Privacy Policy

1. Data we collect

We collect only what's needed to provide the service:

• • Account info: email address and password (or Google/Apple ID).
• • Business profile: business name, industry, sales channels.
• • Financial entries: revenue and expense records you choose to log.
• • Connected Shopify store data: when you link a Shopify store, we read order data (order number, totals, financial and fulfillment status, line items, and the customer's name attached to each order) and the access token Shopify issues us. We never read customer email, phone, address, payment details, or any Shopify resource outside of orders.
• • AI assistant messages: the questions you type into the in-app financial assistant. These are sent to Google's Gemini API to generate a response; under their enterprise terms your data is not used to train AI models.

2. How we use it

We use your data exclusively to operate Hesabaty Business: storing your manual entries, syncing your Shopify orders, calculating profit and loss, generating reports, sending reminders for unpaid expenses, and answering your questions through the AI assistant. We never use your financial data for advertising, sell it to third parties, or train AI models on it.

3. Third-party providers

We rely on a small number of providers to run the service. Each is a data processor acting on our behalf:

• • Supabase, Inc. — database, authentication, and serverless functions for all data described in section 1.
• • Google LLC (Gemini API) — generates AI assistant responses. Only the chat messages you type are sent.
• • Apple Inc. and Google LLC (push services) — deliver push notifications when you enable them. Only your device's push token is shared.
• • Shopify Inc. — source of the order data we sync from your store. We only read; we never send your data back to Shopify.

4. Where it lives & how long we keep it

Your data is stored on Supabase infrastructure with row-level security. Each business is logically isolated — no other user can query your records, ever. Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Authentication tokens live in your device's secure keychain, never in plain storage. Some processors (Supabase, Google) operate servers outside Egypt, in the European Union and the United States. We retain your data while your account is active. When you disconnect Shopify, we deactivate the integration and revoke our access token immediately. When you delete your account, every byte we hold about you is permanently removed within 24 hours. When Shopify notifies us of a shop data erasure request after a merchant uninstalls, we delete all corresponding order data within 48 hours. When Shopify notifies us of a customer data erasure request, we redact the affected customer's data within 30 days.

5. Your rights

Under Egypt's Personal Data Protection Law (Law No. 151 of 2020) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:

• • Access the personal data we hold about you.
• • Correct inaccurate or outdated data.
• • Delete your data — the right to be forgotten.
• • Export your data in a portable format.
• • Object to certain types of processing.
• • Withdraw consent at any time and lodge a complaint with Egypt's Data Protection Center or your local supervisory authority.

6. Contact us

Questions about privacy, or to exercise any of your rights? Email us at abdukhaznety@gmail.com. If you are an end-customer of a merchant who uses Hesabaty Business, you can contact the merchant directly or email us and we will coordinate with the merchant. We respond within 30 days.