Overview
This Privacy Policy ("Policy") applies to Jekon ("Jekon", "we", "our", or "us"), an early-stage venture run by its founders from Pune, Maharashtra, India. Jekon is not yet an incorporated company. When it is registered, responsibility for your data will pass to that company, this Policy will be updated, and we will tell you by email.
This Policy describes how we collect, use, store, share, and protect information when you: - Visit our website at jekon.in or any of its subdomains - Use the Jekon reconciliation platform at app.jekon.in ("Platform") - Connect accounting software, bank accounts or WhatsApp to the Platform - Contact us by email or through the forms on our website
Our two roles
For information about website visitors, demo requests and our own customers' account users, Jekon is the data controller (or "data fiduciary" under Indian law). For the financial records our customers bring into the Platform — invoices, payments and bank transactions, which may include details of their own customers and suppliers — we act as a processor on our customer's behalf and handle that data only on their instructions.
By using Jekon's services, you acknowledge that you have read and understood this Policy.
Data We Collect
We collect the following categories of data:
1. Contact & Enquiry Information
When you join early access, book a demo or apply to our partner program, we collect your name, work email address, company or firm name, whether you are a business or an accounting firm, company size or number of clients, country, the accounting platform you use, and any message you include.
2. Account Information
When your organisation uses the Platform, we collect each user's name, email address, role and login credentials. Passwords are stored only as salted hashes, never in readable form.
3. Financial Data Your Organisation Connects
To reconcile your books, the Platform imports and stores the following from the sources you connect (QuickBooks Online, Xero, bank feeds via Plaid or GoCardless, and CSV uploads): - Invoices, bills and payments (customer or vendor name, amounts, currency, dates, invoice and reference numbers) - Bank transactions (amount, currency, date, description or payee, and bank account details provided by the feed, such as account name and institution) - Purchase orders and goods receipts, where you use three-way matching - Match results, review decisions and the audit trail of every action taken in the Platform
This data is stored in our database so it can be matched, reviewed and reversed. It is kept separate from every other customer's data.
4. WhatsApp Data
If your organisation links a WhatsApp number, we receive that phone number, basic message details (such as message ID and time) and any documents or images sent to Jekon's WhatsApp number from it.
5. Billing Information (only once paid plans start)
Jekon does not take payments during early access. When paid plans start, they will be billed through Stripe, which collects and stores payment card details; Jekon will not receive or store full card numbers. We will then keep a record of your plan, invoices and payment status.
6. Usage & Technical Data
- IP address
- Browser type and version, and operating system
- Pages visited, actions taken in the Platform, and timestamps
- Server and security logs
7. Cookie Choice
When you accept or decline cookies on our website, your choice is saved only in your own browser. We do not record it on our servers. See our Cookies section below.
How We Use Your Data
We use the data collected for the following purposes:
Providing the Platform
To import your invoices and bank transactions, score and match them, route matches for automatic approval, review or blocking according to your settings, keep the audit trail, and let you reverse actions.
Communication & Scheduling
To respond to early-access signups, demo requests and partner applications, schedule calls, provide support, and send service and account notices.
Billing
To manage subscriptions, invoices and payments, once paid plans start.
Security & Fraud Prevention
To protect accounts, detect and prevent unauthorised access or abuse, and maintain the integrity of audit records.
Improving our Service
To understand how the website and Platform are used and fix problems, using aggregated or de-identified information wherever possible.
Legal Compliance
To comply with applicable Indian laws (including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023), the GDPR and UK GDPR, and other legal obligations.
Optional AI explanations
Matching decisions are made by deterministic rules, not by AI. If your organisation switches on AI-written explanations, the relevant match details are sent to our AI provider to generate a plain-language explanation. Before anything is sent, we remove identifiers such as card numbers, bank account numbers, IFSC codes, PAN and Aadhaar numbers. This feature is off by default.
We do not sell your data, use it for advertising, or share it with data brokers. We do not use customers' financial data to train AI models.
Third-Party Services & Integrations
We share data only with the service providers we need to run Jekon, and only for that purpose:
Accounting Platforms
QuickBooks Online (Intuit Inc.) and Xero Limited, via OAuth 2.0, using read-only access. We do not write data back to your ledgers without your explicit instruction.
Bank Data Providers
Plaid Inc. (US bank accounts) and GoCardless (UK and EU bank accounts) supply bank transaction data you authorise through their own consent screens.
Messaging
Meta Platforms (WhatsApp Business Platform), if you link a WhatsApp number.
Payments
Stripe, Inc. will process subscription payments once paid plans start.
