Privacy Policy
Last updated: 5 November 2026
Project Khata is a construction-expense ledger. This page explains what information the service handles, why, which outside services take part, and how long each kind of information is kept. It describes what the software does today.
1. Who we are and how to reach us
Project Khata is operated by Bilal Tahir.
- Email: [email protected], for support, questions and data-deletion requests.
2. Whose information this is
Most of the information in Project Khata is entered by our customers, the companies and individuals who run construction sites (the "account holder"). The account holder decides what to record about their own projects, contractors, suppliers and payments. We process that information to run the service for them. Where this page says "you", it means whoever is using the service or whose details have been recorded in it.
3. What we collect and handle
Account and sign-in
- Full name, mobile number and (optionally) email address of each person who signs in, their role on each project (Project Manager, Manager, Supervisor or Investor) and the language and theme they chose.
- A password, stored only as a salted hash (PBKDF2-SHA256), never as readable text. Sign-in uses a token kept in your browser.
- When you start a free trial: the name, mobile number, email and password you type. If a bot-check is switched on, Cloudflare Turnstile is used on that form.
- The network address of a request, which the service uses for security and to limit repeated sign-in attempts.
Business records entered by the account holder
- Projects, jobs, budgets, contracts, payment schedules, tasks, purchases, quotations and the Final Ledger of payments: amounts, dates, descriptions, who was paid and who entered the record.
- Details of contractors and suppliers, as the account holder chooses to enter them: name, phone and WhatsApp number, address, CNIC, a photograph, notes and their trade. They may be people who have never used Project Khata themselves.
- Files the account holder uploads, such as receipt photos or PDFs, and photos of contractors.
- Records of who did what and when (audit information) and of the actions people take in the service.
- The mobile number and the content of messages sent to our business WhatsApp number, and delivery status reports from WhatsApp for messages we send.
- When a contractor is asked to confirm a payment: their Yes or No answer, the time, the number we wrote to and the message identifiers. Their answer is recorded beside the payment, not inside it.
- Consent records (who confirmed that a person agreed to receive messages, when, and from where) and opt-out records (when a number replied STOP).
- For the optional assistant: the question or entry sent by chat, drafts created from it with each change and the typed approval, a short conversation memory (the last question and a pending numbered choice), and usage counts (number of messages, amount of audio, an estimated cost) used to apply each account's message allowance.
On your device
- The app stores your sign-in token and your language, theme and workspace choices in your browser's local storage. We found no advertising or analytics tracking in the app, and the app sets no cookies of its own. Cloudflare, which sits in front of our service, may set its own technical cookies.
- This public website loads a font from Google Fonts, so your browser contacts Google when you open it.
4. Why we use it
- To run the service: sign you in, apply your role's permissions, record payments in the ledger, show budgets and balances, and keep a permanent record of entries.
- To send the messages the account holder asked for: payment confirmation requests to contractors, scheduled summaries and reminders to project staff, and replies from the assistant.
- To keep the service secure and fair: limit repeated attempts, stop unauthorised access, apply allowances and investigate faults.
- To answer your questions and requests sent to support.
We do not use the information to show advertising, and we do not sell personal information.
5. WhatsApp messages
- Who is messaged. A contractor or supplier is sent a message only after the person recording the payment confirms that this person agreed to receive WhatsApp messages from us. That confirmation is stored with who gave it, when and where. Project staff are messaged at the numbers they have verified in the service.
- What is sent. A payment confirmation request names the payee, the amount, what it was for, the date and the company's name, and offers the buttons "Yes, received" and "No, not received". Summaries and reminders list payments due or overdue for a project.
- STOP. Anyone can reply STOP to stop all our messages to their number. It takes effect immediately and applies across every account; replying START allows messages again.
- Meta. Messages travel through WhatsApp, which is provided by Meta. Meta handles the numbers and messages under its own terms and privacy policy.
- Who may use the chat assistant. Only project staff whose number is verified. An unknown number is ignored.
6. Voice notes and the assistant
These optional features are switched on per account. When they are off, no information goes to the providers below for them.
- Voice notes. When project staff send a voice note, our server fetches the audio from WhatsApp, converts it and sends it to OpenAI to turn it into text. This happens in the server's memory: Project Khata does not save the audio, and does not log the audio or the transcript. What OpenAI does with audio it receives is governed by OpenAI's own terms; we have not verified its retention and make no promise about it.
