Privacy Policy

Mantra Decora Nepal ("we", "our", or "us") operates the Mantra POS mobile application and website (collectively, the "Service"). This Privacy Policy explains how we handle information when you use our Service.

By using Mantra POS, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

The Service is a business management tool (POS and inventory system). We collect only what is necessary to operate the Service:

• Account credentials — username and hashed password used to authenticate you.
• Business data you enter — sales records, inventory, customers, suppliers, and expenses that you input into the system.
• Session cookies — temporary browser/app cookies that keep you logged in during your session.
• Uploaded files — receipts, payment proofs, or company logos you choose to upload.

• To authenticate you and provide access to your company's data.
• To store and display the business records you create.
• To send account-related emails (e.g. password reset OTP).
• To maintain the security and performance of the Service.

Your data is stored in an isolated MySQL database on our secure web server. Each business account (tenant) has its own separate database — your data is never mixed with another company's data.

• Password hashing — passwords are stored as strong bcrypt cryptographic hashes; never in plaintext.
• HTTPS encryption — all communication between the app and our server is encrypted via TLS/HTTPS.
• Tenant isolation — each company's data is stored in a separate database schema.

We retain your data for as long as your account is active. If you close your account, your data will be deleted within 30 days upon written request.

Backups may persist for up to 90 days as part of our disaster-recovery procedures, after which they are purged automatically.

The Service uses the following third-party services:

• Google Fonts — to display the Inter typeface. Only font files are loaded; no personal data is sent.
• SMTP email service — to deliver password reset emails using a server-side mailer. Your email address is not shared with advertising networks.

The Service is intended for business use by adults (18+). We do not knowingly collect information from children under 13. If we become aware that a child has provided us with personal information, we will delete it promptly.

You may contact us at any time to:

• Request a copy of your personal data.
• Request correction of inaccurate or incomplete data.
• Request deletion of your account and associated data.