# Privacy policy This policy explains how Inventorious, operated by CODEIXLAB, handles personal data: ours as controller of account and billing data, and yours as the business that puts your customers' and staff's data into the Service. ## On this page 1. Who is responsible for which data 2. What we collect 3. Why we use data and our legal bases 4. Who we share data with 5. International transfers 6. How long we keep data 7. How we protect data 8. Data breaches 9. Your rights 10. Cookies and similar technologies 11. Children 12. Data processing summary for business customers 13. Changes to this policy 14. Contact Version 1.1 Last updated: 2026-11-14 This is the original English version. Translations are provided for convenience; if they differ, the English version prevails. ## 1. Who is responsible for which data # We act in two roles: - Controller: for the data of people who sign up for or manage an account (owners, administrators and users), billing and subscription data, website visitors and people who contact us. We decide why and how that data is used. - Processor: for the business data that you and your team enter or collect in your account, such as your customers, suppliers, staff, orders and files. You are the controller of that data and we process it only on your instructions to provide the Service. If you are a customer of a business that uses Inventorious (for example you bought from an online store, or you are an employee of a business), the business is responsible for your data and you should contact them first to use your rights. We will help them respond. ## 2. What we collect # Account and sign-in data: name, email address, password (stored only as a salted hash), phone and address if you add them, language, time zone, the date you accepted our terms, and, if you enable it, a two-factor authentication secret (stored encrypted) and hashed backup codes. If you sign in with Google or Apple, we receive your name and email from them. Session and security data: sessions record your IP address and browser details (user agent), API access tokens and their device identifiers, and sign-in activity needed to protect your account. Business data you enter: company settings, products, stock and warehouses, customers and suppliers (name, email, phone, address, tax number), orders, invoices, payments, expenses, and files such as logos and product images. Staff (HRM) data you enter: staff profiles, departments and shifts, attendance with clock-in and clock-out times and the IP addresses they were recorded from, leave, holidays, payroll, salaries and awards. This is the business's data about its own staff. Online store data: when a shopper creates an account or orders on a storefront, the business receives, and we process for it, their name, email, phone, password hash, delivery and billing addresses and order history. Billing data: plan, licence dates, payment transactions, invoice details and tax number, and Stripe customer and subscription identifiers. Card details are collected and held by Stripe, not by us. Messages: what you send through our contact form (name, email, message) and our replies, and account deletion reasons if you give one. Technical data: server logs (IP address, requests, errors), and error and performance reports described below. We do not use advertising or analytics trackers on our marketing site. The login, sign-up, password reset and contact forms use Google reCAPTCHA, which receives your IP address and browser data when those forms load and are submitted (see below). ## 3. Why we use data and our legal bases # To provide and secure the Service, sign you in and keep your business running (performance of our contract with you). To bill you, keep tax and accounting records and meet legal duties (contract and legal obligation). To send service emails such as password resets, invitations, invoices, licence and payment notices, and to answer your requests (contract and legitimate interests). To detect abuse and errors, keep the Service stable and improve it (legitimate interests in running a safe, reliable service). To protect the login, sign-up, password reset and contact forms from bots and automated abuse with Google reCAPTCHA (legitimate interests in keeping accounts and the Service secure). To send you optional product news, where you ask for it or the law allows. You can unsubscribe at any time (consent or legitimate interests). We do not sell personal data, and we do not use your business data for advertising. ## 4. Who we share data with # We share data only with service providers that help us run the Service, under contracts that limit their use of it: - Stripe: payment processing, subscriptions and invoices for plan fees. - Email delivery: our SMTP email provider, or the SMTP server a business configures in its own settings, to deliver service emails and invoices. - File storage: files you upload are stored on the server disk or on S3-compatible cloud storage (Amazon S3 or Wasabi), in folders separated by account. - Sentry: error and performance monitoring. Reports are scrubbed of passwords, tokens and request content before sending, and identify a user only by an internal ID. - Google and Apple: only if you choose to sign in with them. Apple and Google push notification services: only if you enable notifications in the mobile app, to deliver alerts to your device. - Google (reCAPTCHA): bot protection on the login, sign-up, password reset and contact forms. When one of those forms loads and when you submit it, Google receives your IP address, browser and device details, the page address, cookies it sets and how you interact with the box, and decides whether you are a person. Google acts for its own purposes under its Privacy Policy and Terms (policies.google.com). The service loads only on those forms, not on other pages. - Google Fonts: signed-in app screens and online stores load the Nunito font from Google, which receives your IP address and browser details. Our marketing website serves its fonts itself. - Our hosting and infrastructure providers, which run the servers and database that hold the data. We may also disclose data when the law requires it, to protect rights and safety, or in a merger or sale of the business, with the same level of