Privacy Policy for HisabBot
Welcome to HisabBot (হিসাববট), an offline-first, conversational digital ledger application developed by KothaBot ("we", "us", or "our"). HisabBot is designed to assist shopkeepers, retail store owners, and individuals in Bangladesh with recording customer dues (বাকি), payments (জমা), and cash sales (নগদ) naturally through Bangla voice input or manual entry.
We respect your privacy and are committed to protecting the financial and personal information of you and your customers. This Privacy Policy details the types of information we collect, how it is used, how it is stored, and your rights concerning your data in full compliance with the Google Play Developer Program Policies.
1. Information We Collect
A. Voice and Audio Data
When you use the voice input feature by tapping the microphone icon, HisabBot requests microphone access (RECORD_AUDIO). The app captures your spoken audio solely for the duration of the speech prompt to transcribe Bangla speech into structured transaction text (e.g., customer name, amount, and entry type).
- Audio recording is strictly user-initiated. We never record in the background or when the microphone button is not active.
- Audio files are processed ephemerally in real-time. We do not sell, rent, or monetize your voice recordings, nor do we use your audio for commercial ad profiling.
B. Financial and Ledger Information
To maintain your shop ledger, you may enter customer details including:
- Customer names and optional telephone numbers.
- Transaction types: Credit (বাকি), Payment (জমা), and Cash (নগদ).
- Transaction amounts, dates, and optional product notes.
All financial ledger records are stored locally on your device in an encrypted local database (SQLite/Room). Your customer ledger records remain exclusively on your device and are not uploaded to public databases or shared with unauthorized third parties.
C. Biometric and PIN Security Data
If you choose to enable the app lock, you may set a 4-digit PIN or authenticate via your device's fingerprint/face biometric sensor.
- PIN Lock: PIN codes are hashed using cryptographic PBKDF2/SHA-256 with random salt before being stored locally on your device. We cannot view or recover your raw PIN.
- Biometrics: Handled entirely through the Android OS
BiometricPromptAPI. Biometric credentials never leave your device's secure hardware element (TEE/Secure Enclave) and are never accessible to our application.
D. Telemetry and Analytics
We do not embed third-party advertising tracking libraries or invasive telemetry frameworks. We collect zero personally identifiable information (PII) about your store customers for analytics.
2. How We Use Your Information
We use the collected information strictly for:
- Interpreting spoken Bangla transactions into structured ledger entries.
- Calculating customer balances, totals due, and payment timelines.
- Facilitating user-directed payment reminders via Android dialer, SMS, or WhatsApp.
- Securing your application against unauthorized physical access via PIN and biometrics.
3. Third-Party Services and Data Sharing
To provide high-accuracy natural Bangla voice intelligence, spoken audio may be processed securely through AI speech-to-text models (such as official Google Gemini API endpoints). This data transmission occurs over encrypted HTTPS/TLS connections solely for immediate inference.
We never sell, lease, or exchange user or store customer data with brokers, advertisers, or third-party marketing firms.
4. Android Permissions and Why We Need Them
- Microphone (
android.permission.RECORD_AUDIO): Required exclusively when you tap the mic button to speak transaction entries. Denying this permission allows you to continue using the manual text ledger offline. - Internet Access (
android.permission.INTERNET): Required solely to transmit speech queries to the AI parser endpoint and fetch model responses. Manual ledger writing does not require internet connectivity. - Biometric (
android.permission.USE_BIOMETRIC): Optional; used only if you choose to lock the app with your device's fingerprint or face unlock.
We do not request
READ_CONTACTS, READ_SMS, SEND_SMS, READ_CALL_LOG, or fine-grain GPS ACCESS_FINE_LOCATION. All phone calls or WhatsApp messages are initiated strictly through standard Android user-directed intent handoffs.
5. Data Retention and Deletion (User Control)
Because your financial ledger is stored locally on your device, you have complete sovereignty over your data:
- Deleting Transactions: You can edit, void, or delete individual transactions at any time within the customer profile.
- Deleting Customers: You can delete a customer and their full ledger history directly from the customer management screen.
- Full Data Erasure: Clearing app storage from Android Settings → Apps → HisabBot → Storage → Clear Data or uninstalling the app permanently purges all local databases from your phone.
- Deletion Assistance: If you have any inquiries regarding data deletion, email us at support@kothabot.ai.
6. Children's Privacy
HisabBot is designed for shopkeepers, business merchants, and adults managing financial ledgers. We do not knowingly collect personal information from children under the age of 13 (or under 16 in applicable jurisdictions). If we become aware that a child has provided us with personal data, we will immediately take steps to remove such information.
7. Security Measures
We employ robust technical safeguards including cryptographic hashing for PIN security, on-device local database storage, and HTTPS/TLS 1.3 encryption for any network transmission.
8. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect operational or regulatory changes. Updated versions will be posted at https://hisab.kothabot.ai.bd/privacy.html with a revised "Last Updated" date.
9. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: