Privacy Policy

XoraPro is built and run by M/s N.P. Xora Private Limited, a company registered in Nepal.

• Company Registration Number: 387740/82/83
• PAN: 623570591
• Registered address: Ward No. 3, Samakhusi, Kathmandu Metropolitan City, Nepal
• Email: support@xorapro.com
• Phone: 976-8591889

This policy covers the XoraPro mobile app, the website at xorapro.com, and every screen you reach after signing in.

This is the most important section. Read it first.

XoraPro holds two different kinds of information, and our duty is different for each.

The first is information about you and your business, because you are our customer. You gave it to us when you opened your account and while you paid for the service. We decide how that information is used, so the responsibility for it is ours.

The second is everything your business types into XoraPro about other people. Your customers, your staff, your suppliers. Their names, their phone numbers, what they owe you, what you pay them. That information belongs to your business, not to us. You decide what goes in, who in your team can see it, and when it comes out. We hold it and process it only on your instruction.

Your customer is not our user. We do not contact the people in your khata for our own purposes. We do not sell their details. We do not use one business's records to serve another business.

In legal language, we are the controller of the first kind and the processor of the second kind. In plain language: your books are your books.

Our full promises on how we handle the second kind for your business are here: Data processing terms

If you are a customer, a staff member or a supplier of a business that uses XoraPro, section 13 is written for you.

If you buy on XoraPro Market, section 13A is written for you.

When you open and run a XoraPro account, we hold:

• Your name, mobile number and email address.
• Your business name, PAN or VAT number, address and business type.
• The passkey, sign-in code or password you use to get in, which devices you marked as trusted and for how long, and how each sign-in's second step was proved (authenticator app, passkey, recovery code or security questions).
• Your role in the business and which screens your role can open.
• Sign-in records: date, time, device and IP address. We keep these so you can see who opened your books and when.
• If the owner turns on the list of allowed internet addresses: those addresses and their labels, who added or removed each and when, and a hash of the recovery code (never the code itself).
• What you pay us, when the subscription renews, and which plan you are on.
• Your agreement to the Terms of Service: which version you agreed to, which version of this Privacy Policy was in force then, when, from which IP address and browser, and at which step (opening a business, accepting an invitation or after signing in). We keep this to show who agreed to which terms.
• Messages you send us for support.

We also use account and sign-up information for two purposes of our own:

• Security, fraud and copying checks. We check new sign-ups for security, fraud and copying of XoraPro. Each day, named XoraPro staff receive a summary of new accounts and businesses: name, email, the internet address and whether it belongs to Nepal or elsewhere (worked out on our own server from the public register of addresses, not by an outside service), the device and browser, and a new business's PAN, type of business and the features it has switched on or off. They are also told the same day when something looks wrong, such as many new accounts from one internet address, a business still without a PAN seven days after joining, many trade or feature changes on one business in one day, or a business's whole books being exported at once. Such an alert names the business, its owner's email and, where it applies, who did it and from which internet address, but not what is inside the books.
• Helping new sign-ups get started. We may call, message or email new sign-ups to help them get started. If sign-up did not ask for a phone number, our team may find the business's number from another source, such as its signboard, a directory or its own website, and keeps short notes of those calls.

We do not use your information for advertising, and we do not sell it.

XoraPro contacts some people for its own purposes: guests at events XoraPro hosts, people who ask us about XoraPro, and account holders about our own service. We use the details they gave us only for the purpose they agreed to. Anyone can stop these messages at any time by writing to support@xorapro.com or replying STOP.

If you make a complaint about XoraPro with the form on the Business information page, we keep your name, the phone number or email you give, what the complaint is about and what you write, with a one-way code made from your internet address (never the address itself) to stop misuse of the form. We use them only to register, investigate and answer your complaint, as the Electronic Commerce Act 2081 s.33 requires, and keep them for at least six years, so that we can show how each was handled (the law requires at least five: Electronic Commerce Directive 2082 cl.14).

If you book a demo on one of our trade pages (hotels or schools, for example), we keep your name, your business's name and trade, your mobile number, the email you give, the day and time you would like a call, your note and the language you chose, with a one-way code made from your internet address (never the address itself) to stop misuse of the form. The XoraPro team uses them only to contact you about the demo you asked for, and notes whether we have called. We keep them for 12 months, and then they are deleted.

When guests are being checked in at an event run on XoraPro, whether XoraPro or a business is the host, our server compares the email addresses on that event's guest list with the accounts opened the same day, so that a room full of new accounts is not mistaken for misuse. This check shows no guest's details to our staff, and we do not use the guest list for anything else.

We never contact the customers, staff or guests of a business that uses XoraPro for our own purposes (section 2).

The Individual Privacy Act 2075 lets personal data be collected only with consent, and used only for the purpose it was collected for (see section 18). For readers who know the terms used in international law such as the GDPR, this table names the basis we rely on for each purpose this policy describes.

How to withdraw consent, or object to a use, is in section 18A.

This is your business's data. We list it here so you can see what sits on our servers under your account. Which items apply depends on the features your business turns on.

