This is the original English version. Translations are provided for convenience; if they differ, the English version prevails.
1. Who is responsible for which data #
We act in two roles:
- Controller: for the data of people who sign up for or manage an account (owners, administrators and users), billing and subscription data, website visitors and people who contact us. We decide why and how that data is used.
- Processor: for the business data that you and your team enter or collect in your account, such as your customers, suppliers, staff, orders and files. You are the controller of that data and we process it only on your instructions to provide the Service.
If you are a customer of a business that uses Inventorious (for example you bought from an online store, or you are an employee of a business), the business is responsible for your data and you should contact them first to use your rights. We will help them respond.
2. What we collect #
Account and sign-in data: name, email address, password (stored only as a salted hash), phone and address if you add them, language, time zone, the date you accepted our terms, and, if you enable it, a two-factor authentication secret (stored encrypted) and hashed backup codes. If you sign in with Google or Apple, we receive your name and email from them.
Session and security data: sessions record your IP address and browser details (user agent), API access tokens and their device identifiers, and sign-in activity needed to protect your account.
Business data you enter: company settings, products, stock and warehouses, customers and suppliers (name, email, phone, address, tax number), orders, invoices, payments, expenses, and files such as logos and product images.
Staff (HRM) data you enter: staff profiles, departments and shifts, attendance with clock-in and clock-out times and the IP addresses they were recorded from, leave, holidays, payroll, salaries and awards. This is the business's data about its own staff.
Online store data: when a shopper creates an account or orders on a storefront, the business receives, and we process for it, their name, email, phone, password hash, delivery and billing addresses and order history.
Billing data: plan, licence dates, payment transactions, invoice details and tax number, and Stripe customer and subscription identifiers. Card details are collected and held by Stripe, not by us.
Messages: what you send through our contact form (name, email, message) and our replies, and account deletion reasons if you give one.
Technical data: server logs (IP address, requests, errors), and error and performance reports described below. We do not use advertising or analytics trackers on our marketing site. The login, sign-up, password reset and contact forms use Google reCAPTCHA, which receives your IP address and browser data when those forms load and are submitted (see below).
3. Why we use data and our legal bases #
To provide and secure the Service, sign you in and keep your business running (performance of our contract with you).
To bill you, keep tax and accounting records and meet legal duties (contract and legal obligation).
To send service emails such as password resets, invitations, invoices, licence and payment notices, and to answer your requests (contract and legitimate interests).
To detect abuse and errors, keep the Service stable and improve it (legitimate interests in running a safe, reliable service).
To protect the login, sign-up, password reset and contact forms from bots and automated abuse with Google reCAPTCHA (legitimate interests in keeping accounts and the Service secure).
To send you optional product news, where you ask for it or the law allows. You can unsubscribe at any time (consent or legitimate interests).
We do not sell personal data, and we do not use your business data for advertising.
5. International transfers #
Our providers may process data in countries other than where you live, including outside the UAE and the European Economic Area. Where the law requires, we rely on safeguards such as standard contractual clauses, adequacy decisions or your consent, and we choose providers that commit to protecting personal data.
6. How long we keep data #
We keep account and business data while your account is active. After your subscription ends or your account is closed we keep it for up to 90 days, then delete or anonymise it.
We keep billing, invoice and tax records for as long as the law requires, which is at least 5 years in the UAE. Backups are overwritten on a rolling schedule, so deleted data may remain in them for a limited time.
Businesses decide how long to keep their own customer, staff and order records and can delete them in the app. Deleting a user login removes that person's sign-in data from the Service.
7. How we protect data #
Connections use HTTPS. Passwords are hashed, two-factor authentication is available, sensitive secrets are encrypted, and sensitive actions such as deleting an account need password re-entry.
Every business account is kept separate and access inside it is controlled by roles and permissions. Staff can see only what their role allows, and permission changes are recorded.
Access to our systems is limited to those who need it, we monitor for errors and abuse, and we keep backups of the database. No system is perfectly secure; please use a strong password and two-factor authentication.
8. Data breaches #
If we become aware of a personal data breach affecting data we process, we will notify the affected businesses without undue delay, with the information they need to meet their own notification duties. Where we are the controller, we will notify regulators and individuals as the law requires, such as the UAE Data Office and the competent authority in the European Union.
9. Your rights #
Depending on where you live, you may have the right to access your data, correct it, have it deleted, restrict or object to its use, receive it in a portable format, withdraw consent, and complain to a regulator. This applies under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the GDPR and Spanish data protection law (LOPDGDD), and the Saudi Personal Data Protection Law, among others.
To use a right over data we control, email support@inventoriouspro.com. We reply within 30 days and may need to confirm who you are. You can also change your profile and delete your login from your account settings.
Complaints can be made to the UAE Data Office, the Spanish Data Protection Agency (AEPD) or your local authority, such as SDAIA in Saudi Arabia.
11. Children #
The Service is for businesses and is not directed to children under 18. We do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.
12. Data processing summary for business customers #
This section is our data processing agreement summary for personal data that you enter or collect in the Service. It applies together with the Terms of service.
- Subject and duration: hosting and processing your business data to provide the Service, for as long as your subscription lasts and the retention period above.
- Types of data and people: contact details, orders and payments of your customers and suppliers; staff, attendance and payroll data of your employees; storefront shoppers' account and delivery details.
- Instructions: we process this data only to provide the Service and on your documented instructions, which are your use of the Service and these terms. We tell you if we think an instruction breaks the law.
- Confidentiality: people who access the data are bound by confidentiality.
- Security: the measures above. We help you meet your own security and assessment duties.
- Sub-processors: the providers listed under sharing. We bind them to equivalent data protection terms and stay responsible for them. We will update this page before adding a new one that processes your data, so you can object by cancelling.
- Your requests: we help you answer requests from your customers and staff about their data, through the app tools or on request.
- Breaches: we notify you without undue delay, as above.
- End of service: you can export your data; then we delete or return it as described under retention, unless the law requires us to keep it.
- Audits: we give you the information needed to show compliance and allow reasonable audits with notice and at your cost. A countersigned data processing agreement is available on request at support@inventoriouspro.com.
13. Changes to this policy #
We may update this policy. We will change the date and version above and tell you about material changes by email or in the app before they apply.
14. Contact #
Questions or requests about privacy: support@inventoriouspro.com.
- Operator
- CODEIXLAB
- support@inventoriouspro.com