Legal / Privacy Policy
Privacy Policy
What personal data we process, why, where it goes, how long we keep it, and your rights.
Version 1.3 · last updated 2 October 2026
VD Enterprises (No. 102, Kudiyana Theru, Melapoovanur, Needamangalam, Kalacheri, Tiruvarur District, Tamil Nadu 612803, India) is the data fiduciary for the personal data described here. This notice is given under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 with the rules made under them. If you are in the EEA or the United Kingdom, section 10 adds what those laws require.
It covers topbilling.in, app.topbilling.in and api.topbilling.in. It does not cover what you do with the Output you generate, or the websites of the providers named below.
1. What we collect
| Category | What it is | Where it comes from |
|---|---|---|
| Account data | Name, email address, and an authentication record held by our authentication provider. We never see or store your password. | You, at sign-up |
| Billing profile | Billing name, address, and GSTIN if you choose to give one. | You, when you buy credits |
| Payment records | Order amount, status, payment reference and method type. Card numbers, UPI credentials and bank details are entered on the payment gateway and never reach our servers. | Our payment gateway |
| Usage metadata | Per request: timestamp, request id, project, API key id, model, token counts, latency, status, pricing version, amount charged. | The gateway |
| Technical data | IP address, user agent, and request logs used for security, rate limiting and abuse prevention. | Your client |
| Mobile number | Your number in international format, and when it was verified. We keep it to stop one person opening many accounts, to reach you about a security or payment problem, and because the referral programme is only fair if accounts are distinct. It is never used for marketing. | You, if you verify a number |
| Referral records | Which code an account signed up with, and whether a reward was paid. A referrer is never shown the email address of the person they referred. | You, at sign-up |
| Support correspondence | What you write to us and what we reply. | You |
What we do not keep
We do not store the text of your prompts or of the model output. Request content is held in memory only for as long as it takes to forward it to the model provider and stream the answer back to you. It is not written to our database and not written to our logs. Where a failure has to be investigated, the diagnostic record keeps the request id, the error and the token counts — never the content.
We do not use your content to train, fine-tune or evaluate any model. We do not sell personal data, and we run no advertising, profiling or cross-site tracking.
2. Why we process it, and on what basis
| Purpose | Basis under the DPDP Act | Basis under the GDPR, where it applies |
|---|---|---|
| Creating your account and providing the Service | Consent given at sign-up for the specified purpose | Performance of a contract |
| Metering and charging, invoices, refunds | Consent, and compliance with a legal obligation for tax records | Contract, and legal obligation |
| Security, fraud prevention, rate limiting, abuse investigation | Legitimate use: prevention and investigation of fraud, and information security | Legitimate interests |
| Transactional email: low balance, receipts, incident and policy notices | Consent, and performance of the Service | Contract |
| Verifying your mobile number, and keeping accounts distinct | Legitimate use: prevention and investigation of fraud | Legitimate interests |
| Running the referral programme and paying rewards | Consent, and performance of the Service | Contract |
| Product or marketing email | Separate consent, which you may withdraw at any time | Consent |
| Responding to a lawful demand from a court or an authority | Compliance with law | Legal obligation |
You may withdraw consent at any time by writing to support@topbilling.in or by deleting your account. Withdrawal does not affect processing already carried out, and where we must keep a record for tax or fraud reasons we will tell you which record and why.
3. Children
The Service is for people aged 18 and over. We do not knowingly collect the personal data of a child, and we carry out no tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has created an account, write to grievance@topbilling.in and we will delete it.
4. Who else processes it
We use a small number of processors, each for a stated purpose and under contract. The current list is published at Sub-processors, with the entity and processing location of each named processor; AI model providers are described there by category, not by name, for commercial confidentiality. We give at least 30 days of notice before adding a named processor that affects you.
The core of the Service is hosted in India: the application and the gateway run in the Mumbai region of Google Cloud, and the database and authentication run in the Mumbai region of our managed-Postgres provider. The exceptions are our transactional email provider, which processes the recipient address and the message in the United States, the SMS sender that delivers a verification code to your mobile number, and the AI model providers, which process the content of your request wherever they operate.
We disclose personal data outside that list only where the law compels it, and we tell you first where we are legally permitted to.
5. Transfers outside India
Where a processor is outside India — our email provider, and the AI model providers — the transfer happens under contractual terms that oblige them to protect the data and to use it only for the purpose we set. If the Central Government notifies a country to which transfers are restricted, we will stop transferring there. We do not transfer your account or billing data outside India.