• Accounting and invoicing. IRD-format invoices, VAT figures, TDS deductions, journal entries, and credit and debit notes.
• Bills by email. When a business opens its address for supplier bills: the email addresses or domains the owner allows to send bills, and who added or removed each one and when; for every email that reaches the address, the sender's address, the subject, the date and whether it was accepted; and from accepted emails, the attached PDFs or photos, which carry the supplier's name, PAN, bill number and amounts, the draft read from each, and who reviewed it. Files from an email that came from an allowed address, but whose sender could not be confirmed, are kept unread until the owner approves them or sets them aside. Files from other emails that were not accepted are not kept. A file that became a bill stays with that bill; a file set aside is archived, not deleted.
• Customs entries. For each customs declaration and challan an importing business records: the pragyapan number, date, customs office, the name of the foreign supplier or clearing agent, the goods and their HS codes, the duties and taxes paid, the challan number and the bank reference; photos of the declaration and the challan, which carry the importer's and the supplier's names, PAN and amounts; the draft read from those photos; and who saved, posted or undid each entry and when. The photos stay with the entry; a posted entry's photos are not removed, and a draft is put away, not deleted.
• Parties. Names, phone numbers, email addresses, addresses and PAN or VAT numbers of the customers and suppliers you trade with, with credit terms and notes. When a buyer's name, PAN or VAT number, address or mobile is put on a till bill, they are kept with that bill, printed on it and sent to the IRD with it.
• Cooperative member loans. For each member loan: the member (a customer of the cooperative), the amount, rate and instalment schedule, and every repayment with the day the member paid, the day it was entered and who entered it; the days past due, whether the loan is In Arrears and each change of that state with the figures of the day; the penalty charged for each late day with the base and rate used, the old figures kept when a later repayment replaces them; and each request to waive penalty, with its reason, who asked, who decided and, if refused, why. These records are archived, never deleted.
• Loyalty card members. The mobile number, name (if given) and card number of a customer who joins a shop's loyalty card, and the history of points earned and spent on each bill. They are used only to count the points and show them on the bill and its e-receipt; no SMS is sent. A card can be archived, but its points history stays with the books.
• Khata. What each party owes you, what you owe them, and every entry that made up the balance.
• Customer portal. The notes a customer writes from the khata link you send them (which bill, quotation or statement each is on, when, and the internet address it came from), when you read them, when the customer accepted or declined a quotation, and which bills a Fonepay payment made from the link paid and how much each. When a link asks for a phone code: the last four digits of the number the code went to, the internet address it was asked from, and only hashes of the code, the number and the session it opened; the code itself is never kept. Notes and payment records stay with the history and are not deleted.
• Quote links. When you send a client a link to a quotation: when the link was first and last opened and how many times (not counting your own team or link previews); and when the client accepts or declines on the link, the name they type, their reason for declining (if they give one), the time and their internet address, which are kept with the quotation and in the audit log as evidence of the answer. The internet address of an answer given on the customer portal is also kept with the quotation. These stay with the quotation's history and are not deleted.
• Staff records. Contact details, address, role, joining date, date of birth, gender, marital status, emergency contacts, citizenship number, PAN, SSF number, bank account for salary, a photo, copies of identity and work documents (such as citizenship certificate, passport, work permit and contract), driving licences with front and back photos, attendance, leave, and notes.
• Payroll. Salary, allowances, a stylist's commission percent, insurance premiums, retirement contributions, tax deductions, advances (peshki) and repayments, and payslips. Payslips can be emailed to the staff member (section 7, Resend).
• Worksite clock-in and the location record. The time of each clock-in and clock-out, the phone's position at that moment and its distance from the worksite, the location record while signed on, and vehicle trips with their route. At a shared kiosk device, whether the staff PIN matched. Whether each clock-in and each position came from the XoraPro app or a web browser, and the app's version. Section 5 explains this in full.
• Construction site diary. For each day, how many people of each trade worked on site and for how many hours (which can be filled from the job titles of staff signed on at the worksite), the names, organisations and arrival times of visitors and inspectors, site photos with the phone's position, the time each was taken, the time it reached our server and who uploaded it, and the name and time of whoever submitted the diary or later added a note to it. A submitted diary is locked as evidence and is not deleted; a correction is added as a note. At submit, only the worksite's position (never a person's) is sent to Open-Meteo to look up the day's weather.
• Signing in on a restaurant or hotel floor. When the business counts floor sign-in as clocking in: the time of each sign-in at the staff door and each End my shift, the phone's position at that moment and its distance from the worksite where the worksite asks for location, whether the person was on that day's rota, and the time of their last action on the floor, which is offered to the manager as the clock-out time when a shift is left open.
• The hotel's housekeeping list. Which rooms each housekeeper is given for the day, the times they press Start cleaning and Done, and the remarks they pick (such as Towels short or Do not disturb). These stay in the room's log after the room is clean. While a clean is under way, the housekeeper's name and start time show on the front desk and housekeeping boards.
• Attendance machines and imported punches. When a business connects its own fingerprint or face attendance machine to XoraPro, or imports a file of punches: the time of each punch, the user number the person is enrolled under on the machine, the machine's serial number and the codes it sends for the kind of punch (in, out or break) and how the person was identified (finger, face, card or password), and the staff member's usual outlet or worksite. Fingerprint and face templates stay on the machine; XoraPro never asks for, receives or keeps them, and drops them unread if a machine sends them anyway.
• Deployments at a manpower company. When a manpower, security or cleaning company places its workers at client sites: which worker stood on which post of which client contract (the site, the role and the day or night shift), from which day to which day, the short reason written when a deployment ended, and who made the deployment and when. No personal ID number is kept with it.
• Vehicles. Vehicles, the driver and purpose of each trip, destination, times out and back, odometer readings and dashboard photos, and position at departure and return.
• Transporters' bilty. On each bilty a transporter books: the consignor's and the consignee's names, phone numbers, PAN and addresses, the goods with their packages and weight, the vehicle's number, and the driver's name and phone; at delivery, the name of the person who took the goods; and when the freight is collected, the amount, the day and whether it came in cash or by Fonepay. Each change of status is kept with who made it and when. A cancelled bilty is archived with its reason, never deleted. The bilty's link, which the business sends itself from WhatsApp, opens that one bilty only, to whoever has the link; XoraPro sends nothing itself.
• Inventory and point of sale. Products, batches, stock counts, sales, discounts and refunds, and the customer on a sale where one is recorded.
• Gift cards and wallets. The name printed on a card where one is given, a customer's wallet and its balance, and every top-up, spend, store credit and expiry behind it. A card's code is never put in a link, a log or the audit record.
• Orders and deliveries. The customer's name, phone, email (the one typed on a website order, or else the one the buyer signed in with) and delivery address, any voice note, the age confirmed for age-restricted goods, pack, handover and proof-of-delivery photos, the name of whoever collected the order, and for a phone order a restaurant takes, the customer's name, phone, delivery address and the time they want it ready. On a phone or website order, only staff who take payment and hand the order over see the customer's name, phone and address; other floor staff see how the order came in and its counter number, and the kitchen ticket prints none of these details. When staff tell a customer their order's stage from the business's own WhatsApp or Viber, which order and stage, on which app, in which language, when and by whom, with the message and the number it went to, are kept in the business's message delivery log. XoraPro does not send these messages itself: the chat opens on the staff member's own device.
• Age checks. For drinks and tobacco sold only to people 18 and over: how staff checked a guest's or a buyer's age (seen an ID, clearly over 25, or asked), who checked and when, and the tab, sale or order it belongs to. No ID number, date of birth or picture of an ID is kept.
• Kitchen food-safety log. For a restaurant that keeps its food-safety checks in XoraPro: each check logged on the kitchen screen (the reading, whether it was within its limit, what was done about one that was not, and any note), the name of the staff member who logged it and when, and a photo when the check asks for one. A food handler's health certificate: which staff member it belongs to, the dates it was issued and is valid until, and a photo of it. The certificate photo can be opened only by the business's owner and the staff member it belongs to; the month's log printed for an inspector shows only each holder's name and the date their certificate is valid until. A logged check is never changed: a correction is a new entry. A photo taken but never attached to a check or a certificate is deleted after a day.
• Hotels. Guest name, phone, nationality, address, identity document type and number, date of birth, gender, stay dates, rate and deposit, and for foreign guests passport country and expiry, visa type, number and expiry, date and point of entry into Nepal, purpose of visit, the country they have come from and next destination. Nationality, passport country and the country a guest has come from are also kept as international country codes (ISO 3166-1). The extras a guest takes (such as breakfast or a pickup), their day and time, and for a pickup the guest's note, such as a flight number or where to meet. For bills put on the room: the guest's room charge PIN (kept encrypted), their room charge limit, and, where a waiter takes one, the guest's finger signature for that bill. When a guest signs the registration card on the desk's screen, the signature is kept as an image with the date and time it was drawn. Where a hotel switches it on, foreign guest details are sent to the Department of Immigration through FNMIS. For the hotel's own FNMIS registration: its NepaliPort login email, its R code (kept encrypted) and the screenshot of its approved NepaliPort dashboard it uploads for XoraPro to check; never its NepaliPort password. While a guest is checked in, a guest link and a 4-digit stay PIN for the guest's own phone, kept only in scrambled (hashed) form and closed the moment the guest checks out; that page shows the guest's first name only. Requests and complaints a guest makes from that page or through the desk: what was asked for, the room number, the guest's first name, any note the guest typed, who handled it and when, and for a complaint what was done; that note is never put into a notification or the audit record. When the desk gives a guest a QR code to fill in their ID on their own phone: the text details the guest sends (name, document type and number, nationality, date of birth, gender, address, and passport and visa details) are kept encrypted only until the desk takes them, for 30 minutes at most, and are deleted as soon as it does; no picture of the document is ever sent or kept. The code works once, for 30 minutes, and is kept only in scrambled (hashed) form; that page shows the hotel's name only. Only the details the desk chooses and saves go on the guest's record. When an ID is read from a camera, a scanner or a file, it is read on that device; no picture or file is sent or kept. After a guest leaves, the guest's own review of the stay (a score from 1 to 5 and any comment they write), whether the guest agreed at the desk to be sent the review link, and when it was sent. The review page shows no guest name, room or dates, and the link closes after 30 days. When the desk messages guests from the hotel's own WhatsApp or Viber, a record of which guest's chat was opened, on which app, when and by whom; not the message and not the number. Offers go only to past guests who agreed to hear about offers, and every offer carries a link to stop them.
• Hotel groups and families. Rooms booked as one party (a family, a company or a tour): the group's name and kind, who pays, and the name and PAN the bill is made out to. For each person in a room besides its main guest: their name, relation, whether they are a child and their age, who looks after a child and in which room, and the same details the guest register and the foreign guest record take for a main guest (nationality, identity document type and number, and for every foreign national, children included, the passport and visa details). Identity and visa numbers are kept encrypted, and a person taken off a room stays on the record.
• Reservations, bookings, waitlists and queues. Name, phone, party size, time and any note. In a salon's queue, also the service and the stylist chosen. Public booking and reservation forms also record the internet address the request came from, to stop abuse. A coupon code a guest uses on a table booking or a restaurant's website order, with the percent it gave. Table QR orders: the name and phone a guest chooses to leave with their order, both optional, kept on the table's tab for the restaurant's staff and never printed on a kitchen ticket. Named tabs at a bar or counter: the name a tab is opened under and, if given, the guest's phone, kept on the tab. The name is printed on the guest check, never on a kitchen ticket. The phone is used only to find the guest among the business's customers, so the tab can be put on their khata.
• Guest consent. When a guest gives a phone number on a booking, waitlist or online order form: what the number was for, whether they ticked a box to get offers and news and on which channel, which form and wording they saw, when, and when they withdrew. These records keep a locked code made from the number, never the number itself. Offers go only to guests who ticked the box and have not stopped messages.
• Events and RSVPs. Guest name, phone and email, business name and address when the host asks for them, answers to the host's questions, the ticket, check-in time, and whether the guest agreed to be contacted about the event.
• Visitor and contractor log. Name, phone, organisation, purpose of the visit and who they came to see, vehicle number, arrival and leaving time, and the phone's position at sign-in.
• Marketplace enquiries. The name, phone and message a member of the public sends a business, and the internet address it came from.
• Customer payment confirmations. When a customer taps I have paid on a receipt link, the screenshot of their banking app's payment screen (up to five for one notice, each with the time it arrived) and the transaction reference they type are kept with the invoice as evidence of the payment. The picture is saved without its camera or location data. It can be opened only by members of the business who can see its money, by the business's accounting firm, and by named N.P. Xora staff under the rules in section 6. The reference is emailed to the business owner.
