application:

• Local SQLite Storage: All day-to-day business accounting records—such as customer directories, transactions, stock inventory, invoices, gold/silver rates, and ledger balances—are stored locally in an encrypted database directly on your personal hardware (mobile phone or computer).
• No Centralized Cloud Harvesting: We do not automatically upload, scrape, or store your private commercial records onto centralized company servers. Your financial transactions and jewellery stock remain strictly under your control.
• Data Ownership: You retain complete and unconditional ownership of all business records created or stored using Sonaro.

3. Information We Collect

We may collect and process the following categories of information:

• Account & Business Setup: Shop or business name, owner name, phone number, email address, physical shop address, GSTIN, and staff login credentials (usernames and PINs).
• Customer Ledger & Billing Records: Customer names, contact numbers, order histories, item descriptions, purity/karat, gross weight, net weight, wastage, making charges, payments, and balances entered voluntarily by you.
• Technical Diagnostics: Anonymized application crash logs, operating system versions, and unique device hardware identifiers required for software licensing and anti-piracy validation.

4. Device Permissions & Why We Need Them

To deliver essential jewellery management and point-of-sale functionality, Sonaro may request the following device permissions:

• Camera / Photos: To capture jewellery photos for stock catalogs, attach images to repair job sheets, and scan barcode or QR labels on product tags.
• Bluetooth & Nearby Devices: To connect with wireless Bluetooth thermal receipt and barcode printers for invoice printing.
• Storage / Media: To export generated PDF tax invoices, download reports in Excel/CSV format, and read or write local database backup files.
• Internet & Network: To retrieve live market bullion prices (Gold 24K, 22K, 18K and Silver), check for application updates, and connect to Google Drive for secure backup and restore functions.

5. Google API Services & Google Drive Data Policy (OAuth Verification & Limited Use)

Sonaro offers an optional, user-initiated Google Drive Cloud Backup & Restore integration. This section describes our exact usage of Google APIs and user data in strict compliance with Google's policies.

5.1 Requested Google OAuth Scope

Sonaro requests access to the following Google OAuth 2.0 scope only:

• https://www.googleapis.com/auth/drive.appdata (View, create, update, and delete its own configuration and application data in your Google Drive).

5.2 Exclusive Purpose: Application Data Folder Backup & Restore

The Google Drive integration is used exclusively for one explicit purpose: to allow you to securely store and restore encrypted backup snapshots of your Sonaro database and product photos directly to your own Google Drive storage.

5.3 Strict Application Data Folder Isolation

By utilizing the restricted drive.appdata scope:

• Sonaro interacts only with its own hidden, sandboxed Application Data folder (appDataFolder) within your Google account.
• Zero Access to Personal Files: Sonaro cannot view, search, read, modify, or delete any personal documents, photos, Google Sheets, Google Docs, or files stored in your general Google Drive.
• No other third-party application can access the files placed in Sonaro's Application Data folder.

5.4 Storage, Security & Token Protection

• Pre-Transmission Encryption: Backups are encrypted locally prior to upload using industry-standard AES encryption.
• Encrypted In-Transit: All communication with Google APIs occurs over secure, TLS 1.3 / SSL encrypted connections.
• Keystore Token Security: Google OAuth tokens (access tokens and refresh tokens) are securely stored only on your local device inside the Android Keystore / iOS Keychain. Tokens are never transmitted to VRSONI Soft servers or any third-party infrastructure.

5.5 Prohibition of Data Sale, Advertising, and AI Training

• No Data Sale: We will never sell, lease, or monetize data obtained from Google APIs to any third party, broker, or advertiser.
• No Targeted Advertising: Information received via Google APIs is never used for serving advertisements, behavioral retargeting, or consumer profiling.
• No AI Model Training: Information accessed through Google APIs is never used to train or refine artificial intelligence models, machine learning systems, or neural networks.
• No Human Access: No employee, engineer, or contractor of VRSONI Soft has access to your Google Drive backup files or database contents. Human access is only permitted if explicitly requested by you for technical support troubleshooting, with your prior affirmative written consent.

5.6 Google Limited Use Disclosure

6. Data Retention, Control & Account Deletion

You maintain ultimate control over your information at all times:

• Disconnect Google Account: You can disconnect Sonaro from your Google Account at any time directly in the app settings, or remotely by visiting your Google Account Security Permissions.
• Delete Cloud Backups: You can delete backup archives from within Sonaro or via Google Drive settings under "Manage Apps".
• Local Data Deletion: You can clear your local database at any time by selecting "Reset Data" in app settings or uninstalling the app.
• Account & Cloud Deletion Request: You can submit a deletion request through our public deletion portal at https://sonaro.in/delete-account.html or by emailing our support team at support@sonaro.in. All server-side data will be permanently purged within 30 days.

7. Information Sharing and Disclosure

We do not share your information with third parties except under the following strict circumstances:

• Essential Infrastructure Providers: High-security cloud hosts (such as Amazon Web Services EC2 for hosting our landing page) and SMS/communication gateways used strictly to send transactional messages or OTPs requested by you.
• Legal Compliance: When strictly required by law, subpoena, or government authority pursuant to applicable Indian laws or international jurisdiction.

8. Data Security Architecture

We apply enterprise-grade security practices to safeguard your information:

• End-to-end transport layer security (TLS 1.3 / HTTPS encryption).
• AES-256 local database encryption on client devices.
• Strict role-based access management and operator PIN authorization within the software.

9. Children's Privacy

Sonaro is a commercial software platform built exclusively for businesses, jewellery store proprietors, and retail operators. We do not knowingly solicit or collect data from anyone under the age of 18.

10. Updates to This Policy

We may periodically update this Privacy Policy to reflect software feature enhancements or statutory compliance updates. When changes are made, the "Last Updated" date at the top of this document will be updated. Continued use of the software after updates constitutes acceptance of the revised policy.

11. Contact Us & Grievance Redressal

If you have questions, feedback, or grievance inquiries concerning this Privacy Policy, please reach out to our data compliance team: