Lekha

Privacy Policy

Effective date: June 9, 2026 · Data fiduciary: Ekarche Private Limited, India.

What We Collect

We collect account identity data, tenant configuration, and records you enter into Lekha, including receivables, payables, stock, salaries, and attached document metadata.

Lawful Basis and Purpose

We process personal data on the basis of your consent and to perform our agreement with you, limited to the purposes described in this policy: operating the ledger and capture workflows, authentication and access control, support, and meeting legal obligations. We do not use your data for unrelated purposes.

How We Use Data

  • To authenticate users and enforce tenant access.
  • To operate ledger and document-capture workflows.
  • To provide support, auditability, and service reliability.

Document Processing

Document extraction is used to prefill draft records. You remain in control of confirmation before records are committed.

Data Sharing and Sub-Processors

We do not sell your data. To provide the service we share specific data with processors bound by data-processing agreements:

  • Hosting and infrastructure providers, strictly for hosting, security, and core platform operations.
  • Docusift (operated by Ekarche) receives the supplier and import documents you upload, solely to extract their fields. These documents may contain counterparty names, GSTINs, and amounts.
  • When e-invoicing is enabled for your tenant, an authorised GST Suvidha Provider / Application Service Provider receives the invoice data required to register an IRN with the Invoice Registration Portal.

Retention and Deletion

We retain personal data per the schedule below. Statutory holds on financial records always take precedence over deletion requests; the record is deleted once the hold lapses.

  • Account profile (name, email, role, password hash, MFA secret) — retained for the life of the account; deleted within 30 days of account closure. Lawful basis: contract.
  • Authentication + session (refresh tokens, login timestamps, IP for active sessions) — rolling 90 days from last sign-in. Lawful basis: legitimate interest in account security.
  • Bills, invoices, payments, supplier & buyer records, and the source documents — 7 years from the close of the financial year (Indian Companies Act + GST record-keeping rules). Lawful basis: legal obligation.
  • Other uploaded documents not tied to a financial entry — retained for 7 years by default and configurable per tenant; deleted on a scheduled purge once retention lapses. Lawful basis: contract.
  • Audit log (who-changed-what on every entity) — lifetime of the tenant; purged on tenant deletion. Lawful basis: legal obligation + legitimate interest in accountability.
  • Support tickets + email correspondence — 24 months from last update, then anonymised. Lawful basis: legitimate interest.
  • Consent records — lifetime of the consent + 5 years post-withdrawal. Lawful basis: legal obligation.

You may request account closure and data lifecycle actions through the contact below.

Your Rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may access, correct, and complete your personal data, request its erasure, nominate another individual to exercise your rights, and seek grievance redressal. To exercise any of these, contact us using the details below.

Cross-Border Transfer

Where data is processed outside India by a sub-processor, we do so only as permitted by applicable law and under appropriate contractual safeguards.

Cookies and Similar Technologies

Lekha uses a small set of strictly-necessary storage mechanisms to keep you signed in and to remember your in-app preferences. We do not run third-party advertising or cross-site tracking cookies, and we do not run third-party analytics on Lekha today. See cookie policy for the full list of categories and storage keys.

For Business Customers (DPA)

Where Lekha processes personal data on a customer’s behalf (for example, customer’s buyer / supplier contacts in their ledger), Lekha acts as a data processor and the customer is the data fiduciary. A Data Processing Addendum is available on request to lekha@ekarche.com and the authoritative sub-processor list is published at /subprocessors.

Security and Breach Notification

We apply role-based access controls, per-tenant isolation, and operational safeguards to protect your information. In the event of a personal-data breach, we will notify the affected workspace admin without undue delay and, where feasible, within 72 hours of becoming aware. Where required by law (Data Protection Board of India under DPDP-2023; the relevant EU/UK supervisory authority for affected EU/UK data subjects), we will notify the regulator as well.

Grievance Officer

For privacy questions, rights requests, or grievances, contact the Grievance Officer, Ekarche Private Limited, at lekha@ekarche.com or +91 91930 51759. We respond within the timelines required by applicable law.