protection. Within an account, data is visible to the account's users according to the roles and permissions the business set. ## 5. International transfers # Our providers may process data in countries other than where you live, including outside the UAE and the European Economic Area. Where the law requires, we rely on safeguards such as standard contractual clauses, adequacy decisions or your consent, and we choose providers that commit to protecting personal data. ## 6. How long we keep data # We keep account and business data while your account is active. After your subscription ends or your account is closed we keep it for up to 90 days, then delete or anonymise it. We keep billing, invoice and tax records for as long as the law requires, which is at least 5 years in the UAE. Backups are overwritten on a rolling schedule, so deleted data may remain in them for a limited time. Businesses decide how long to keep their own customer, staff and order records and can delete them in the app. Deleting a user login removes that person's sign-in data from the Service. ## 7. How we protect data # Connections use HTTPS. Passwords are hashed, two-factor authentication is available, sensitive secrets are encrypted, and sensitive actions such as deleting an account need password re-entry. Every business account is kept separate and access inside it is controlled by roles and permissions. Staff can see only what their role allows, and permission changes are recorded. Access to our systems is limited to those who need it, we monitor for errors and abuse, and we keep backups of the database. No system is perfectly secure; please use a strong password and two-factor authentication. ## 8. Data breaches # If we become aware of a personal data breach affecting data we process, we will notify the affected businesses without undue delay, with the information they need to meet their own notification duties. Where we are the controller, we will notify regulators and individuals as the law requires, such as the UAE Data Office and the competent authority in the European Union. ## 9. Your rights # Depending on where you live, you may have the right to access your data, correct it, have it deleted, restrict or object to its use, receive it in a portable format, withdraw consent, and complain to a regulator. This applies under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the GDPR and Spanish data protection law (LOPDGDD), and the Saudi Personal Data Protection Law, among others. To use a right over data we control, email support@inventoriouspro.com. We reply within 30 days and may need to confirm who you are. You can also change your profile and delete your login from your account settings. Complaints can be made to the UAE Data Office, the Spanish Data Protection Agency (AEPD) or your local authority, such as SDAIA in Saudi Arabia. ## 10. Cookies and similar technologies # We use only the cookies and local storage that the Service needs: - a session cookie that keeps you signed in and protects forms from forgery (it is deleted when you sign out, or expires); - a storefront session cookie that keeps a shopper signed in to a business's online store; - a referral cookie that records which link brought you to us if you arrived through a referral; - a language choice remembered in your browser. - on the login, sign-up, password reset and contact forms only: the cookies and similar data set by Google reCAPTCHA (for example _GRECAPTCHA), used solely to tell people from bots and protect the form (our legitimate interest in security). We do not use advertising or tracking cookies, and we do not run third-party analytics on the marketing site. Apart from reCAPTCHA on those forms, no third party sets cookies on our pages, so we show no cookie consent banner. If that changes, we will ask for consent first. You can block cookies in your browser, but you will not be able to sign in. ## 11. Children # The Service is for businesses and is not directed to children under 18. We do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it. ## 12. Data processing summary for business customers # This section is our data processing agreement summary for personal data that you enter or collect in the Service. It applies together with the Terms of service. - Subject and duration: hosting and processing your business data to provide the Service, for as long as your subscription lasts and the retention period above. - Types of data and people: contact details, orders and payments of your customers and suppliers; staff, attendance and payroll data of your employees; storefront shoppers' account and delivery details. - Instructions: we process this data only to provide the Service and on your documented instructions, which are your use of the Service and these terms. We tell you if we think an instruction breaks the law. - Confidentiality: people who access the data are bound by confidentiality. - Security: the measures above. We help you meet your own security and assessment duties. - Sub-processors: the providers listed under sharing. We bind them to equivalent data protection terms and stay responsible for them. We will update this page before adding a new one that processes your data, so you can object by cancelling. - Your requests: we help you answer requests from your customers and staff about their data, through the app tools or on request. - Breaches: we notify you without undue delay, as above. - End of service: you can export your data; then we delete or return it as described under retention, unless the law requires us to keep it. - Audits: we give you the information needed to show compliance and allow reasonable audits with notice and at your cost. A countersigned data processing agreement is available on request at support@inventoriouspro.com. ## 13. Changes to this policy # We may update this policy. We will change the date and version above and tell you about material changes by email or in the app before they apply. ## 14. Contact # Questions or requests about privacy: support@inventoriouspro.com. - **Operator**: CODEIXLAB - **Email**: support@inventoriouspro.com [Read the Terms of service](https://inventoriouspro.com/terms) --- source: https://inventoriouspro.com/privacy language: en modified: 2026-11-14