Privacy Policy

This Privacy Policy explains how Hishabiz ("Hishabiz", "we", "us") collects, uses and shares information when you use our business management software at hishabiz.com (the "Service"). By using the Service you acknowledge this Policy. If you do not agree, please do not use the Service.

1. Information we collect

Account and business information

• Owner name, email address and mobile number.
• Business name and business type, and the name of your main branch.
• Your password, which we store only in hashed (not readable) form. If you sign up with Google, we generate a random password that is never shown to anyone.
• Your role (for example owner or employee), account status and language preference.
• Details of employees you invite, such as their name, email and mobile number.

Business records you enter

Products, categories, stock levels, sales, purchases, returns, damaged stock, customers, suppliers, expenses, due and payment records, invoices, reports, notifications and settings. This includes personal details of your own customers and suppliers (such as names, phone numbers and amounts owed) that you choose to record.

Login and verification information

• Email verification codes (short-lived) and password-reset tokens.
• Whether your email has been verified.

Google account information

If you choose "Continue with Google", we receive from Google your name, email address, whether Google has verified that email, and your Google account identifier. See section 4.

Technical and marketing information

• IP address: we store the IP address from your most recent registration or login on your user record.
• Marketing attribution: when you arrive on our landing, login or registration pages with tracking parameters (for example UTM campaign tags), we store those parameters, the landing page, the referring site and your IP address. If you then register or log in, this record is linked to your account so we can understand which campaigns bring users.
• Analytics: we use Google Analytics, which may collect information such as pages viewed, approximate location, browser, operating system and device type through cookies or similar technologies.
• Feedback: anything you send us through the in-app or website feedback form.

2. How we use information

• To create and operate your account and your business workspace, and to provide the features of the Service.
• To authenticate you, keep you signed in, verify your email and let you reset your password.
• To send service emails such as verification codes, password resets and employee invitations.
• To apply the limits of your subscription plan.
• To respond to support requests and feedback.
• To measure and improve the Service and our marketing.
• To detect, prevent and investigate misuse, fraud or security problems.
• To comply with legal obligations.

We do not sell your personal information or your business records.

3. Business data and tenant separation

Each business registered on Hishabiz is a separate "tenant". Business records are stored with the identifier of the business they belong to, and the application restricts queries to the business of the signed-in user, so users of one business are not shown another business's records. Employees you invite can access your business's data according to the role and permissions you give them. You are responsible for choosing who you invite.

The business records you enter belong to you. We process them on your behalf to provide the Service.

Authorised Hishabiz personnel may access stored data where necessary to operate the Service, provide support you request, or investigate security issues.

4. Google Login

• Google Login is optional. You can still register and log in with email or mobile number and password.
• We request only basic profile information (name, email address and Google account identifier). We do not request access to your Gmail, Google Drive, contacts, calendar or other Google data.
• We use your Google email only after Google confirms it is verified. We store your Google account identifier on your user record to recognise you on later logins.
• We do not store the access token Google issues for the sign-in.
• If you start Google sign-up but do not finish entering your business details, we keep your verified Google name, email and identifier temporarily (up to 14 days) so you can resume. After you complete registration, or when that period ends and the record is no longer usable, it is not used for anything else.
• If an account already exists with the same email and a password, we ask you to confirm that password before Google is linked to it. We never link accounts silently.
• Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
• You can review or revoke Hishabiz's access to your Google account at any time in your Google Account permissions.

5. Security and backups

We use measures that are built into the Service, including:

• Hashed password storage.
• Encrypted connections (HTTPS) for the website.
• Email verification and rate limits on sensitive actions such as password reset.
• Tenant-level restriction of business records, as described in section 3.

No online service can be completely secure, and we cannot guarantee absolute security. We do not currently promise a specific backup schedule or recovery time for your data, and you should keep your own copies of important records (for example, by using the export and report features where available). Keep your password confidential and tell us immediately if you suspect unauthorised access.

6. Sharing and service providers

We share information only as described below:

• Hosting and infrastructure providers that store and run the Service.
• Brevo (email delivery), which receives recipient email addresses and message content for service emails.
• Google, for Google Login and Google Analytics.
• Google Fonts, which serve fonts to your browser on some pages.
• Authorities or other parties where required by law, court order or to protect rights, safety and the security of the Service.
• A successor if Hishabiz is involved in a merger, acquisition or sale of assets, in which case this Policy will continue to apply to your information unless you are told otherwise.

Your own customers and suppliers are not given access to your data by us. If you share an invoice or message with them, you control that sharing.

7. Subscriptions and payments

Hishabiz offers a free plan and paid plans with different limits and features. The Service does not currently process card or mobile-banking payments inside the application, and we do not store payment card or mobile-wallet credentials in the application. If you pay for a plan through another channel arranged with us, we will keep the records needed to manage your subscription and meet accounting obligations.

"Payments" and "dues" that appear inside Hishabiz are records you enter about money between your business, customers and suppliers. Hishabiz does not collect or transfer that money.

8. Retention and deletion

• We keep your account and business records while your account is active so that you can use the Service.
• Verification codes and password-reset tokens expire quickly. Unfinished Google sign-ups are kept for up to 14 days.
• The Service does not currently have a self-service "delete my account" button. To request deletion of your account and business data, or correction of your information, email us at the address in section 13. We will verify that the request comes from the account owner before acting.
• We may keep limited information after deletion where needed for legal, accounting, security or dispute-resolution purposes. Data held in backups may persist until those backups are overwritten.

9. Your rights and responsibilities

You may ask us to access, correct, export or delete the personal information we hold about you, or to object to certain uses, by contacting us. We will respond as required by applicable law, including the laws of Bangladesh.

You are responsible for:

• the accuracy and legality of the records you enter;
• having the right to record personal information about your customers, suppliers and employees, and handling it lawfully;
• keeping your login details secure and managing the access you give to employees.

10. Cookies and sessions

We use cookies and similar technologies to operate the Service:

• Session cookie: keeps you signed in and protects forms against cross-site request forgery (a security token cookie is used for the same purpose). Sessions are long-lived, so you may stay signed in on a device until you log out or the session expires.
• "Remember me" cookie: set only if you choose "Remember me" at login.
• Language cookie: remembers whether you prefer Bangla or English.
• Analytics cookies: set by Google Analytics as described above.

You can block or delete cookies in your browser settings, but the Service may not work properly without the session cookies. You can opt out of Google Analytics using Google's browser add-on.

11. Children's privacy

The Service is intended for business use by adults. It is not directed at children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will take steps to delete it.

12. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top shows the latest version. If a change is significant, we will take reasonable steps to notify you, for example by email or a notice in the Service. Continued use after a change means you accept the updated Policy.

13. Contact us

For privacy questions or requests:

• Email: hishabiz.support@gmail.com
• WhatsApp: +880 1577 004929