Privacy Policy

DRAFT — not reviewed by a lawyer. Do not publish before review.

Last updated: [PLACEHOLDER: date of publication]

Introduction

Welcome to Ubity. We are committed to protecting your privacy while we provide you with good digital experiences. This Privacy Policy explains how we collect, use, and protect information when you use our services, websites, applications, and related products (together, our "Services"). Our Services include business management apps, the cloud service that backs up and syncs their data, and our websites and customer portal.

By using our Services, you agree to the collection and use of information as described in this policy. We design our Services with your privacy in mind, and we are open about how we handle data.

The Services are run by [PLACEHOLDER: company legal name], [PLACEHOLDER: company address, country] ("Ubity", "we", "us").

Two kinds of data

We handle two kinds of data. This policy treats them differently.

Account and website data. Data about you as a user of our Services (for example your name, email, and how you use the Services). For this data, we are the controller.
Business data. Data that you or your team store in our apps and in our cloud service (for example products, stock, invoices, prices, customers, suppliers, and staff). For this data, you are the owner and controller. We are the processor. See "Business Data That You Store With Us" below.

Information We Collect

Personal Information

To provide you with the best experience, we may collect these types of information:

Account Information: When you create an account, we collect details like your name, email address, and password credentials. We store passwords and passcodes only as salted hashes, never as plain text.
Contact Details: Phone numbers, addresses, and other communication preferences.
Payment Information: Billing details and transaction history for our paid services.
Profile Information: Preferences, settings, and personalization choices.

Automatically Collected Information

Like most modern services, we automatically collect some technical information to improve your experience:

Device & Browser Data: Information about your device, browser type, and operating system, and the version of our app that you use.
Usage Analytics: How you interact with our Services, the features you use, and time spent.
Location Data: General location information (with your consent where required).
Performance Data: App crashes, loading times, sync status, and technical diagnostics.

Third-Party Authentication

When you choose to sign in through third-party services like Google, Facebook, WhatsApp, or other authentication providers, we receive certain information from those services. This depends on your permissions and on their privacy policies.

Information from Third Parties

We may receive information about you from several sources to improve our Services:

Social media platforms (when you connect your accounts)
Payment processors and financial institutions
Analytics and advertising partners
Identity verification services

Business Data That You Store With Us

Our business management apps work on your own devices. You can also use our cloud service to back up this data and to keep several devices in sync.

You own your business data. This includes the personal data of your own customers, suppliers, and staff that is inside it. You decide what to store and why.
We process it on your instructions. We use business data only to run the Services for you: store it, sync it, back it up, restore it, show it to you in the apps and the customer portal, and export it. We do not sell business data. We do not use it for advertising.
You are responsible for your own legal duties. For example, you must have a lawful reason to store your customers' personal data, and you must answer their requests. If a person asks us about data in your account, we may refer them to you.
The cloud service can read stored business data. This is needed to sync devices, to show your data in the customer portal and on your phone, and to create exports and connections that you ask for. We limit who at Ubity can see it (see "Support Access").
Isolation. We keep the data of each customer separate from the data of other customers.
Data processing terms. If you need a data processing agreement, contact us. [PLACEHOLDER: decide if a separate data processing agreement is offered and where it is published.]

Apps That Work Offline, Sync, and Backup

Offline first. Our apps keep your data on your device and work without internet. A loss of connection does not stop you from working.
Sync and backup to the cloud. If you link your device to your account, the app sends your changes to our cloud service and receives changes from your other devices. The link uses an encrypted connection (HTTPS).
Device tokens. Each linked device gets a secret token. You can unlink or revoke a device at any time.
Local copies. The app can also make local backup copies on your device, for example before an update. These copies stay on your device and under your control.
Cloud backups. We make regular backups of the cloud service. They are encrypted and kept for a limited time, and we store copies away from the main server. We also test that we can restore them. [PLACEHOLDER: backup retention period, confirm with technical setup; current design says 30 days.]
Open work. To protect your work, the app may save a draft of a form you are filling in. This draft stays on your device.