6. How long we keep it
| Data | Retention | Why |
|---|---|---|
| Financial records: credit transactions, the usage ledger, invoices | 8 years from the end of the financial year | Required by Indian tax and accounting law; these tables are append-only by design |
| Usage metadata | 13 months | Lets you reconcile a full year of billing, then it goes |
| Security and access logs | 90 days | Long enough to investigate an incident |
| Account and billing profile | While your account is open | To provide the Service |
| Support correspondence | 24 months | Continuity of support, and a record of disputes |
| Request and response content | Not retained | Held in memory for the duration of the request only |
When you delete your account, personal data that is not inside a record we must keep for the reasons above is erased within 30 days. Financial records remain because the law requires them; they are not used for anything else.
7. How we protect it
- TLS on every connection, HTTP Strict Transport Security, and no mixed content.
- API keys are stored only as peppered hashes. A key is displayed once and cannot be recovered.
- Provider and payment credentials live in a managed secret store with per-service access, and are never written to the database or to logs.
- Least-privilege service accounts, an optional network allowlist on the administrative console, and multi-factor authentication with step-up re-authentication for administrative actions.
- Money moves only inside the database, under row locks and append-only rules, with an audit log that cannot be edited.
- Managed database backups, and restricted, logged access for the small number of people who operate the Service.
No system is perfectly secure. We hold no security certification today; if that changes we will say so here rather than imply it.
8. If there is a breach
If a personal data breach occurs we will report it to the Data Protection Board of India and tell every affected person, without undue delay and in the form the law requires, describing what happened, what data was involved, what we are doing about it, and what you can do. We keep a record of every breach and of the decisions taken.
9. Your rights
- Access — a summary of the personal data we process about you and who we have shared it with. Most of it is already visible in the dashboard, and usage is exportable.
- Correction and completion — fix anything inaccurate or incomplete, in Settings or by writing to us.
- Erasure — delete your account, and with it the data we are not required to keep.
- Withdraw consent — for any processing that rests on consent.
- Nominate — name a person to exercise your rights if you die or become unable to exercise them yourself. Write to support@topbilling.in to register a nomination.
- Grievance redressal — complain to our Grievance Officer before approaching the Board.
Write to support@topbilling.in from the address on your account, or use the dashboard. We answer within 30 days. We do not charge for this, and we will not refuse a request without telling you the reason.
10. If you are in the EEA or the United Kingdom
Where the GDPR or the UK GDPR applies, the lawful bases are those in the table in section 2, and you also have the right to object to processing based on legitimate interests, to ask us to restrict processing, to receive your data in a portable form, and to complain to your supervisory authority. We take no decision about you by solely automated means that has legal effect. We have not appointed an Article 27 representative in the Union or the United Kingdom; we are a small Indian business serving Indian developers, and if that changes we will appoint one and name it here.
11. Grievance Officer
Vasudev (Proprietor) — grievance@topbilling.in. Postal address: VD Enterprises, No. 102, Kudiyana Theru, Melapoovanur, Needamangalam, Kalacheri, Tiruvarur District, Tamil Nadu 612803, India. We acknowledge every grievance within 24 hours and aim to resolve it within 15 days. If you are not satisfied you may approach the Data Protection Board of India. The full route is in the Grievance Redressal Policy.
12. Cookies
We set only what is needed to keep you signed in and to keep the site secure. There are no advertising or analytics cookies. See the Cookie Policy.
13. Changes to this notice
We post a new version here with a new date, and for a change that materially affects how we use your data we email account holders at least 15 days before it takes effect.
Other documents
- Terms of Service — The agreement between you and VD Enterprises for using Top Billing.
- Acceptable Use Policy — What you may not do with the Service, and what happens if you do.
- Cookie Policy — The only cookies we set are the ones that keep you signed in.
- Data Processing Addendum — The processor terms that apply when you route personal data you are responsible for through the Service.
- Sub-processors — Every third party that processes data on our behalf, what for, and where.
- Credits, Refunds and Cancellation Policy — How prepaid credits work, what is charged, and when money comes back.
- Service Delivery Policy — Nothing is shipped. What you buy is available within minutes, and usually at once.
- Referral Programme Terms — Invite someone, and when they top up you get credits. The exact rules.
- Service Level and Support Policy — What we aim for on availability and response, stated as targets rather than promises.
- Grievance Redressal Policy — How to complain, what we must do about it, and where to go if we fail you.
- Responsible Disclosure Policy — Report a vulnerability in good faith and we will not come after you.
- About and business details — The registered identity behind Top Billing, as the e-commerce disclosure rules expect.
- Contact — How to reach us, and what to include so the first reply is a useful one.