Privacy Policy

This policy explains how Kashir ("we", "us") handles data when you use our website makhzan.app, the store management panel, our mobile app on Google Play, and the online storefronts merchants create on our platform (together, the "Service"). By using the Service, you agree to this policy.

1. Our role

We are responsible for your account and business profile data. For the data a merchant enters about their own customers, suppliers and staff, the merchant is responsible, and we process it on their behalf only to provide the Service to them. If you are a customer of a shop that uses Kashir and want to access or delete your data, contact that shop directly; we will help them fulfil your request.

2. Data we collect

a. Account and business information

• Name, email address, phone number, and password (stored as a one-way hash that can't be reversed).
• Business name and type, logo, branches, tax number, currency, time zone and language.
• Staff accounts you add (name, email, phone, role and permissions).

b. Business data you enter

• Products, prices, stock and stock movements, sales, invoices and returns, purchases, expenses, and cashier shifts.
• Your customers' and suppliers' details (such as name, phone number, balances, payments and loyalty points), plus appointments and tables if you use them.
• Product photos you choose to upload.

c. Online store orders

When someone places an order on a merchant's online store, we collect what the buyer enters: name, phone number, email (optional), delivery address and order notes, and pass it to that merchant to fulfil the order.

d. Device and usage data

• IP address, browser or device type and name, app version, and sign-in times and attempts.
• An activity log inside your account (for example, who edited a product or cancelled an invoice, and when) for security and auditing.
• Technical error logs, used to keep the Service stable.
• A push notification token (Firebase Cloud Messaging) to deliver alerts to your device.

e. Subscription and payment data

Subscriptions bought through Google Play are paid entirely through Google. We only receive the purchase identifier, subscription status and expiry date to verify your subscription. We never receive or store your card details.

f. Mobile app permissions

Depending on the features you use, the app may ask for access to the camera (to scan barcodes or photograph products) and to notifications. We only use a permission when you use the feature that needs it, and you can deny or revoke it at any time in your device settings.

3. How we use data

• To provide and operate the Service: checkout, inventory, invoices, reports, and syncing across your devices and branches.
• To manage your subscription and free trial and verify purchases.
• To protect accounts: detecting and blocking repeated sign-in attempts and reviewing suspicious activity.
• To send the notifications and messages you turn on: sales and stock alerts, emails, and WhatsApp messages to your customers if you enable them.
• To answer support requests and meet our legal obligations.

We do not sell or rent your data to anyone, we don't use your customers' data to market ourselves, and we don't show ads in the Service.

4. Sharing

We share data only with the service providers we need to run the Service, and only as much as they need:

• Hosting: our hosting provider's servers, which store the database, files and backups.
• Google Firebase Cloud Messaging: to deliver push notifications to your devices.
• Google Play: to process in-app subscriptions and payments.
• Email delivery: to send welcome emails, alerts and daily summaries.
• WhatsApp messaging provider (such as Twilio): only if a merchant turns on WhatsApp messages; it receives the recipient's number and the message text.

We may also disclose data when required by law, to protect our rights or users' safety, or as part of a transfer of the Service, in which case the new owner must honour this policy.

5. Security

• All connections are encrypted over HTTPS, and passwords are stored as one-way hashes.
• Each business's data is isolated from every other business and is only accessible to that business's users, according to their permissions.
• Repeated failed sign-ins are blocked automatically, and you can sign out of all devices at once.
• Daily backups are kept with restricted access.

No method of transmission or storage is 100% secure, but we take reasonable steps to protect your data and will notify you if a breach affects you.

6. Retention

• Account and business data: kept while your account is active, and deleted within 30 days of a confirmed deletion request.
• Activity log: deleted automatically after 90 days.
• Sign-in attempt records: deleted automatically after 30 days.
• Backups: we keep only the latest 7 daily backups, which rotate automatically, so deleted data disappears from them within about 7 days.
• We may keep invoices and payment records for your subscription only for as long as the law requires.

7. Your rights

• Access and correction: edit your account and business details from Settings at any time.
• Export: export products, sales and reports to Excel or PDF.
• Deletion: request deletion of your account and all of its data (see the next section).
• Notifications: turn them off in the app or your device settings.

8. Deleting your account

You can ask us to delete your account and data at any time, without installing the app, through the account deletion request page or by emailing support@makhzan.app. We first verify that you own the account, then delete it and the business data linked to it within 30 days. If you are a staff member of a shop, the shop owner can also delete your account directly from user management.

Note: deleting your account does not cancel a Google Play subscription. Cancel it in the Google Play app under Subscriptions so it doesn't renew.

9. Cookies

We only use cookies that are needed for the website to work, such as keeping you signed in and protecting forms against forged requests. We don't use advertising cookies or third-party analytics.

10. Children

The Service is meant for business owners and their staff. It is not directed at children under 18, and we don't knowingly collect their data. If you learn that a child has created an account, contact us and we will delete it.

11. International transfers

Your data may be processed and stored on servers outside your country by the service providers listed above. We protect it according to this policy wherever it is processed.

12. Changes to this policy

We may update this policy from time to time and will change the "Last updated" date at the top. If a change is significant, we will let you know by email or in the app before it takes effect.

13. Contact us

For any privacy question, email support@makhzan.app and we'll get back to you as soon as we can.