Spreadsheet Exports

If you ask for it, we create a spreadsheet that holds a copy of your business data (for example products, stock, sales, purchases, customer balances, and payments). The spreadsheet is kept in an account that we control with a third-party service. We share it with you as view-only. We keep it up to date from the cloud service.

We create it only for customers who ask for it.
You tell us which people may see it. Anyone who has the link or access that you share can see it, so share it with care.
You can ask us to stop the export and delete the spreadsheet at any time.
The privacy policy of the third-party service also applies to the spreadsheet.

Support Access

Our staff do not open your business data without a reason. They may access your account or data only:

to help you, for example when you ask for support or report a problem; or
to keep the Services safe and working, for example to fix a sync error or stop abuse.

We record this access in an audit log. Our staff are bound by confidentiality. We may also use read-only tools to investigate technical problems. These tools also record each use.

How We Use Your Information

We use your information to provide you with good services and experiences.

Service Provision

Core Functionality: To deliver, maintain, and improve our Services, including sync and backup.
Personalization: To customize your experience with relevant content and features.
Account Management: To manage your account and provide customer support.
Communication: To respond to your inquiries and send important updates.

Service Enhancement

Analytics: To understand usage patterns and improve our Services.
Research: To develop new features and services based on your needs.
Security: To protect against fraud, abuse, and security threats.
Performance: To optimize our Services for better speed and reliability.

Business Operations

Marketing: To inform you about our Services, updates, and special offers (with consent where required).
Advertising: To display relevant advertisements and measure their effectiveness. [PLACEHOLDER: confirm if advertising applies to the apps and the customer portal. We do not use business data for advertising.]
Legal Compliance: To comply with legal obligations and protect our rights.
Business Development: For business planning, analysis, and strategic decisions.

App Updates and Notifications

Automatic updates. Our apps check for new versions. The app downloads an update in the background, checks that the file is correct, and installs it. It installs only when it is safe, for example when the app is idle and no work is open. We may require a minimum version for the app to keep working. Some app stores update apps themselves, and their rules apply there.
Update data. To do this, the app sends us its platform, its version, and a device identifier.
Notifications. We send notifications inside the apps, in the customer portal, and by email. They include service messages, such as reminders before a subscription ends, backup or sync problems, and security alerts. If you turn on system notifications, your device shows them too. Service messages are not marketing, and you cannot turn off the ones that we need to send for security or for your account. You can turn off marketing messages at any time.

Information Sharing

We are open about how we share information.

Service Providers

We work with trusted third-party service providers to help us deliver our Services. We name types of providers here, and we may change providers over time.

Infrastructure Providers: Hosting, cloud services, backup storage, and technical infrastructure.
Email and Messaging Providers: To send account emails and notifications.
Payment Processors: Secure payment processing and financial services.
Analytics Partners: To understand how our Services are used.
Advertising Networks: To display relevant advertisements and measure performance.
Support Services: Customer support platforms and communication tools.
Spreadsheet and Productivity Providers: To create the spreadsheet exports that you ask for.

We ask these providers to protect data and to use it only for the service that they give us.

Legal Requirements

We may share your information when the law requires it or to protect important interests:

Legal Compliance: To comply with laws, regulations, and legal processes.
Safety & Security: To protect our users, Services, and property.
Rights Protection: To enforce our terms and protect our legal rights.
Emergency Situations: To protect personal safety or prevent harm.

Business Transfers

If our business changes, your information may be transferred:

Mergers & Acquisitions: If we merge with or are acquired by another company.
Asset Sales: If we sell or transfer all or part of our business.
Business Restructuring: During reorganizations or similar business changes.

Public Information

Some information may be made publicly available:

User-Generated Content: Information you choose to make public.
Aggregated Data: Anonymized and aggregated statistical information.
Public Profiles: Information visible to other users based on your settings.

We never put your business data on a public page.