Hosting
Amazon Web Services (AWS) hosts the Platform and its database; our primary servers are located in India. Our marketing website (jekon.in) is hosted by Netlify, Inc.
Email & Records
Email delivery providers send form confirmations and service emails on our behalf. Google (Google Workspace) stores our list of early-access signups, demo requests and partner applications.
AI Provider (optional)
Sarvam AI, only if your organisation switches on AI explanations, and only with identifiers removed as described above.
Each of these providers is governed by its own privacy policy and our agreements with them. We may also disclose data where required by law or to protect our legal rights.
International Transfers
Jekon is based in India and our primary servers are located in India. If you are in the European Economic Area or the United Kingdom, your data will be transferred to and processed in India and other countries where our service providers operate.
Where the law requires it, we protect these transfers with appropriate safeguards, such as the European Commission's Standard Contractual Clauses. You can request more information about these safeguards by emailing dev.jekon@gmail.com.
Data Retention
Contact & Enquiry Data
Information submitted through our website forms is retained for up to 3 years for business correspondence and then deleted.
Financial Data & WhatsApp Documents
Kept for as long as your organisation's account is active, so that matches can be reviewed and reversed. After an account is closed, we delete this data within 90 days, unless we are legally required to keep it longer.
Audit Trail
The audit trail is append-only and cannot be edited, by your users or by our staff. It is kept for the life of your account and deleted with your other financial data when the account is closed, unless the law requires us to keep it longer.
Account & Billing Records
Billing and invoice records are kept for as long as tax and accounting laws require.
Server Logs
Application and security logs are kept for 30 days.
You may request deletion of your personal data at any time by emailing dev.jekon@gmail.com. We will respond within 30 days. If your request concerns financial data that your organisation controls, we will refer it to your organisation and act on its instructions.
Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Right to Access
You can request a copy of the personal data we hold about you.
Right to Rectification
You can request correction of any inaccurate personal data.
Right to Erasure ("Right to Be Forgotten")
You can request deletion of your personal data, subject to legal retention requirements.
Right to Restrict Processing
You can ask us to pause processing your data in certain circumstances.
Right to Data Portability
You can request your data in a structured, machine-readable format.
Right to Object
You can object to processing based on legitimate interests.
Right to Withdraw Consent
Where we rely on consent to process your data (for example, optional cookies), you can withdraw that consent at any time.
GDPR and UK GDPR (EU and UK Users)
Our lawful bases for processing include: performance of a contract, our legitimate interests (such as securing the Platform and responding to enquiries), compliance with legal obligations, and consent where we ask for it.
Digital Personal Data Protection Act, 2023 (India)
Indian residents have rights under the DPDP Act, including the right to access, correct and erase personal data, and to nominate another person to exercise these rights.
To exercise any of these rights, please email: dev.jekon@gmail.com
Security Measures
We use technical and organisational measures appropriate to financial data, including:
Encryption
Data in transit is protected with TLS. Our database, cache and backups are encrypted at rest, and the OAuth tokens that connect your accounting software and bank feeds are additionally encrypted with AES-256-GCM.
Customer Data Isolation
Every request to the Platform is limited to the organisation that made it, so one customer's records cannot be read by another.
Access Control
Platform permissions are role-based; for example, only administrators can approve or reverse matches. Access to production systems by Jekon staff is limited to authorised personnel, requires two-factor authentication and an approved network, and is logged.
Append-Only Audit Trail
Every match action in the Platform is recorded with the state it replaced. The audit trail cannot be edited or deleted through the Platform.
Verified Inputs
WhatsApp messages are verified as genuinely coming from Meta before they are accepted, and uploaded files are limited by type and size.
Incident Response
If a personal data breach occurs, we will notify affected customers and the relevant authorities within the timeframes required by applicable law (for example, within 72 hours under the GDPR).
Children's Privacy
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us personal data, please contact us at dev.jekon@gmail.com and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data practices. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Post a notice on our website
- Where required by law, notify you directly by email
We encourage you to review this Policy periodically.
Contact Us
For privacy-related queries, requests, or complaints, please contact us:
Jekon (founding team; not yet incorporated) Grievance Officer / Data Protection Contact Email: dev.jekon@gmail.com Location: Pune, Maharashtra, India
We will respond to all privacy requests within 30 calendar days. If you are unsatisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction, or, in India, with the Data Protection Board of India.
This Privacy Policy is governed by the laws of India. Any disputes arising under this Policy shall be subject to the exclusive jurisdiction of the courts in Pune, Maharashtra, India. For all enquiries, contact us at dev.jekon@gmail.com.