- Understanding messages. A free rule-based reader tries first. Only if it cannot read a message, and only if the feature is on, the text of that message is sent to Anthropic together with today's date, the names of your projects (up to 20) and the kind of your previous question, so it can classify the message. It is told never to answer or invent anything, and everything it proposes is checked by our server against your own message.
- Nothing is saved without you. An entry made by chat becomes a draft, shown back to you in plain English. It is saved only when you type YES to that exact version. A voice note can never approve it.
7. Who else handles information
| Provider | Used for | Information involved |
|---|---|---|
| Meta (WhatsApp Cloud API) | Sending and receiving WhatsApp messages | Phone numbers, message content, delivery and read status |
| OpenAI | Turning voice notes into text (optional) | The audio of a voice note, sent for transcription |
| Anthropic | Classifying a message the rule reader could not read (optional) | That message's text, today's date, project names (up to 20), the kind of the previous question |
| DigitalOcean | Hosting of the application server and database | All information stored in the service |
| Cloudflare | Network protection and delivery, bot-check on trial sign-up, forwarding of the support email address | Web requests to the service; emails sent to support |
| Google Fonts | A font on this public website | Your browser's request when the page loads |
Provider policies: WhatsApp, OpenAI, Anthropic.
Inside an account, information is visible to the people the account holder gives access to, according to their role: for example a Supervisor sees only the pay screen and an Investor sees totals only. We may also disclose information where the law requires it.
8. How long we keep it
These are the periods the software is built to apply. The clean-up runs automatically about once an hour while WhatsApp is switched on, so a period may be exceeded by up to roughly that long.
| Information | What happens |
|---|---|
| Ledger entries, contracts, purchases and other business records | Kept while the account exists. Ledger entries are never edited or deleted, by design; a mistake is corrected by a reversal entry and both stay visible. |
| Receipt photos and files | Kept as evidence. Removing one in the app hides it; the file itself is kept. |
| Audio of voice notes | Not stored by Project Khata (handled in memory only). See section 6 about OpenAI. |
| Text of questions, typed messages and voice-note records received by WhatsApp | The stored content is removed 30 days after we finished processing it. The record that a message arrived (its identifier, type and outcome) stays, so a message delivered twice is not acted on twice. One exception: a typed message that quotes one of our payment confirmation requests that is not yet resolved is kept until that request is resolved, then cleared. |
| A contractor's answer to a payment confirmation | Once the answer is recorded, the stored text of the reply and of the delivery reports is removed. The confirmation itself (status, answer, times, number, message identifiers) is kept as payment evidence. A request never expires and a late reply is still matched. |
| A LINK code sent to verify a phone number | The code is removed from the stored message once it has been handled. |
| Chat entries that were cancelled or failed | The wording is removed 30 days after the draft was last changed. The row stays. |
| Chat entries still open | Kept until they are confirmed or cancelled. They do not expire. |
| Chat entries that were saved | Kept with every revision, so there is a record of who approved what and when. |
| Conversation memory (the last question, a pending numbered choice) | Cleared 2 days after the last message. |
| Consent and STOP records | Kept, as proof of consent and of opt-out. |
| Usage counts and audit records | Kept. |
| Backups | A backup of the database and of uploaded files is taken once a day, and the last seven days are kept on the server. Information removed from the live service therefore remains in those backups for up to about seven days. |
| Server logs | Operational logs are kept for troubleshooting and security. Web server logs, which include network addresses and the addresses requested, are rotated daily and about 14 days are kept. Application logs are kept until the server's log storage limit is reached, so there is no fixed number of days. We do not log voice audio or its transcript. |
The clean-up above does not remove saved entries, financial records, receipts, usage records or audit records. A free trial that has ended is locked; its information is not deleted at that moment.
9. Security
- The service is served over HTTPS.
- Passwords are stored only as salted hashes.
- Each person sees only what their role allows. Accounts are separated from each other by rules in the application and in the database itself.
- Receipts are stored privately and shown only to signed-in people with access to that project.
- Ledger entries cannot be altered once written.
- Accounts and access can be suspended immediately.
No online service can promise perfect security, and we make no claim of any security certification.
10. Your choices
- Stop WhatsApp messages: reply STOP to any of our messages.
- Look at or correct your details: ask the account holder who set up your access, or contact us.
- Export: an account holder can export the Final Ledger to a spreadsheet at any time.
- Ask for deletion: see how to request data deletion. Some records cannot be removed, and that page says which and why.
11. Changes to this policy
When this page changes in a way that matters, we will update the date and tell account holders.
12. Questions
Write to [email protected].