$ cat privacy.txt
Privacy policy
What we keep, where it is, how long we keep it and who can see it. The short version: your business's data is used to run your system and for nothing else.
1. Who is responsible
AppBay, Palestine (info@appbay.dev). When your business records its own customers - a name and phone number on a sale, for example - your business decides what to record, and we keep it on your behalf.
2. What is kept
- What your business enters: products, prices, stock, sales, payments, suppliers, expenses, and any customers you add.
- Your staff: names, usernames and roles. Passwords are stored only in a scrambled form that cannot be turned back into the password - nobody, including us, can read them.
- What keeps the system safe and working: which till made each sale, a log of who did what (a sale cancelled, a price changed), server logs that include the internet address a request came from, and error reports (the error, the screen, the shop and the username) so we can fix faults quickly.
3. On your own devices
So that a till can keep selling with no internet, it keeps a copy of the products and recent sales in the browser, and any sales still waiting to upload. If you tick "Remember me", the sign-in is kept on that device. To allow signing in with no internet, a till keeps a one-way check of the password, never the password itself. Clearing the browser's data for the site removes them. Sales still waiting to upload are kept through a sign-out on purpose, so a sale is never lost.
4. Where it is
On our own servers in Germany, inside the European Union, with nightly backups to separate storage, also in Germany. Every connection is encrypted (HTTPS). Each business has its own separate database.
5. Who can see it
- Your staff, according to the roles you give them.
- AppBay's administrators, only to run, fix, back up or restore the system, or when you ask us to.
- Nobody else. We do not sell data, show advertising or track people across sites.
- Where a system sends text messages or email for you - appointment reminders, for example - the phone number or address and the message go to the sending provider for that purpose only.
6. This website
appbay.dev counts visits with Umami, which runs on our own server, sets no cookies and does not identify you.
7. How long
For as long as your subscription runs. When it ends, we keep your data for 90 days so you can ask for a copy, then delete it; the last backup copies expire within a further 30 days.
8. Your choices
A business can ask us for a copy of its data, or for it to be corrected or deleted, at info@appbay.dev. If you are a customer of one of the businesses we serve, please ask that business first; we will help them answer you.
9. Changes
If this policy changes, the date at the top changes too, and businesses we serve are told before anything important changes.