• Payment reminders. When a business uses staged payment reminders: each stage sent for a bill (the day, the channels and whether each one went, the words sent and the bill's link), who sent the WhatsApp message and when, whether the business has stopped reminders for a customer and who stopped them, when the customer last opened the bill's link, which the business sees as Opened on, and, when the business writes it down, the day the customer promised to pay a bill and who wrote it. No reminder goes for that bill until the promised day has passed. XoraPro does not send WhatsApp messages itself: the chat opens on the business's own device. Every reminder email carries a link to stop messages.
• Receipts sent from the till. When your staff email a counter receipt to a customer, the address it went to, who sent it and when are kept in the audit log, and the address and subject are kept in the record of that email's delivery. A mobile number typed for WhatsApp, Viber or a text is saved to the customer only when they tick Save to this customer. XoraPro does not send WhatsApp or Viber messages itself: the chat opens on your own device. When a text is sent, the number it went to is kept with the message in the business's message delivery log and, when the text uses an SMS credit, in the note on that credit.
• Messaging. Chats between your business and your customers or team, including voice messages, attachments and calls placed inside the app.
• Calendar. Appointments and reminders.
• XoraPro Find. If you list your business as a service provider, your trade and service area.
• Schools. Student names, dates of birth, phone, guardian names and contacts, daily attendance, exam marks, behaviour notes, fee schedules and payment status. The period timetable: which teacher teaches which class and subject, on which weekday, at what time and in which room. Where the school takes attendance period by period, each child's mark in each period (present, late or absent) and the staff member who marked it; the day's attendance is worked out from those marks. When a teacher is on approved leave, the colleague confirmed to cover each of their lessons, who confirmed it and when; a cancelled cover stays on the record, marked cancelled. A numbered receipt for each fee payment: the child, class, months paid, amount, how it was paid and the name of the staff member who received it. Anyone holding a receipt's link can see that one receipt; it shows no phone number. The school's certificate register: for each transfer certificate, character certificate and bonafide letter, its number, the child's name, date of birth, guardian and class, the last approved grade, conduct, purpose, the dates of request, issue and leaving, any fee charged, the name of the staff member who issued it, when and by whom each copy was printed, and the reason if it was cancelled. The date a child was registered for the Grade 10 board exam. Certificates are never deleted; a cancelled one stays, marked cancelled. The school's fee approval records: for each class and year, the approved monthly ceiling, the approving local government, the approval letter number and date, and the days the fees were presented to the Teacher-Parent Association and posted as a public notice. Scholarships and reserved seats: the child, the kind of award and the share of fees waived; for a reserved seat, the group it is for (a poor family, a disability, a girl, Dalit or Janajati); the ward or committee recommendation that shows the child is eligible, with its number and dates; the committee's decision; and when and why an award ended. The group and the recommendation are seen only by the principal and the school office. Guardian consent records: for each use of the child's data (the school record, photos in records and ID cards, public photos, and messages), whether the guardian gave, refused or withdrew consent, who signed and their relation to the child, the day they signed, the version of the wording they signed and the staff member who recorded it. Consent records are never changed or deleted; a withdrawal is added as a new record. School ID cards: for each child and member of staff given a card, which card it is in their series, the academic year, when it was made, printed and last scanned, and, if it was replaced, when, why (lost, damaged or a new year) and by whom; and the child's photo and blood group when the school records them. The photo prints on the card only while the guardian's consent to photos in records and ID cards stands. The QR on a card holds a random code and nothing about the person. The gate log: each scan of a card at the school gate, its day and time, whether the child was late and by how many minutes, and the staff member who scanned it; a child's scan marks them present on the class register. No fingerprint, face or other biometric data is taken, and a photo is never matched against a face. Gate log entries are never changed. Notices to families: each notice or circular the school publishes, the classes or sections it was for, the children it reached, when each family link first opened it, and whether the school office sent it again from its own WhatsApp or Viber (only that it was sent and by whom, never the phone number or the message). A withdrawn notice is kept, marked withdrawn. When a guardian turns on notifications on a family link, the push address their phone's browser gives for that link; it is removed when the guardian turns notifications off, when the school turns the link off, or when the push service says it no longer works.
• NGOs and non-profits. A numbered receipt for each donation: the donor's name (a donor on file or a typed name), and where the donor gives them their PAN, address, phone and email, the amount, how it was paid and its reference, the fund it goes to, whether the money came from outside Nepal, its purpose and the staff member who made the receipt. The PAN is printed on the receipt and on the donor's yearly giving statement so the donor can claim the deduction; it is never put in a link, a log or an audit record. Anyone holding a receipt's link can see that one receipt; it shows no phone number or email, and the link of a voided donation stops working. Donations are never deleted; a voided one stays, marked voided, with its reason.
• Pharmacies. Patient name, the prescriber's name and registration number, the drug, batch and quantity dispensed, and a photograph of the paper prescription. The law requires the dispensing register to be kept as an unbroken chain, so it cannot be deleted. When a pharmacy switches on patient records: the patient's details (name, date of birth or age, sex, phone, address, blood group), the patient ID the pharmacy gives them, their guardians, and the link to their khata. A National ID or Health ID number, when given, is stored encrypted and shown with only its last four characters. Diagnosis and allergies as written by the doctor or said by the patient, encrypted with the pharmacy's own key; a correction archives the old entry with its reason. Photos of their prescriptions, encrypted with the pharmacy's own key, never deleted and withdrawn only with a reason. The medicines the pharmacy gave them, read from the pharmacy's own sales and invoices. The medication chart the pharmacy keeps: each medicine as the doctor wrote it or the patient said it, its dose, how and when it is taken, its start and stop days, what it is for and who prescribed it, the written words encrypted with the pharmacy's own key; a stopped, changed or corrected entry stays on the record. The doctors and other professionals treating the patient: their name, profession, speciality, council registration number, hospital or clinic and phone, kept once in the pharmacy's list, and which of them treat the patient, in what role and since when. The patient's khata balance, unpaid bills and latest payments, read from the pharmacy's own khata. The patient's consent and how it was given (a signature on screen, a guardian's signature, spoken consent with the witnessing staff member, or an SMS code of which only a hash is kept), when, and when it was withdrawn. A sealed log of every opening, printing and change of the record: who, their role, when and what was done, without the patient's name or any clinical detail. Pharmacists' council registration numbers and expiry dates, and the XoraPro account each signs in with; opening diagnosis, photos and medicines needs two-step sign-in. The patient portal: the XoraPro account a patient, or a child's guardian, links to see the record, the one-time code the pharmacy gave (only a hash of it is kept), when and by whom it was linked, a guardian's link ending on the child's 18th birthday, and every view by the patient, which goes in the same access log. XoraPro's staff cannot read these records. Patient records are archived, not deleted. At the till, when the patient's consent names the counter staff, each item is checked against the patient's allergies. The counter staff see nothing about allergies unless an item conflicts, and then only the name of the allergen (for example penicillin), never the list, a condition or a diagnosis. Only the registered pharmacist or pharmacy assistant sees the full list. When a sale needs their decision (a prescription medicine, an allergy STOP or an item to check by hand), the pharmacy keeps which patient it was for, who decided (their name and council number, shown on the sale as Dispensed by) and the reason they wrote, encrypted with the pharmacy's own key. Other sales do not record the patient. Which registered person was on duty, and a log of every allergy alert shown and every allergy list opened, are kept too. Each staff member's confidentiality undertaking: the name they typed, the date, and the version of the text they accepted.
• Jewellers. Customer name, phone, address and PAN; every sale and purchase of gold and silver, with its weights, purity and amounts. When the shop buys old gold or silver from a customer, what the law asks of the seller: the type, number and a photo of their identity document, a photo of the original purchase bill or why there is none, and proof of origin for metal brought from abroad. Where the anti-money-laundering law asks for it (an occasional customer past Rs 1 lakh in a day, transactions past Rs 10 lakh, or a politically exposed person): the customer's identity document type, number and photo, occupation, source of funds, a note that proof of address was seen, whether they are a politically exposed person, the result of the sanctions check, for a large sale the name on the paying bank account and its holder's relation to the customer, and the record of any threshold transaction report with its goAML reference. Identity numbers are kept encrypted and shown on screen with only their last few characters. The law requires these records to be kept, so they are archived, not deleted.
• Pet shops. The name, kind, breed, birthday and weight of a customer's pets, the food each eats, how much a day and the bag size the owner buys, and their vaccinations with the days due and given. They are used only for the shop to remind the customer before the food runs out or a vaccination is due; the shop sends any reminder itself from WhatsApp, and XoraPro sends nothing. The shop changes or removes a profile when the customer asks; removing it keeps only the pet's name and kind and clears the other details and its vaccinations.
• Bakery and mithai shops. With a cake or sweet-box order: the words a customer asks for on the cake (often a person's name), the size, the flavour, the pickup day and time, and the reference photo the customer gives (which can show a person). The photo is made small on the phone before it is sent and can be opened only by the shop's own signed-in people; it is never public. They are used only to make and hand over the order. The order's name, phone and money are kept as for any order ahead. The activity log never keeps the words on the cake or the photo.
• Mobile, electronics and repair shops. The IMEI of each phone or the serial of each item sold, the bill and the customer it was sold to, and its warranty term; with a warranty claim, the fault the customer reports. On a repair job card: the customer's name and phone, the device, its IMEI or serial, the fault, its condition at intake with photos of the device, and only whether the passcode was given to the technician. The passcode itself is never stored. For a phone traded in: its IMEI and condition. They are used only to run the sale, the warranty and the repair. The shop sends the ready message itself from WhatsApp or Viber, and XoraPro sends nothing. XoraPro sends no IMEI to the Nepal Telecommunications Authority. Job cards and sale records are archived, not deleted.
• Tailoring shops. With a customer's name and phone, their body measurements for each garment (kurta, suruwal, blouse, coat, daura, shirt, pant), in cm or inches, with the day they were taken. When a new set is taken the older one is kept, so an old order still shows the set it was cut to. On an order: the garment, the design as described and the design photos the customer gives (which can show a person), whose cloth, the trial and delivery days, the advance, and the karigar the work was sent to. Photos are made small on the phone before they are sent and can be opened only by the shop's own signed-in people; they are never public. They are used only to stitch and deliver the garment. When the customer asks, the shop removes a set: its figures are cleared. The activity log records only that a set was taken, never the figures. The shop sends the ready message itself from WhatsApp or Viber, and XoraPro sends nothing. Order records are archived, not deleted.
• Optical shops. With a customer's name and phone, their eye prescription: the right and left eye SPH, CYL, AXIS, ADD and PD, who measured it (the shop's own optometrist or an outside doctor) and when, and a photo of an outside doctor's slip. This is health data: it is kept only after the customer agrees, and when and by whom that consent was recorded is kept. The figures and the slip photo are stored encrypted, never put in a link, a log or the activity log, and can be opened only by the shop's own signed-in people who serve at the counter; XoraPro Software Developers cannot open them. When a new prescription is taken the older one is kept, so an old order still shows the prescription its lenses were made to. On a spectacle order: the frame, the lens type and coatings, the delivery day, the advance, and the lab the lens work was sent to. They are used only to make and hand over the glasses and to remind the customer of their next eye test. When the customer asks, the shop removes a prescription: its figures and slip are cleared. The shop sends the ready message and the reminder itself from WhatsApp or Viber, and XoraPro sends nothing. Order records are archived, not deleted.
• Milk collection. For a collection centre or cooperative that buys milk from farmers: each farmer's code, name, phone, village or ward, milk type, and how they are paid: cash, or a bank name and account number, or a wallet name and wallet number. Each pour of milk: the date and shift (morning or evening), the litres or kg, fat, SNF, temperature where measured, the rate and amount, the slip number, who recorded it and when, and, if it was voided, who voided it, when and why. Bank account and wallet numbers are never put in a link, a log or the activity log; the activity log records only that they changed. Each farmer has their own passbook link, which shows that farmer only their own pours and cycle totals, and never their phone, bank account or wallet number. Anyone holding the link can open it, so the centre can reset it and the old link stops working at once. The centre sends slips and passbook links itself from WhatsApp or Viber, and XoraPro sends nothing. Farmer and pour records are archived, not deleted.
