Privacy Policy

1. Data we collect

Account data: your email address or phone number (for sign-in and one-time passcodes), your display name, and a password handled exclusively by Firebase Authentication (we never store your password).

Business data you enter: business profile, products, customers, suppliers, quotes, orders, invoices, payments, expenses, stock movements, employees and roles. This data belongs to you and is stored in a per-tenant isolated database schema (row-level security).

Operational logs: sign-in events, audit entries for record changes, rate-limit counters (short-lived), and error logs needed for security and reliability.

AI assistant content: questions you send to the in-app AI assistant are forwarded to the AI provider to generate the answer. We do not persist chat messages; only the provider and model name are logged for auditing.

2. Why we process data (legal bases)

Performance of the contract: hosting your workspace, generating documents, processing purchases and subscriptions. Consent: optional features such as the AI assistant and marketing communications. Legitimate interests: security, fraud prevention, abuse detection, and service analytics. Legal obligation: tax and accounting records you create through the platform.

3. Cookies and local storage

We use strictly necessary cookies only: an httpOnly session cookie (authentication), a workspace-selection cookie, and a language-preference cookie. We do not set cross-site advertising cookies ourselves. On public marketing pages, Google AdSense may show ads and use cookies in accordance with Google’s policies; you can opt out of personalised ads via Google’s Ads Settings (google.com/settings/ads).

4. Service providers (sub-processors)

Vercel Inc. — application hosting and CDN. Neon — managed PostgreSQL database. Google Firebase — authentication, phone/Google sign-in and reCAPTCHA Enterprise abuse protection. PayPal — payment processing for subscriptions; your card or PayPal credentials never pass through our servers. Brevo — transactional email delivery of one-time passcodes. Groq, Inc. and Google (Gemini) — AI answer generation for the in-app assistant. Each provider processes only the data necessary for its function, under its own privacy terms.

5. Data retention and deletion

Your data is retained while your account is active. You can export everything at any time (Settings → Export) and delete your account or business in-app; deletion removes your records immediately and cascades to related data. Rate-limit and security counters expire automatically within hours. Backups, where they exist, roll off on their scheduled cycle.

6. Your rights

You may request access, correction, export or erasure of your personal data, and you may object to optional processing (such as the AI assistant — simply stop using it). Requests can be made in-app or by emailing ahmedbecetti41@gmail.com. We respond within 30 days. If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.

7. Security

All traffic is encrypted with TLS/HTTPS. Passwords are held by Firebase Authentication, never in our database. Tenant isolation is enforced at the database layer (PostgreSQL row-level security). Secrets are stored server-side only and are never shipped to browsers. Access to production data is limited to the platform owner.

8. Children

The platform is intended for business users aged 16 and over. We do not knowingly collect data from children.

9. Changes and contact

We may update this policy; the date at the top reflects the latest revision. Material changes will be announced on the landing page. Questions: ahmedbecetti41@gmail.com.