GenesisCipher Labs

Pact Privacy Policy

Last updated: August 3, 2026

GenesisCipher Labs (“we”, “us”) builds Pact, an invoicing and payment-tracking app for Indian creators and freelancers — it turns a brand-deal email into a GST-compliant invoice and tracks when you get paid. Privacy is the architecture, not a footnote: Pact runs entirely on your device and we do not operate any server that receives your data. This policy explains exactly what is processed, where it goes, and the rights you have under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

The short version

• Everything you put into Pact — your business profile (including PAN, GSTIN, bank account, UPI ID, address, logo and signature), your brands, deals, invoices, and payment records — is stored on your device only.
• We, GenesisCipher Labs, never receive that data. We run no servers, no analytics, no ad networks, and no trackers, and we do not sell or share personal data. Pact contains zero third-party SDKs.
• Deal details are extracted from pasted or shared text on your device, using Apple Intelligence (the on-device Foundation Models on supported devices) or an offline text parser. Your email text is never sent to us or to any cloud AI service.
• The only thing that leaves your device is your subscription purchase, handled directly by Apple through StoreKit. We never see your payment details.
• Payment reminders are scheduled locally on your device — there is no push server.
• You can view, edit, and delete any profile, brand, deal, invoice, or payment at any time inside the app.

Who is the data controller

GenesisCipher Labs is the controller for the limited processing described here. Because effectively all processing happens on your device, your device — and Apple, acting as a processor for subscriptions — does the work. Contact for privacy questions, data-rights requests, and grievances (including the grievance contact required under the DPDP Act): genesiscipherlabs@gmail.com.

What we process, why, and the legal basis

Data	Where it is processed	Why	Lawful basis (DPDP Act)
Your business profile — legal name, PAN, GSTIN, registered address, email, phone, bank account name/number/IFSC, UPI ID, business logo and signature image	On your device	To render legally-formatted GST invoices that identify you as the supplier	The specified purpose you voluntarily provided the data for
Brand / client records — name, GSTIN, billing address, place-of-supply state, contact name, email, phone, notes	On your device	To address invoices and determine the correct GST treatment (CGST+SGST, IGST, or export)	The specified purpose you voluntarily provided the data for
Deal details — title, deliverables, amount, currency, payment terms, and the original pasted/shared text	On your device	To create the deal, generate the invoice, and let you re-extract if needed	Your consent when you paste or share the text
Invoices and payment records — invoice documents, tax breakup, supplier/brand snapshots, due dates, amounts, and paid/overdue status	On your device	To track who owes you what and when, and to keep each invoice reproducible	The specified purpose you voluntarily provided the data for
Local notification identifiers	On your device	To schedule and cancel payment reminders	Your consent via the iOS notification permission

We do not profile you for advertising and we do not make solely-automated decisions producing legal effects. Extraction confidence scores are hints shown to you for your own review; you confirm every invoice.

On-device AI

Pact can read a pasted or shared brand-deal email and pre-fill the deal for you. On supported devices this uses Apple Intelligence (Apple’s on-device Foundation Models); on other devices it uses a built-in offline text parser. In both cases the text is processed entirely on your device and is never transmitted to us or to any third-party or cloud AI provider. Draft follow-up emails are generated the same way, and you edit and send them yourself — Pact never sends email on your behalf.

How data enters Pact

• Pasting or sharing text. You can paste a deal email from the clipboard, or send it to Pact from another app (such as Mail or Gmail) using the iOS/macOS Share Sheet. Text shared to Pact is handed to the app through a private App Group container on your device (group.com.genesiscipherlabs.Pact) and is read and cleared by the app — it is never uploaded. A shared web link is stored only as text; Pact does not fetch it.
• Typing it in. You enter your profile and can edit any extracted field manually.

How data leaves Pact — always because you sent it

Pact never transmits anything by itself. Everything below happens only when you tap something, and in each case you choose the destination:

• Sharing an invoice. You send the invoice PDF through the standard Share Sheet — to mail, a messaging app, Files, or by dragging it out on iPad and Mac. Where it goes and who receives it is entirely your choice, and it is then governed by whichever app or service you chose.
• Exporting your book. Export all invoices builds a zip — every invoice PDF, a CSV ledger, and a GST/TDS summary — and hands it to that same Share Sheet. It is assembled on your device and goes nowhere until you send it.
• Folder backup. If you nominate a backup folder, Pact writes a dated zip of that same pack into it, at most once a day. Pact only ever writes a file. If the folder you choose sits inside iCloud Drive, Dropbox, Google Drive or a similar service, that service will sync the file under its own terms and privacy policy — which is usually the point of choosing such a folder, but is worth choosing deliberately. Pick a purely local folder if you would rather nothing sync.
• Payment and follow-up links. A rupee invoice can carry a UPI QR code, and a follow-up can be sent over WhatsApp. Both are ordinary links built on your device from details you entered; opening one hands off to that app, which is then governed by its own terms. Pact contacts no payment gateway, takes no commission, and has no part in the payment itself.

Who else receives data (processors and third parties)

• Apple Inc. processes your subscription purchase and entitlement through StoreKit, and stores invoice PDFs and the app database within the standard on-device app sandbox. If you have iCloud Backup enabled, your device backup — which may include Pact’s data — is encrypted and stored by Apple under Apple’s terms. We never receive any of this.
• No one else. There are no advertising SDKs, no analytics SDKs, no crash-reporting SDKs, and no data brokers. Pact makes no network requests other than Apple’s StoreKit.

Retention

Your data stays on your device until you delete it (per record, in-app) or uninstall the app. We hold nothing to retain or delete on a server, because we hold nothing.

Your rights

Under the DPDP Act, you can access, correct, update, erase, and grieve the processing of your personal data, and withdraw consent at any time. Because your data never leaves your device, you are in direct control:

• View / edit / delete: open the relevant deal, invoice, brand, or your profile in the app and edit or delete it. Uninstalling the app removes all of it.
• Notifications: revoke or limit permission in iOS/macOS Settings → Notifications.
• Grievance / complaints: email genesiscipherlabs@gmail.com — this is the grievance contact under the DPDP Act. You also have the right to lodge a complaint with the Data Protection Board of India once it is operational.

Children

Pact is a professional invoicing tool and is not directed to children. We do not knowingly process the personal data of a child. Because all data is on-device, you can clear it directly at any time.

Security

Data on your device is protected by operating-system app sandboxing and device encryption. Because we hold no central database of your personal data, there is no company server for an attacker to breach.

Changes

We will update this page when our practices change and revise the “Last updated” date.

Contact

GenesisCipher Labs — genesiscipherlabs@gmail.com

This policy describes Pact’s actual on-device behaviour. It is provided in good faith and should be reviewed by qualified counsel before publication in your specific jurisdiction.

This site is open source. Improve this page.