• Hospitals. Patient names (including in Devanagari), date of birth or estimated age, sex, phone, address, blood group, the hospital's patient identity number (UIN), the names, relation and phone numbers of guardians or next of kin, and the description of an unidentified emergency patient. A National ID, Health ID or health insurance number, when given, is stored encrypted and shown on screen with only its last four characters. The code on a patient's QR card is not stored, only a hash of it. Clinicians' council registration numbers and expiry dates, and the XoraPro account each clinician signs in with. Each visit, with its department and who was on the care team. The patient's consent to the care team opening their record: how it was given (a code sent by SMS to their phone, of which only a hash is kept; a signature drawn on screen; a guardian's signature; or spoken consent with the witnessing staff member), when, and when it was withdrawn. Every emergency (break-glass) opening of a record without consent, with the clinician, the reason given and the medical director's review. A log of every opening, printing and change of a patient's record: who, their role, when and on what basis. The log is sealed so that changes to it can be detected, and the patient can be shown who opened their record by role and department. Hospital records are archived, not deleted. Shared ward devices: each device's name and ward, who enrolled or revoked it and when, and only a hash of its credential. Each time a staff member unlocks one with their staff number and PIN: who, on which device, when the session started, was last used and ended, and why it ended (idle, end of shift, switch user, ended by a supervisor, the staff member leaving, or their access changing). Each time a ward device lists its ward's patients: who looked, on which ward and when, without naming the patients. When HR records that a member of staff has left, their clinical access and their seat at the hospital are ended after their last working day, and the count of what was ended is recorded. Outpatient visits (XoraHealth): the patient's place and token number in a doctor's queue for the day and each change to it; the consultation note (presenting complaint, history, examination, vitals, assessment, plan and follow-up date), its diagnoses with their ICD-10 codes, the clinician who signed it and when, and every later addendum with its author and time; recorded allergies and reactions; prescriptions (medicine, dose, route, how often, for how long, quantity, instructions in English and Nepali, and the reason given when an allergy warning was overridden); and lab, radiology and procedure orders with their status. The clinical text is encrypted with the hospital's own key, which XoraPro staff cannot open. A signed note cannot be changed, only added to. Laboratory work (XoraHealth): each sample's ID, type, who took it and when, and when the lab received it; each result (a number with its unit, the reference range for the patient's sex and age and whether it is low, high or critical, or the words the lab wrote), the lab's comment, who entered the results, who verified them (always a second person) and who released the report, with the times; and every correction of a released report as a new version marked amended, with who made it and why, the earlier version kept. Results are encrypted with the hospital's own key. A rejected lab sample (XoraHealth): its old sample ID, the reason it was rejected (for example haemolysed or clotted) and any note, who rejected it and when, and who took the new sample and when; the note is encrypted with the hospital's own key. Inpatient admissions (XoraHealth): the ward and bed, the inpatient number, when the patient was admitted, moved to another bed and discharged, and who admitted, moved or discharged them; the hospital's bed board shows who is in each bed by name and patient number, and each time it is read the hospital's log records who read it and when, without naming the patients. Radiology reports (XoraHealth): the findings and the impression typed for an X-ray, scan or other imaging order, who wrote and signed the report and when, and every addendum added after signing with its author and time; a signed report cannot be changed, only added to, and the words are encrypted with the hospital's own key. The hospital pharmacy (XoraHealth): each hand-over of a prescribed medicine, with the item and batches handed over, the quantity, who handed it over and when, and whether an allergy warning was checked; a controlled medicine's entry in the drug register names the patient by their patient identity number, never by name. The ward's medication chart (XoraHealth): each dose recorded as given, held, refused, not available or omitted, when, by whom, on which ward device, the reason and any note, the second person who witnessed a high-alert or controlled medicine, the effect of a dose given as needed, and every correction as a new entry that names the one it corrects, the earlier entry kept. Vital signs (temperature, pulse, blood pressure, breathing rate, oxygen level, air or oxygen, alertness and pain score) with the early warning score worked from them, and nursing tasks (such as a dressing or turning the patient) with when they were due and who did them. The reasons, notes, readings and task details are encrypted with the hospital's own key; a chart entry cannot be changed, only corrected by a new one. Government reports (XoraHealth): whether a patient is treated free as one of the target group for the hospital's free beds, who marked it and when, and how a ward or emergency stay ended (for example cured, referred out or died); the hospital's free-bed register names these patients to the hospital's own staff, and each time it is read the hospital's log records who read it and when, without naming the patients. The monthly HMIS figures, the daily Free Health Portal entries and the Digital Clearance records are counts and amounts only, with who prepared, locked or entered them and when, and never name a patient; the reason a locked month was unlocked is encrypted with the hospital's own key. The emergency department (XoraHealth): how the patient arrived and who brought them, whether the case is medico-legal with its note, and for an accident or unidentified patient the local administration office informed, who informed it, when and what was said; each triage (the category, the chief complaint and a note, who triaged and when), kept as recorded, a new triage added as a new entry; the observation bed; the decision on the visit (admitted, referred out, discharged home, discharge on request, left against medical advice, absconded or died), with its note, the cause of a death, who signed it and when. A referral to another institution: the institution, the reason, the treatment given, the condition at transfer and the transport, the referring clinician with their council registration number, the patient's or guardian's written consent or refusal (the signature itself is on the printed letter) and who recorded it and when, and the receiving institution's reply. When an unknown patient's record is merged into their existing record: both records, who merged them, when and why, and who undid a merge, when and why; nothing written on either record is changed. The emergency board shows who is in the department by name and patient number, the triage colour, the bed and the stage, and each time it is read the hospital's log records who read it and when, without naming the patients. The words are encrypted with the hospital's own key. Nursing and handover notes written on a ward stay (XoraHealth), with who wrote them and when, encrypted with the hospital's own key; a note cannot be changed, only corrected by a new note that names it. During an internet outage a ward device keeps an encrypted copy of its ward's patients for the nurse signed in (name, patient number, bed, allergies, medicines and doses due in the next 8 hours, open tasks and the latest early warning score) and the entries recorded while offline, sealed with a key that exists only in that browser's memory and on the hospital's server, never in the clear on the device; the copy is wiped when the device is locked, switched to another user or reaches the end of the shift, and the entries are sent once the connection returns. An entry the chart could not take when it arrived is kept, encrypted with the hospital's own key, until a nurse resolves it, with who resolved it, when and why. Each printed downtime pack is logged like a patient record. A patient's diet order on a ward (XoraHealth): the diet, a yes or no food allergy flag set by the clinician, from and to, and who ordered it; the kitchen sees only the bed, the diet and that flag, never a name or the allergy itself. Support staff tasks: beds waiting to be cleaned and maintenance tickets, with the place, the job in plain words and who did each step when; these name no patient. Day surgery (XoraHealth): the booking (the procedure, the theatre, the surgeon and anaesthetist, the time and the day-care bed), the photo of the consent form the patient or their guardian signed on paper with its fingerprint (SHA-256), who signed, the staff witness and who attached it, the pre-op checklist with who ticked each item and when, and the operation note (the procedure done, findings, complications, implants, blood loss and post-op instructions) with who signed it and every later addendum. The consent photo, the operation note and its addenda are encrypted with the hospital's own key; a signed operation note cannot be changed, only added to. The discharge summary of an inpatient stay (XoraHealth): the admission and discharge date and time, the provisional and final diagnoses with their ICD-10 and ICD-11 codes, the presenting illness, history, findings, key interventions, treatment, consultations, blood transfusion, adverse reactions to medicines and transfusion, the outcome (and for a death, the cause of death), the advice and follow-up in English and Nepali, the medicines to take home, and the doctor who prepared and signed it and the consultant, each with their NMC number, and when; every addendum added after signing, including after the discharge, with its author, their registration number and the time; and when a patient leaves without a signed summary, the reason (absconded, left against medical advice, died, referred out in an emergency or other), any note, for a death the cause of death, and who recorded it and when. The words and codes are encrypted with the hospital's own key; a signed summary cannot be changed, only added to, and the record of a discharge without a summary cannot be changed. Bills for each visit: the services charged and their prices, each discount with its reason and the owner who approved it, the health equity fee, deposits taken and given back with their receipt numbers, how the patient paid, and the tax invoice issued. A bill names the services only, never a diagnosis or a clinical note, and every opening of a bill is logged like a patient record. The hospital's price list keeps every change with who made it and when. When the hospital's owner or medical director accepts the XoraHealth pilot agreement, and when each staff member accepts the Staff Statement: who accepted (name, role and account), when, the device and network address, and the version of the text accepted. These acceptance records cannot be changed or deleted. If someone who worked at a hospital closes their XoraPro account, their name stays on the hospital's records, because clinical records must show who did what. Insurance and payers: the payers a hospital is empanelled with (the Health Insurance Board, the Social Security Fund or a corporate panel) with their co-pay and ceiling; on a bill, who pays, the patient's insuree or membership number (sealed with the hospital's own key, with only its last four characters shown on lists), the payer's share and the patient's co-pay. On each insurance claim: the patient's name, hospital identity number, sex and date of birth, the visit's dates and type, the diagnosis codes from signed notes (sealed), the bill's services and dispensed medicines, the amounts, the payer's claim code, the payer's questions and reasons for refusal (sealed), every step of the claim and who moved it, and which claims each payment from a payer paid and how much. These details reach a payer's system only when the hospital's staff download or print a claim and enter it there; XoraPro sends nothing to any payer itself. Every opening, print and export of a claim is logged like a patient record. Claims and their steps are never deleted.
• Construction variations. On the link a contractor sends a client to approve a variation: the name the client types, when they approved or said no, the reason they give for saying no, and the signature they draw on screen, kept as an image. When they approve with a code sent to their phone, the code and the number are kept only in scrambled (hashed) form, with the number's last four digits and the network address that asked for the code. Site photos, with who added them and when. The link itself is kept only in scrambled (hashed) form, and a new link or a new price closes the old one. An approved variation is never deleted; it stays on the record.
• Photos and files. Receipt photos, batch photos, product images, your logo, and anything else uploaded into a record. Photos and documents are stored inside our database in Nepal, not in a separate file service.
• XoraPro Software Developers. If you invite us to work in your account: the job and the last day you set, the undertaking each developer signed (the name they typed, the time, their network address, the text's version and fingerprint, and XoraPro's digital signature), and a record of every screen they opened, every file they downloaded and every change they made. You can read it on Change history, and it stays with your business after the access ends.
• Setup partners. If you invite a local IT person to set up your business: their name, the email or phone you wrote, their certificate number (if given), the job, the last day and the permissions you gave; the undertaking they signed (the name they typed, the time, their network address, the text's version and fingerprint, and XoraPro's electronic seal); a record of every screen they opened, every file they downloaded and every change they made; and, when they finish, their handover note and their confirmation that they deleted your files. You can read it on What your setup partner did, and it stays with your business after the access ends.
• Emergency passes. In the rare case that cannot wait for your invitation, a XoraPro platform admin may open an emergency pass to your business for up to two hours: who, when, until when and why (a written reason), and a record of every screen they opened and every change they made. You are emailed when it opens and shown a notice on every screen, and you can end it at any time. The record is on Change history and is never deleted.
• XoraPro support visits. If XoraPro support (Kenn and Merina) open your business to help you set it up while you are somewhere else: who opened each visit, when it began and when they left, their network address and browser, and every change they made, with their name. They are never an owner, and in a hospital they never see patient or clinical records. The record is on Change history and is never deleted.
• Incident reports. What staff write about accidents, near misses, complaints and harassment: what happened, when and where, photos, the people involved (staff, customers, students or patients) with any injury, treatment and hospital, witnesses' phone numbers, a child's class and what their guardian was told, and the notices sent. A report about health, harassment or a child can be read only by the people the business names, never by the person it is about, and every opening is recorded. An anonymous report keeps no name, IP address or device. Reports are not deleted; one made in error is voided with a reason.
• New products from staff. The photo a staff member took of a product, the shop picture made from it, the words, count and barcode they typed or corrected, any price the owner told them, and the name of the person who added it. Until the owner publishes it, it stays inside the business and is not on the till or the website. One the owner puts aside is kept with the business's records, not deleted.
• Scanned documents (XoraScan). Scans your team saves into XoraPro: the PDF of every page, a small picture of page one, the text read from the pages when someone asked for it, the title, the record it is filed on, and who saved it and when. Scans made on the free scanner at xorapro.com/scan stay on the phone and never reach our servers. A saved scan opens only for people who may open the record it is filed on; a removed scan is hidden and can be brought back.
• Scans of identity papers. A hotel may keep scans of a guest's passport, visa page or citizenship on the stay, and a school may keep scans of a student's birth certificate, transfer certificate from the previous school and character certificate on the student's record. These papers carry identity numbers. A guest's papers are seen and opened only by the people who may see guest IDs (the owner, the accountant liaison and the firm's owner or admin), and a student's only by the people who may see the student's record. A Setup Partner sees none of them unless the owner ticked sensitive records. They open only through the address that checks the record, never a public link, and an identity number is never put in a link or a log.
• Scan to fill. On New bill, New expense and Scan to receive, a scanned paper is read on the phone itself and the supplier's PAN, the bill number, the date and the total are filled into the form. The text read does not leave the phone; the scan is kept as above, and the form's details are kept only when you press Save.

