1. Introduction
Hisaabii Baqala is a point-of-sale and simple accounts service for neighbourhood grocery shops (baqalas) in Saudi Arabia. This Privacy Policy explains what information we collect when you use the Hisaabii Baqala web app and desktop till app (the “Service”), how we use it and who we share it with.
By creating an account or using the Service you accept this policy. If you do not agree, please do not use the Service.
2. Information we collect
Account details: your name, email address, password (stored only in hashed form), language and notification choices. Cashier accounts you add hold the cashier's name, email and password.
Baqala details: the shop name in Arabic and English, commercial registration (CR) number, VAT number, national address, logo, and the ZATCA device certificate created when you connect your baqala to ZATCA.
Records you keep in the Service: products, barcodes, prices and stock; sales, returns, receipts, tax invoices and credit notes; customers you sell to on credit (name and mobile number only), what they bought, paid and still owe, and the credit statements you create; suppliers, purchase orders, purchases and what you owe them; expenses; day cash counts; and your settings.
Technical data: IP address, browser and device type, the till the app runs on, the cookies needed to keep you signed in, and server logs used to run and protect the Service.
We do not collect payment card numbers. Card payments are taken on your own card machine; the Service only records that a sale was paid by card.
3. How we use information
We use this information to run the Service for you: signing you in, recording sales, printing receipts, keeping your stock, customer credit and supplier balances, preparing your reports, issuing tax invoices and reporting them to ZATCA, sending you notifications (low stock, near expiry, credit limit, ZATCA failures) and giving you support.
Customer credit statements: when you press the WhatsApp button, the Service opens WhatsApp on your device with a message for your customer that contains a private link to their statement. You send that message yourself; we do not message your customers.
We may use combined figures that do not identify you or your customers to understand how the Service is used and to improve it. We do not sell your data.
4. Who we share information with
ZATCA (Zakat, Tax and Customs Authority): your tax invoices and credit notes, and the baqala details ZATCA requires, are sent to ZATCA's Fatoora systems as the e-invoicing rules require.
Email delivery provider: used to send verification codes, password-reset codes and notification emails to you.
Automatic translation (optional, currently Google Gemini): when you type a product, shop or address name in one language, the text you typed may be sent to this service to suggest it in the other language. No customer details are sent.
Hosting and database providers that run the servers of the Service. They may handle data only as needed to provide their service to us.
5. How long we keep data
We keep your account and baqala data for as long as your account is open, and for a reasonable period afterwards where the law, a dispute or security requires it.
Tax invoices and credit notes are tax records. Saudi tax rules require you, as the taxpayer, to keep them for the period the law sets. Deleting a baqala from the Service permanently removes its records from our systems, so download or print the records you must keep before you delete it.
Links to customer credit statements stop working after their expiry date.
6. Cookies
We use only the cookies needed to run the Service: one that keeps you signed in, a short-lived one used while you reset your password, and one that remembers your language. We do not use advertising cookies.
7. Your rights and choices
You can see and correct your account and baqala details in Settings at any time, and delete a baqala from My baqalas. To ask for a copy of your data, a correction or the deletion of your account, contact us. Saudi Arabia's Personal Data Protection Law may give you further rights, and we handle requests as that law requires.
Your credit customers: you decide which customers to save, and you are responsible for telling them how you use their name and mobile number. If one of your customers contacts us about their data, we will refer them to you.
Some records cannot be erased where the law requires us or you to keep them. We will tell you when that applies.
8. Security
Passwords are stored hashed, connections to the Service are encrypted, each baqala's data is kept separate, and ZATCA device keys are stored encrypted. Cashier accounts cannot see cost prices, profit, finance pages or settings. No system is perfectly secure: keep your password private and give each cashier their own sign-in.
9. Children's privacy
The Service is for shop owners and their staff. It is not directed at children and we do not knowingly collect children's personal data.
10. Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date and, when a change is important, tell you through the Service or by email.
11. Contact
Questions about privacy or your data: sales@hisaabii.com.