Data Security & Retention

Security Measures

We take data security seriously and use reasonable protections:

Encryption: Data is encrypted in transit (HTTPS) and, where we store it, at rest. Backups are encrypted.
Credentials: Passwords and passcodes are stored as salted hashes. Device tokens are random, stored as hashes on our side, and you can revoke them.
Access Controls: Strict access limits, authentication, and separation of each customer's data.
Checks on incoming data: We check data that devices send us, and we refuse data that is not valid.
Abuse Protection: Rate limits and size limits on requests.
Monitoring: Regular security monitoring, logging, and vulnerability assessments.
Integrity Checks: We compare data between your devices and the cloud to find differences early.
Training: Employee training on privacy and security best practices.
Incident Response: Procedures for handling security incidents. If a breach affects your data, we tell you without undue delay, as the law requires.

Important: While we use strong security measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work continuously to improve our protections.

Data Retention

We keep your information only as long as necessary:

Service Provision: To provide and maintain our Services.
Legal Obligations: To comply with legal requirements.
Dispute Resolution: To resolve disputes and enforce agreements.
Legitimate Interests: For other legitimate business purposes.

Retention periods vary with the type of information and the purpose. When information is no longer needed, we securely delete or anonymize it according to our data retention policies.

Specific rules:

Business data stays in your account while your account is active.
Cloud backups are kept for a limited time and then removed. [PLACEHOLDER: backup retention days.]
Audit logs of support access and security events are kept for [PLACEHOLDER: audit log retention days].
Billing records are kept as long as the law requires.

Export and Deletion of Your Data

Export. You can ask us for a copy of all your data at any time, and you can export data from the app. We give it in a common format, such as a spreadsheet or database file.
Deletion. You can ask us to delete your account and all data that we hold for you in the cloud service. We do this after we verify your identity. Backup copies are removed when they expire, within [PLACEHOLDER: days until backups are fully removed]. Data on your own devices stays under your control.
Legal limits. We may keep some data when the law requires it (for example billing records).

After a Subscription Ends

When a subscription ends or is not renewed, we do not delete your data at once.
We keep your data for a period after the end. During this period, you can export it, and you can renew to continue. [PLACEHOLDER: length of the period, decision open.]
Some features may become limited when a subscription ends. We tell you before this happens.
A missed payment alone does not delete your data.
After the period, we may delete the data from the cloud service, after we send you a notice. You can ask us to delete it sooner.
Data on your own devices stays on those devices.

Your Rights & Choices

Depending on your location, you may have rights about your information.

Information Rights

Access: Request access to your personal information.
Correction: Request correction of inaccurate information.
Deletion: Request deletion of your personal information.
Portability: Request transfer of your data to another service.
Objection: Object to certain processing of your information.
Restriction: Request restriction of processing.

Privacy Controls

Account Settings: Manage your preferences and privacy settings.
Marketing Preferences: Choose what marketing communications you receive.
Cookie Controls: Manage cookies through your browser settings.
Location Settings: Control location sharing through device settings.
Devices: Unlink a device from your account at any time.

Exercise Your Rights

To use your rights, contact us with the information below. We may need to verify your identity before we process your request. If your request is about personal data in a customer's business data (for example, you are a customer of one of our users), we may refer you to that business.

International Data Transfers

Your information may be transferred to and processed in countries outside your own. Our cloud servers are in [PLACEHOLDER: server country or region]. When we transfer information across borders, we make sure that appropriate safeguards are in place:

Legal Frameworks: Using appropriate legal mechanisms for international transfers.
Standard Clauses: Using standard contractual clauses where required.
Adequacy Decisions: Relying on official adequacy decisions where available.
Additional Measures: Using extra protective measures when needed.

Children's Privacy

Our Services are made for businesses and are generally not directed to children under 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children without appropriate parental consent.

If we learn that we have collected information from a child without proper consent, we take steps to delete it promptly. Parents and guardians can contact us if they have concerns about their child's privacy.

Third-Party Services

Our Services may work with or link to third-party services.

Authentication Services

We may offer sign-in through third-party providers like Google, Facebook, WhatsApp, and others. When you use these services, their privacy policies apply to the information that they collect and share with us.

Advertising Services

We may work with advertising partners to display relevant advertisements. These partners may collect information about your interactions with ads to measure effectiveness and personalize advertising.