Buyers on XoraPro Market are covered by section 13A.

Published content is public. Anything a business chooses to publish, such as its logo, product photos, website text, menus, event pages and Market listings, is public: anyone on the internet can see it. The business decides what to publish and is responsible for having the consent of anyone shown in it. Market listings are also governed by the Market seller agreement.

Founding 99. If your business claims a Founding 99 place, its name, founding number and join date are shown on the public page xorapro.com/founding.

Business verification. When you verify your business: photos of its registration certificate and its PAN or VAT certificate (and a tax clearance or renewal page if you add one), which may show the names of its owners or partners, and the registration number, registering office and PAN you type. They are kept with the business's records for XoraPro's check. Only XoraPro's checker and the business's owner and managers can open them, and they are never shown publicly. The public mark shows only that XoraPro checked them, and when.

Business email and PAN check. When a business is registered we keep its own email, which XoraPro writes to about the business; it is not shown to customers. The XoraPro team looks up each new or changed PAN on the Inland Revenue Department's public PAN search, and keeps with the business's records the name shown there, the result, who checked it and when, and the checker's note. For a sole proprietorship that name may be the owner's own name. Only XoraPro's checker and the business's owner see these, and they are never shown publicly.

XoraPro asks for these permissions only when a feature needs them. You can refuse any of them and the rest of the app keeps working, except where this section says otherwise.

• Location. For staff clock-in, for the visitor log and for vehicle trips, as described below.
• Camera. For scanning QR codes, photographing receipts, batches, products, odometers and delivery handovers, and video calls.
• Microphone. For voice messages in chat and for voice and video calls.
• Screen sharing. Only during a call, and only when someone starts it.
• Notifications. To send reminders, payment alerts and chat messages.

We do not read your contacts, your SMS inbox, your call log, or the other files on your phone.

The staff location record. When a staff member scans the worksite QR to clock in or out, we record the phone's position at that moment and its distance from the worksite. While the person stays signed on, we also record the phone's position about every 15 minutes. In the XoraPro Android app this continues with the screen off, and a notification saying "Signed on for work" stays on the phone for as long as it runs. In a web browser it happens only while the clock screen is open. It stops when the person signs off, and after 12 hours at the most. With each clock-in and each position we also record whether it came from the XoraPro app or a web browser, and the app's version, so the business can see why a phone went quiet.

Staff on a vehicle trip have the phone's position recorded in the same way for the length of the trip, from departure until the vehicle is returned.

Inside the employer's business, only the owner and the people in the HR, payroll and accountant liaison roles can see this record. An outside accounting firm linked to the business cannot. They can see where each signed-on person was last recorded, and each person's record for a chosen day. Every time one of them opens a named person's day, that look is recorded in the business's activity log. The staff member can see their own record at their personal link.

The position readings are deleted automatically after 90 days. The clock-in and clock-out times, and a vehicle trip's times, odometer readings and positions at departure and return, stay in the business's attendance and vehicle records.

