Privacy Policy

1. Who we are and what this covers

NoExcel is a digital invoicing and sales platform operated from Lahore, Pakistan. This policy covers the NoExcel website and the NoExcel application.

It does not cover websites we link to, such as those of FBR, or any third-party service you choose to connect to. Those have their own policies and we do not control them.

2. Our two different roles

For information about you and your users — the details you give when registering, and the records of how you use the Platform — we decide why and how it is processed, and we are responsible for it.

For the business data you enter — your customers, suppliers, products, orders, invoices and payments — we act on your instructions. You decide what goes in, who it relates to and how long it stays. If that data includes personal information about your customers, you are responsible for having a lawful basis to collect it and for telling those people how it is used, including that invoices are reported to FBR.

3. What we collect

We collect only what we need to run the Service and keep it secure.

This includes:

• Registration details — your name, email address, phone number and company name.
• Sign-in information — a securely hashed password, or, if you sign in with Google, the basic profile information Google shares with us. We never receive your Google password.
• Company and tax configuration — your business details, registration numbers, addresses, branches, bank accounts and the FBR credentials you supply.
• Business records you enter — customers, suppliers, products, stock, orders, invoices and payments, including any documents you attach to them.
• Activity records — a log of significant actions taken in your account, showing which user made a change and when, which exists so that you have an audit trail.
• Technical information — IP address, browser and device type, pages visited and timestamps, collected automatically when you use the Platform.
• Correspondence — messages you send through our contact form, by email or on WhatsApp, and our replies.

4. How we use it

We use the information to:

• Provide the Service, including creating your invoices and transmitting them to FBR through PRAL.
• Authenticate users, apply role-based permissions, and keep your company data separate from every other company on the Platform.
• Send you service messages such as password resets, security notices, billing correspondence and material changes to these policies.
• Provide support when you contact us, and investigate faults you report.
• Detect, investigate and prevent abuse, fraud and unauthorised access, and keep the Platform secure.
• Understand which parts of the Platform are used, so we can improve them, and meet our own legal obligations.

5. What we send to FBR and PRAL

When you issue an invoice through NoExcel, we transmit to FBR through PRAL:

FBR and PRAL handle that information under their own rules and retention periods, which we do not control and cannot change on your behalf. Once an invoice has been accepted we cannot withdraw it from their systems. If your buyer is an individual rather than a business, the registration or identity number on the invoice is personal data about them, and you should make sure they know it is reported.

• Your seller registration details, business name, address and province.
• Your buyer name, registration or identity number, address and registration type.
• The invoice number, date, document type and transaction type.
• Each line item, with its description, HS Code, quantity, unit of measure, value, tax rate and tax amounts, including any SRO reference.

6. Other parties who process data for us

Besides FBR and PRAL, we rely on a small number of providers, each of which may only act on our instructions:

• Hosting and infrastructure — the servers and database on which the Platform runs, and where backups are held.
• Google — if you choose to sign in with a Google account, and reCAPTCHA, which we use on our public forms to block automated abuse.
• Email delivery — for password resets and service messages.
• Professional advisers — accountants or lawyers, only where necessary and only in confidence.

7. Cookies

We use cookies that are necessary for the Platform to work: keeping you signed in, remembering your language, and protecting forms against cross-site request forgery. Without these the Service cannot function.

Google reCAPTCHA sets its own cookies on pages carrying our public forms, in order to tell people from bots. You can block or delete cookies in your browser, but if you block the necessary ones you will not be able to sign in.

8. Where your data is held

Your data is held on our servers and in encrypted backups. Traffic between your browser and the Platform is encrypted in transit using TLS.

Some of the providers listed in section 6, such as Google, operate internationally, which means limited categories of data may be processed outside Pakistan. Where that happens we take reasonable steps to ensure the provider offers an appropriate level of protection. Your invoice data is transmitted to FBR and PRAL within Pakistan.

9. How we protect it

We take reasonable technical and organisational measures to protect your information, including:

No system can be guaranteed completely secure. Please use a strong, unique password, give each person their own login rather than sharing one, and remove users promptly when they leave your business.

• Encryption of traffic in transit, and password storage using a one-way hash so that we never hold your password.
• Strict separation between company accounts, enforced on every request so that one customer cannot reach another customer data.
• Role-based permissions, so users only reach what their role allows, and an activity log recording significant changes.
• Scheduled database backups, and restricted administrative access to production systems.

10. How long we keep it

We keep your data for as long as your account is active. If your subscription ends, or you close your account, we retain your data for 30 days so that you can request an export, and then delete it.

We may keep limited information for longer where the law requires it, or where we need it to resolve a dispute or enforce our agreement. Backups are overwritten on a rolling cycle, so a copy of deleted data may persist in a backup for a short period after deletion from the live system.

Data already transmitted to FBR is held by FBR under its own retention rules and is not deleted when you close your NoExcel account.

11. Your rights

In relation to personal information we hold about you, you may ask us to:

• Give you a copy of the personal information we hold about you.
• Correct it where it is inaccurate or incomplete — most of it you can also correct yourself in your account settings.
• Delete it, subject to information we must keep by law or that has already been filed with FBR.
• Export your business records in a machine-readable format, which you can also do yourself at any time from the Platform.
• Object to or restrict particular processing, such as analytics, where you have grounds to do so.

12. If something goes wrong

If we become aware of a security incident that affects your personal information and is likely to put you at risk, we will tell you without undue delay. We will explain what happened, what information was involved, what we are doing about it, and what we suggest you do.

13. Children

NoExcel is a product for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy to reflect changes in the Service, in the providers we use, or in the law. The date at the top of this page always shows the most recent revision, and where a change is material we will tell you by email or in the application rather than relying on you to notice it.