The fine print, in plain English.
Every legal document we publish, with a one-paragraph summary up top — so you know what you're signing before you scroll the formal version.
Every legal page in one place.
The agreement between you and Ketpy Book when you use the platform.
What data we collect, why, how long, and your rights.
How we comply with the Digital Personal Data Protection Act 2023.
When, how, and how much you can get refunded.
How to cancel, and what happens after.
What cookies we set and why.
All documents last updated 08 May 2026. We notify customers in-app + by email at least 14 days before any material change.
How we protect your data & books.
India-hosted
AWS Mumbai region (ap-south-1). Your data never leaves India unless we explicitly tell you (e.g. for an integration partner you opt into).
Encrypted everywhere
TLS 1.3 in transit, AES-256 at rest, encrypted backups. Database snapshots taken every 24 hours, retained 30 days.
Tenant isolation
Multi-tenant by design — every query is scoped to your tenant's ID. Audited monthly to prevent cross-tenant leaks.
OTP + 2FA
6-digit email OTP on signup. Optional TOTP 2FA on Pro. Suspicious login alerts to your registered email.
Export anytime
One-click export of your full books to Excel + JSON, anytime. No held data, no held hostage.
Audit logs
Every change in your tenant — who, when, what. Pro tier retains 24 months; Lite retains 90 days.
Breach disclosure
If a security incident affects your data, we will notify you within 72 hours per DPDP Act 2023.
GDPR-aware
Even though our customers are India-only, we follow GDPR-grade engineering practice for data subjects.
SOC 2 Type II
Audit underway. Target completion Q4 2026. Penetration test report available under NDA today.
Where we stand today.
One inbox handles it all.
For DPDP / privacy-related requests, security disclosures, grievance redressal, or any legal question — one email handles all of it. Replies usually come within 1 working day; DPDP requests honoured within the statutory 30 days.
Mention "DPDP", "Security", or "Grievance" in the subject so we route it to the right specialist on day one.
The kind of thing you'd normally need to email a lawyer to ask.
Where is my data stored? +
Who owns the data in my tenant? +
Can I get a Data Processing Agreement (DPA)? +
How long do you keep my data after I cancel? +
Do you share data with the GST department? +
What law governs disputes? +
Are you SOC 2 / ISO 27001 certified? +
How do I report a security vulnerability? +
Questions we haven't covered?
Write to team@ketpy.com or use the contact form — usually a same-day reply during IST hours.