At a worksite that requires location, a clock-in without location is not accepted. At other worksites, a staff member who refuses location is still clocked in, without a position. At a restaurant or hotel staff door, a sign-in with no location, or from outside the area, is still recorded, and its hours count only after a manager has checked and accepted it.

XoraPro stores a few small items on your device so that you stay signed in, the right business opens and your choices are remembered. All of them are ours: there is no analytics, advertising or third-party cookie, fonts are served from our own site, and we do not track you across other websites. Because every item is needed for the service or remembers a choice you made, we do not ask for cookie consent.

The till also keeps some things in your browser's storage on that device: sales rung up offline until they are sent, sales the server refused so you can fix them, and the Order Slip number series. These stay on the device, even after you sign out, until they are sent or removed, so do not clear the browser's site data while the till shows sales waiting. A copy of the till page with your customer list is wiped when you sign out. A shop checkout keeps a copy of the order in that browser tab until it goes through or the tab is closed.

If we ever add analytics or any cookie that is not needed for the service, we will update this section first and ask for your consent where the law requires it.

XoraEmergency is a free app, and a web page at emergency.xorapro.com, that dials the emergency and helpline numbers of Nepal as Ncell lists them. It is not run by the police or the government. It has no account, no ads and no analytics, and it sends nothing to XoraPro.

• Location. The app asks for your location when it opens, and reads it only while it is on screen; it stops when you leave it or switch to another app. It is read on the phone to show your latitude, longitude, accuracy, the time of the reading and its Plus Code, which is worked out on the phone; the app does not store it, does not send it to XoraPro and looks up no address. It leaves the phone in three cases only: when you tap Share my location, to the app you pick (for example SMS, WhatsApp or Viber) as a message you can read before you send it; when you tap Send SOS by SMS, Send update or Share on WhatsApp, in the SOS message, which you check before you send it; and when you tap Open in Google Maps, to Google Maps.
• Calls. Tapping Call opens your phone's dialer with the number typed in. The app does not place the call, does not hold the phone call permission, and does not see or keep any record of the call.
• Maps. The app shows no map of its own and fetches no map pictures. Open in Google Maps opens your location in Google Maps, whose own privacy policy applies.
• SOS to my people. The names and phone numbers of up to five people you choose to save are kept on the phone only, after you agree to that. The app sends them to no one, XoraPro included, and does not read the phone's contacts; you type them in. Send SOS by SMS opens the phone's own SMS app with one of those numbers at a time (or, while you are online, to all of them at once if you choose) and a message with your location filled in, and you press send yourself; that SMS goes through your mobile operator. Share on WhatsApp opens the same message in WhatsApp, whose own privacy policy applies. The Android app does not let Android copy them to a Google Drive backup or move them to a new phone in a device-to-device transfer either. Removing a contact, or clearing the app's data, deletes them from the phone.
• Medical ID. The name, blood group, allergies, medical conditions, medicines and emergency contact you fill in are kept on the phone only, and the app sends them nowhere. This is sensitive health information: anyone holding your phone can open the app and read it, which is what it is for, so that a responder can read it when you cannot speak. The Android app does not let it go into a Google Drive backup or move to a new phone in a device-to-device transfer. Delete medical ID, or clearing the app's data, deletes it from the phone.
• Check on me. When you start the timer, its start and due time are kept on the phone only and sent nowhere. In the Android app the phone itself shows a notification at that time (it asks for permission the first time; with Alarms and reminders off it may come late, and the app says so); the notification comes from no server or push service. The web page asks for no notification permission. When the time passes the app opens on the SOS screen, but it sends no SMS or message by itself: you press send. Cancelling deletes it from the phone. The time you last tapped Send SOS or Send update is also kept on the phone only.
• Widget and tile. The Android Home Screen widget and quick-settings tile only open the dialer or the app; they read, keep and send nothing.
• The Nepal Police app. Tapping Nepal Police app (Panic Mode) opens Nepal Police's own app when it is on the phone, or its page on Google Play when it is not. XoraEmergency sends that app nothing and connects to no Nepal Police system; that app's own privacy policy applies. On Android the app only checks whether that one app is installed.
• Language and tourist mode. Your choice of English or Nepali, and whether tourist mode is on, are kept on the phone only.
• The web page. emergency.xorapro.com is served from a server XoraPro rents from Amazon Web Services in Singapore, apart from the XoraPro service. Like any website, that server sees your IP address and the files the page asks for when it loads; it is set to keep no record of visits. After the first visit your browser keeps the page on your phone, and it then opens without asking the server.
• The page xorapro.com/emergency shows the same numbers and links to emergency.xorapro.com; it asks for no location and makes no request of its own. What every page of this site stores is in section 5A.

XoraScan is a free Android app that opens the free scanner at xorapro.com/scan. It has no account and no ads, and no analytics or advertising code. Links outside the scanner, such as signing in to XoraPro, open in your phone's browser, so saving a scan into a XoraPro account happens there, under the rest of this policy.

• Camera. The app asks for the camera the first time you tap the camera in the scanner, and uses it only while the scanner is on screen. When the phone has Google's document scanner, which comes with Google Play services, Scan may open it instead; Google's own terms apply to it, and XoraScan receives only the finished pages.
• Files you share into it. When you share a photo or a PDF to XoraScan from another app, or open a PDF with it, the app copies the file into its own temporary folder, adds it to the scanner on the phone, and deletes the copy. It reads only the files you share, and asks for no permission to read your photos or files.
• What stays on the phone. Your scans, the text read from them and the names you give them are kept in the app's storage on the phone and are never sent to XoraPro. The app does not let Android's cloud backup copy its storage. Saving a PDF puts it in the phone's Documents/XoraScan folder, or in the app's own folder on Android 10 and older; Share sends it to the app you pick.
• What reaches our server. Like any website, the scanner asks xorapro.com for its pages and files (the scanner's code, the text reader's language files and the corner-finding model), and our web server keeps the technical log described in section 10. If something goes wrong in the scanner, the app sends our own error log the error's name, message and place in the code, the page's address without its query, the screen width and the language; the server keeps only the browser family and whether it was a phone, tablet or computer. It carries no name, no scan and nothing typed into a form, no IP address is kept with it, and it is shared with no one. Such a report is deleted once the same error has not come back for 30 days.

• We do not sell your data, or your customers' data, to anyone.
• We do not share it with advertisers, and there is no advertising or ad-tracking code in the app.
• We do not build profiles of your customers for our own use.
• We do not look at one business's books to help another business.

We do not read your records except when you ask us for support, when we need to keep the service running, fix a fault or check its security, or when the law requires it. Such access is limited to named N.P. Xora staff and to what the task needs. The daily sign-up summary and the same-day alerts in section 3, and the event guest check in section 3A, are the routine exceptions: they read new account and business sign-up details, the activity records those alerts need, and the email addresses on an event's guest list, for our own security purpose.

These are the outside companies involved in running XoraPro today. Each one gets only what it needs to do its job.

• Ncell Axiata Limited (Pokhara, Nepal). Runs our servers and database. Your books and records are stored here.
• Amazon Web Services (Singapore region, standby hosting). Keeps a standby copy of our database, rebuilt from our encrypted backups at Cloudflare and kept read-only. It runs XoraPro only while the Nepal server is unavailable, when a person on our team decides to switch to it, and we move the service back to Nepal once that server is back.
• Cloudflare. Stores our backups. They are encrypted on our server in Nepal before they leave it, so Cloudflare cannot read your records.
• Fly.io, in Singapore. Ran our servers and database until 17 September 2026. The copy of the data that stayed there was deleted on 1 October 2026.
• Resend (United States). Delivers every email XoraPro sends: sign-in codes, invitations, invoices and payslips a business sends, event tickets and reminders. It receives the recipient's address, the message and any attached PDF.
• Postmark (ActiveCampaign, United States). Receives the email sent to the address a business opens for supplier bills, and hands it to XoraPro. It receives the sender's address, the subject, the email's headers, the message and the attached files.
• Google Workspace (United States). Our company email, including support@xorapro.com. It gets only what you write to us.
• Sync.com (Canada). Our own document storage, used by our team. It holds files a business sends us directly, such as a logo, menu or photos, and our own company records. It does not hold the XoraPro database.
• Push services: Apple Push Notification service and Google Firebase Cloud Messaging for the phone app, and for browser notifications the push service run by your browser's maker (Google, Apple, Mozilla or Microsoft). They receive a device address and the notification, not your books.
• Google ML Kit (United States), inside the phone app's QR scanner. The scan happens on the phone; Google receives device and app details and performance data.
• Anthropic (United States). Runs the AI behind seven features: the Xora AI assistant, Draft a reply in messages, reading a supplier's invoice at truck arrival, translating event messages, naming a product from its photo, writing a product's description from its photo, and reading a delivery platform's statement or VAT bill. Section 15 lists what each one sends. A business owner can switch them all off in Settings.
• eSewa and Khalti (Nepal). Only when your business connects one of them to collect payment on an invoice, and when you pay us by wallet. See section 14.
• Fonepay (Nepal). Only when your business connects its own Fonepay merchant account to take payment on an invoice by QR. It receives the amount, the invoice number, your business name and a reference number for the payment link. See section 14.
• Sparrow SMS (Nepal). Only when your business sends a receipt, a reminder or a guest message by SMS. It gets the mobile number and the text of that message.
• Call connection servers. Google (STUN, United States) helps two phones find each other, and Metered Open Relay (TURN, server location not disclosed by the operator) carries the call when a direct connection fails. They see IP addresses and call timing, and pass on encrypted audio and video that they cannot read.
• Have I Been Pwned (Australia). When you set a password we send the first five characters of a scrambled form of it, never the password or your email, to check it has not appeared in a known leak.
• The Inland Revenue Department's CBMS. Only if your business switches on electronic billing itself. When it is on, the buyer's name and PAN go to the Department with each invoice. Nothing is sent until you turn it on.