Analytics Services

We use analytics services to understand how our Services are used. These services may collect information about your usage patterns to help us improve our offerings.

Messaging Integrations (Beta)

Some optional features may send messages, such as invoices, through third-party messaging platforms. These features may be offered as beta, and you use them at your own risk. The platform's own terms and privacy policy apply. The platform may limit or block accounts or phone numbers that it sees as abuse. We do not control this.

Third-Party Links

Our Services may contain links to third-party websites and services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before you give them any information.

Paid Services & Subscriptions

For our paid services and premium features, we may collect more information:

Payment Information: Billing details, payment methods, and transaction history.
Subscription Data: Subscription status, plan, usage limits (such as number of devices), and feature access.
Service Usage: How you use paid features to improve your experience.
Support Interactions: Communications about premium support services.

We may record payments that you make in another way (for example a bank transfer) against your account by hand. Online payment processing is handled by secure third-party payment processors. Their privacy policies apply to payment information. We do not store full card numbers.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. When we make changes, we will:

Post Updates: Show the updated policy on our website.
Notify Users: Send email notifications for significant changes.
Provide Notice: Show prominent notices in our Services.
Update Date: Change the "Last Updated" date at the top.

Your continued use of our Services after changes means that you accept the updated policy. We encourage you to review this policy from time to time.

Contact Us

If you have questions about this Privacy Policy or want to use your rights, contact us:

Email: [PLACEHOLDER: contact email; the current policy uses privacy@ubity.dev]
Website: https://ubity.dev
Address: [PLACEHOLDER: company address]

We respond to your inquiry within a reasonable time, normally within 30 days. For urgent privacy concerns, say so in your message.

Agreement

This Privacy Policy is a binding agreement between you and Ubity. By using our Services, you confirm that you have read, understood, and agree to be bound by this Privacy Policy.

If you do not agree with any part of this Privacy Policy, you must stop using our Services.

Changes from the current policy

Reviewer notes. Delete this section before publishing.

Kept from the current policy: all headings and bullet points of the current page, including the advertising, analytics, social sign-in, business transfer, public information, children, and "Agreement" text. The two lists "Your Rights" and "Privacy Controls" are kept in full.

Added: - Short intro that names the Services (apps, cloud service, websites, portal) and the company line with placeholders. - "Two kinds of data": account data (Ubity is controller) vs business data (customer is controller, Ubity is processor). - "Business Data That You Store With Us": customer owns data and the personal data of its own customers and suppliers; Ubity processes on instructions; no sale, no advertising use; the cloud can read stored data; separation between customers; data processing agreement placeholder. - "Apps That Work Offline, Sync, and Backup": offline use, sync, device tokens, local copies, cloud backups, saved drafts. - "Spreadsheet Exports": Ubity-controlled view-only spreadsheet, only on request, how to stop. - "Support Access": only to help the customer or keep the service safe, recorded in an audit log. - "App Updates and Notifications": automatic download and install, minimum version, data sent for updates, service notifications. - "Export and Deletion of Your Data" and "After a Subscription Ends" (no fixed day count; no deletion for a missed payment). - "Messaging Integrations (Beta)": at own risk, platforms may block accounts. - Retention rules for business data, backups, audit logs, billing records.

Changed: - Service-provider list now by type, and extended (email and messaging, backup storage, spreadsheet providers). No provider named. - Security Measures extended: hashed passwords and passcodes, device tokens, data checks, rate limits, integrity checks, breach notice. - Device data now includes the app version; performance data includes sync status. - Payment text: manual payments, no full card numbers stored. - International transfers: added server location placeholder. - Children: states that the Services are made for businesses. - Rights: added "Unlink a device"; requests about a customer's business data can be referred to that customer. - Contact: email now a placeholder; address added. - "Immediately cease" in the Agreement changed to "stop using".

Open points for the owner or lawyer: whether advertising applies to these apps at all (the current text is kept); the data processing agreement; the controller and processor wording for your country's law; the legal basis wording (for example GDPR) if you serve the EU or other regions.