Privacy policy

DRAFT — needs legal review. Written against the Digital Personal Data Protection Act 2023, but not yet reviewed by a lawyer qualified in Indian law.

This policy explains what Top Billing does with personal data. Top Billing is the data fiduciary — the entity that decides why and how your data is handled.

What we collect, and why

When you bid

• Email address. To send your invoice, confirm your bid, and give you a link back to manage your placement. Without it we cannot issue an invoice for your purchase.
• Brand and billing details — the trading name and contact details that appear on your invoice.
• Phone number, only if you choose to give one for alerts.

When you pay

Payments are handled by Razorpay. We never see or store your card details. They are entered directly into Razorpay’s systems. We receive only an identifier for the payment, its amount and its status.

When someone visits the board

• Clicks on a placement. We record that a click happened, which placement it was, and a one-way hash of the IP address — never the address itself. The hash lets us detect automated clicks so advertisers are not billed for fake traffic; it cannot be turned back into an IP.
• Impressions, counted in aggregate per day. No identifier is attached.

We do not use advertising cookies, we do not track you across other websites, and we do not build profiles of visitors.

Why we are allowed to hold it

Almost everything here is processed because it is necessary to perform the contract between us — you cannot be sold an advertising placement, or invoiced for it, without it. Where that is not the basis (for example, optional WhatsApp alerts), we ask for your consent and you can withdraw it at any time.

Who else processes it

We use a small number of processors, each for a single purpose. They act on our instructions and may not use your data for their own ends.

• Supabase — database and authentication. Hosted in Mumbai, India.
• Google Cloud — application hosting. Mumbai, India.
• Razorpay — payment processing. India.
• Resend — transactional email. Your email address and the contents of the message are processed outside India.

We do not sell personal data, and we never have.

How long we keep it

• Invoices and payment records — retained for as long as tax and accounting law requires. We cannot delete these on request, because we are required to hold them.
• Bids and placements — retained while the account is active, as they form the public auction record.
• Click and impression data — retained in aggregate. The hashed identifiers are discarded after 90 days.

Your rights

Under the DPDP Act 2023 you may:

• Ask what we hold about you and how it is processed.
• Have it corrected if it is wrong, incomplete or out of date.
• Have it erased, except where we must keep it for legal or tax reasons.
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
• Complain to us, and then to the Data Protection Board of India if we do not resolve it.

Grievance officer

If you want to exercise a right or raise a concern, contact our grievance officer directly:

Top Billing
hello@topbilling.in
Top Billing

We will acknowledge within two working days and aim to resolve within 30 days. If you are not satisfied, you may escalate to the Data Protection Board of India.

Security

Traffic is encrypted in transit. Payment credentials never reach our systems. Access to production data is restricted to the people who need it, and administrative actions are recorded in an audit log.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board as the Act requires.

Children

This is a service for businesses. It is not directed at children and we do not knowingly collect data from anyone under 18.

Changes

If we change this policy materially we will say so on this page and update the date above. The date at the top tells you which version is current.