The full list, with what each company receives, the country, and a dated change log, is here: Outside companies we use

If we ever add another company to this list, we will update this policy and tell account holders before it starts.

Your books and records are stored in Nepal, at Ncell in Pokhara. Nepal's Electronic Billing Procedure 2082 requires billing software's main server and database to be inside Nepal, which is why XoraPro moved there on 17 September 2026.

Some services we use work outside Nepal and receive only what their task needs: Amazon Web Services (the standby copy of our database, in Singapore), Cloudflare (encrypted backups it cannot read), Resend (emails), Postmark (email sent to a business's bills address), Anthropic (the AI features in section 15), Apple, Google and browser push services (notifications), Google ML Kit (the phone app's scanner), Google Workspace (email you send us), the call connection servers, Have I Been Pwned (the password check), and Sync.com (files a business sends our team directly, and our own company records). Each is listed in section 7 with what it receives.

Where your data is processed. Your books and records are processed on our main server and database in Nepal, at Ncell in Pokhara. A standby copy of the database is kept with Amazon Web Services (AWS) in Singapore. It is rebuilt from the encrypted backups held at Cloudflare, which it fetches over an encrypted connection, and is kept read-only. XoraPro runs from it only while the Nepal server is unavailable, and a person on our team decides when to switch to it. Once the Nepal server is back, we move the service back to Nepal. The services above process what they receive in the countries named in section 7 and on the Outside companies page: Resend, Postmark, Anthropic, Google and the Apple Push Notification service in the United States, Have I Been Pwned in Australia, the Metered Open Relay call server in a location its operator does not disclose, browser push services wherever the browser's maker runs them, the encrypted backups in Cloudflare's Asia-Pacific region, and files a business sends us directly (such as a logo, menu or photos) and our own company records, which our team keeps with Sync.com in Canada. Sync.com does not hold the XoraPro database.

How data that leaves Nepal is protected:

• Each service receives only what its task needs (section 7).
• Everything our server sends to these services travels over an encrypted connection (HTTPS/TLS). Call audio and video are encrypted, so the call connection servers cannot read them.
• Backups are encrypted on our server in Nepal before they leave it, so Cloudflare cannot read your records.
• Where we hold an account with the company, such as Amazon Web Services, Resend, Postmark, Anthropic, Google, Apple, Cloudflare and Sync.com, its published terms for customers apply to what it receives. We accepted those terms when we opened the account.

The frozen copy of the data as it stood on 17 September 2026, which stayed with Fly.io in Singapore, was deleted on 1 October 2026.

Your data does not stop being yours because of where the machine sits. The duties in this policy apply wherever it is stored.

• Everything travels over an encrypted connection. Nothing about your business moves in plain text.
• Every business record carries the business id, and every request checks the signed-in person's membership of that business before reading or writing it.
• You can sign in with a passkey or a one-time code instead of a password. Two-step sign-in is available and we recommend it for the owner account.
• Payment gateway secrets are stored encrypted, not in readable form.
• Each person is invited with a role. Only an owner, the payroll role, your accountant liaison, or your accounting firm's owner or admin can run payroll, set pay, or change payment settings.
• Actions that touch money leave an audit trail showing who did it and when.
• Access to production systems is limited to named N.P. Xora staff and used only for support, maintenance or security.
• Each time we open a business's records inside the app, the owner can see it in the access log.

No system is perfectly safe. If a breach happens that puts your data at risk, we will tell affected account holders and explain what was involved and what we did about it.

Nepali tax law fixes much of this. Where it does not, the period below is our own promise.

• Invoices, ledgers and other books a business must keep for VAT. Six years after the end of the fiscal year. VAT Rules 2053, rule 23(7), under section 16(4) of the VAT Act 2052.
• Documents supporting an income tax return. Five years from the end of the income year, and in practice the six years above. Income Tax Act 2058, section 81(2).
• The audit trail, including sign-in times, internet address and device. At least the six years above. It cannot be edited or deleted within that time. Electronic Billing Procedure 2082.
• Staff and vehicle position readings. 90 days, then deleted automatically. Our promise (section 5).
• Kiosk photos. The kiosk no longer takes a photo. Kiosk photos are deleted after 30 days.
• Demo requests from the trade pages. 12 months, then deleted automatically. Our promise (section 3A).
• Your account details, signed-in devices, support messages and Xora AI conversations. While your account is open, and removed when we carry out a deletion request (section 12). Needed to run your account.
• Daily backups. About five weeks. To recover from a failure.
• Monthly backups. About thirteen months. To recover from a failure.
• Each fiscal year's archive backup. At least as long as tax law requires books to be kept. Electronic Billing Procedure 2082 requires a backup for each fiscal year.
• Market data. As section 13A says.
• Everything else your business puts in. While your business account is open. The business decides what to keep and can delete anything that is not part of its books. It is the business's data.

Signed-out sessions are removed 30 days after they expire, and internet addresses kept for security are cleared after 90 days, except in the audit trail described above.

A backup is never restored to bring back data you asked us to delete, only to recover from a failure.

Our web server keeps a technical log of each request (internet address, time, page and browser) to keep the service secure and find faults. Sign-in links are removed from it, and it is kept for 30 days.

You will notice that XoraPro will not let you delete a posted invoice, a stock movement or a khata entry. It lets you reverse it instead, and both the original and the correction stay on the screen.

This is deliberate. The Electronic Billing Procedure 2082 (विद्युतीय बीजक सम्बन्धी कार्यविधि, २०८२) requires that data once entered cannot be deleted, that corrections are recorded rather than erased, and that every entry carries the user, date and time. Software that allows hard deletes cannot be listed with the Inland Revenue Department.

It also protects you. If a figure is questioned two years from now, the trail shows what happened and who changed it.

Drafts and things that never touched your books can be deleted normally.

Your books are yours and you can take them with you.

• Export. You can export your invoices, ledgers, party balances, payroll and inventory from inside the app at any time, in a form your accountant can open.
• Correct. You can correct anything about you or your business from your settings. Posted entries are corrected by reversal, as explained in section 11.

How deletion works today. Write to support@xorapro.com. The account deletion page at xorapro.com/delete-account explains the same steps. We check that the request really comes from you, which usually takes 2 to 3 working days. N.P. Xora staff then switch the account off so that nobody can sign in, and remove your name, email and phone from it. We aim to finish within 30 days and email you when it is done.

You can also ask from inside the app: Settings, Delete my account.

Your other rights, such as seeing what we hold or objecting to a use, and how to use them, are in section 18A. The same 30-day aim applies to every request.

What the law makes us keep. Invoices, ledgers and other books a business must keep for tax stay for six years after the end of the fiscal year (VAT Rules 2053, rule 23(7)), stored in Nepal, and are then destroyed. The audit trail attached to them, which includes sign-in times, internet address and device, is required by the Electronic Billing Procedure 2082, cannot be edited or deleted, and is kept for the same period. After deletion these entries stay, but the account they point to no longer carries your name, email or phone.

Export your data before you close the account. It is easier than asking for it afterwards.

This section is for you, not for the shop owner.

Your name, your phone number, what you owe, your salary, your clock-in location: the business you deal with put those into XoraPro. That business decides what is held about you and for how long. We only keep it for them, on their instruction. We cannot change or remove it on our own.

So if you want to see what is held about you, get it corrected, or ask why something is recorded, go to the business first. They can do it straight away from their own screen. If you are a staff member, you can see your own location record at your personal link (section 5).

If you have gone to the business and got nowhere, write to us at support@xorapro.com. We will pass it to them and tell you that we have. If what you are describing looks like misuse of the system, we will look into it.

Your rights under the Individual Privacy Act 2075 are against whoever holds your information. In most cases here, that is the business, not us.

This section is for people who buy on XoraPro Market at xorapro.com/market, and for shops that sell there.

Who is responsible for what

There are two kinds of information here, and the duty is different for each.

The shop's records. When you place an order, it goes into the shop's own XoraPro books: your name, phone, email, delivery address, what you ordered, the invoice and the payment. The shop needs these to sell to you, deliver, invoice and keep its tax records. They belong to the shop, as section 13 explains, and the shop is answerable for them. The email is the one you type on the order, or if you type none, the one you signed in with.

What XoraPro holds for the Market itself. For your Market sign-in, reports, complaints and the working of the Market, M/s N.P. Xora Private Limited decides what is collected and why. For that information the responsibility is ours.

What we collect for the Market, and why

We collect information only for the purpose stated, and use it only for that purpose (Individual Privacy Act 2075 s.12(2), (3)).

For shops that sell on the Market, we also hold what the seller agreement asks for: the business's legal name, PAN or VAT number, registration details and a photo of the registration certificate, contacts and grievance contact, and the record of when and by whom the agreement was accepted. The certificate photo is seen only by the shop itself and by XoraPro staff doing the check, and is never shown on a public page.

Who sees your information

• The shop you order from sees what it needs for your order: your name, phone, email, address, what you ordered and how you pay. This exchange is allowed by the Electronic Commerce Act 2081 s.12(2).
• The shop's rider or courier gets what is needed to deliver: name, phone, address and the parcel.
• Other shops do not see your orders with a shop. We do not tell anyone whether you are a customer of a particular shop.
• The outside companies listed in section 7 of this policy, for the jobs described there, and nobody else.
• We do not sell your information, share it with advertisers, or use it to build a profile of you.

Your choices

• From your account page with a shop, you can see your details and change the phone, receipt email and delivery address that shop holds for you (Electronic Commerce Act s.12(3)). To change your name, ask the shop.
• You can order without an account from a shop that sells to individuals: the shop needs only your name and phone, and your address for delivery.
• For anything else, and for your other rights, see section 18A or write to support@xorapro.com.

How long we keep it

• Your sign-in details: while your account is open, and removed when we carry out a deletion request, as section 12 describes. You can ask from your account's Security page or by writing to support@xorapro.com.
• Complaints, reports and seller agreements: at least six years, so that we can show how each was handled. The law requires at least five years (Electronic Commerce Directive 2082 cl.14).
• Orders and invoices: kept by the shop in its books for the periods in section 10.

Where it is kept

On XoraPro's server in Ncell's data centre in Pokhara, Nepal, with a standby copy in Singapore and encrypted backups, as section 8 describes.

Children

The Market is meant for people aged 18 and over, and we do not knowingly open an account for anyone younger (section 17). Goods restricted to adults are sold only to buyers who confirm at checkout that they are 18 or over.

Two different things happen here, and it is worth separating them.

Money your customers pay you. If your business connects eSewa or Khalti, the customer pays on that provider's own page and the money settles into your account with that provider. If your business connects Fonepay dynamic QR, we send Fonepay the amount, the invoice number, your business name and a reference number for the payment link, the customer scans the QR in their own banking app, and the money settles through your Fonepay merchant account into your bank. XoraPro never holds the funds. We store your merchant code and an encrypted secret, for Fonepay also an API username and an encrypted API password, so we can match the payment to the right invoice, plus the reference number the provider returns. We never see or store a card number, a wallet PIN or a bank password.

When you record a payment by hand as Fonepay QR, bank transfer or cash, that is a note you are making in your own book. No data goes to those rails for a note like that.

Money you pay us. For your XoraPro subscription and any SMS credits, N.P. Xora Pvt Ltd issues you a bill and keeps what was billed, what you paid, when, how you paid (bank transfer through Fonepay) and the reference. We never see or store a card number or a bank password.

Seven XoraPro features use AI. The AI is run by Anthropic, in the United States. Each feature sends Anthropic only what is listed below, only when someone uses that feature, and only to produce that answer.

• The Xora AI assistant. Your question and the business figures needed to answer it, such as balances, deadlines or a report total. If you ask about a customer or supplier, this includes their name, balance and recent entries.
• Draft a reply, in messages. The recent messages in that conversation, with the names of the people in it, and the state of the linked record, such as an invoice's total and balance.
• Reading a supplier's invoice at truck arrival. The whole invoice PDF, which carries the supplier's name, PAN or VAT number, invoice number and truck number. A supplier bill emailed to the business's bills address is read the same way: the whole PDF or photo attached to the email, but not the email itself or the sender's address.
• Translating an event message. The text to be translated.
• Naming a product from its photo. The photo as it was taken and the shop picture made from it, both made smaller, and the names of the business's own product categories to choose from. No person's name, price or other record is sent, and only the words the person keeps go on the product.
• Writing a product's whole description from its photo, in the product form. The photo as it was taken and the shop picture, both made smaller, and the product's name, brand and category as typed in the form. No person's name, price or other record is sent, and only the words the person chooses go on the product.
• Reading a delivery platform's statement or VAT bill, when you record its payout. The whole PDF, which carries the platform's name and PAN, the bill number, and the order numbers with their amounts.

A business owner can switch all seven off in Settings.

Only your own business's data is sent. The assistant cannot reach another business's records.

Anthropic's commercial terms do not allow it to train its models on this data. Anthropic deletes what it receives through its service within 30 days, except where its own terms allow it to keep something longer, such as a request flagged for breaking its usage policy.

Your Xora AI conversations are stored in your account so you can look back at them. AI can be wrong. Check any figure before you rely on it.

We give data to a government body only when the law requires it. In practice that means:

• A written demand from an authorised official in the course of investigating or prosecuting an offence, or an order of a court. The Individual Privacy Act 2075 allows disclosure in those circumstances at sections 10(4), 12(5) and 26(1).
• A demand from the Inland Revenue Department in relation to your tax records. Note that section 16(1a) of the Value Added Tax Act 2052 gives the Department continuous access to the computer database of taxpayers. That is a duty that sits on you as a taxpayer, and it is one reason your records cannot be deleted at will.

We will tell you if your data is demanded, unless the law forbids us from telling you.

Separately, one feature sends data to a government office because the law requires it, and only when a hotel chooses to switch it on:

• The Department of Immigration's FNMIS (foreign guest registration). Only if a hotel switches it on, the details of each foreign guest that Nepal's rules require go to the Department. This is a disclosure the hotel makes under the law that applies to it, not the use of one of our outside companies. Nothing is sent until the hotel turns it on.

We do not hand over anything on an informal request. If someone asks without lawful authority, the answer is no.

XoraPro is a tool for running a business. It is not meant for children and we do not knowingly open accounts for anyone under 18.

Schools using XoraPro do hold student records, including names and guardian contact details. That data belongs to the school. The school decides what is held and is answerable for it. Under section 33 of the Individual Privacy Act 2075, consent for a person under 18 is given by the guardian.

The Individual Privacy Act 2075 is the main law here. The parts that bear on what we do:

• Sections 12(2) and 12(3). Personal and family data may be collected only with consent, and data collected by a body corporate with consent may be used only for the purpose it was collected for. That is why we do not repurpose your books.
• Section 12(4). Details of health, property and income, employment, family matters, biometrics, signature, political affiliation and business or transactions may not be given to anyone else or published without consent. Most of what XoraPro holds falls under this.
• Section 10(3). A body corporate holding details of a person's property must not disclose or publish them without that person's consent.
• Section 26(1). Personal information under the control of a public body or body corporate may not be used or given out without consent, apart from the listed exceptions.
• Section 29(2). An offence under the Act carries imprisonment up to three years, a fine up to thirty thousand rupees, or both.
• Section 30(2). A complaint goes to the concerned District Court, and it must be filed within three months of the act complained of.
• Section 31. The District Court may order compensation for damage or loss.

The Individual Privacy Rules 2077 sit under the Act. The Electronic Transactions Act 2063 also applies: unauthorised access to a computer system is an offence under section 45, and disclosing material obtained in confidence in the course of duty is an offence under section 48.

Nepal has no data protection authority and no regulator to complain to. Complaints go to the District Court. Come to us first and we will try to fix it without that.

As an account holder, you have these rights over what we hold about you. They rest on the sections of the Act in section 18: your data is collected with your consent and used only for its purpose (the Act's sections 12(2) and 12(3)), and it is not given out without your consent (the Act's sections 10(3), 12(4) and 26(1)). We also honour these rights as international laws such as the GDPR describe them, wherever you are.

• Access. You can ask what we hold about you and get a copy of it.
• Correction. You can correct your details and your business's details from your settings, or ask us to. Posted entries are corrected by reversal (section 11).
• Deletion. You can ask us to delete your account, as section 12 describes. What the law makes us keep stays for the period the law sets.
• Objection. You can object to any use section 3B bases on legitimate interest, such as a call to help you get started. We will stop, unless the use is needed to keep the service secure or the law requires it, and if we do not stop we will tell you why.
• Portability. You can take your books with you: export your invoices, ledgers, party balances, payroll and inventory from inside the app at any time, in a form your accountant can open (section 12).
• Withdrawing consent. Where we rely on your consent, you can withdraw it at any time: reply STOP or write to us to stop our messages, and turn a phone permission off in your phone's settings. Withdrawing does not undo what was done before.

To use any of these rights, write to us or call:

• Email: support@xorapro.com
• Phone: 976-8591889

We check that the request really comes from you, aim to complete it within 30 days, the same as a deletion request in section 12, and tell you when it is done. If we cannot do what you ask, for example because the law makes us keep a record, we will tell you why.

If you are a customer, staff member or supplier of a business that uses XoraPro, the business holds your information, so use these rights with it first (section 13). If we do not put it right, you can complain to the District Court and seek compensation, as section 18 explains (the Act's sections 30(2) and 31).

When we change this policy we will change the date at the top. If the change affects what we do with your data, we will tell account holders by email and inside the app before it takes effect.

Old versions are available on request from support@xorapro.com.

Ask us anything about this policy, or about what we hold.

• M/s N.P. Xora Private Limited
• Ward No. 3, Samakhusi, Kathmandu Metropolitan City, Nepal
• support@xorapro.com
• 976-8591889

Write in Nepali or English. We reply in whichever you used.