Privacy Policy

Bisnesy is a business management product — point of sale, inventory, accounting and related tools — published by WaafiTech, based in Dhaka, Bangladesh.

For anything in this policy, write to [email protected]. We answer privacy requests from a real person, not a ticket queue.

This policy covers bisnesy.com and the Bisnesy web and mobile apps.

Three different things, kept separate because they are used for completely different purposes.

• Your account: name, email address, mobile number, password (stored only as a salted hash — we cannot read it), profile photo if you add one, and the devices you sign in from.
• Your business data: everything you enter into the product — products, stock, sales, purchases, expenses, customers and suppliers, staff records, accounting entries and the files you upload. This is yours. We hold it so the product can show it back to you.
• Subscription payments: the plan you chose, the amount, your bKash sender number and the transaction id you submit, and whether we verified it.

We also record ordinary technical information every website records: IP address, browser and device type, and which pages were opened. It is used to keep accounts secure, show you your own sign-in sessions, and diagnose faults.

We do not ask for, and have no use for, national ID numbers, dates of birth, or any special category of personal data.

When you record a customer, a due, or a supplier, you are the one deciding what to collect and why. We process it on your instructions so the product can work: to show a ledger, calculate a due, print an invoice, or send a reminder you asked for.

We do not sell it. We do not mine it to build profiles. We do not use one business's data to market to another, and we never use your customer list for our own advertising.

Reminders sent through WhatsApp or SMS go via the messaging provider you have configured, carrying only what the message needs — the customer's number, your business name, and the amount.

• To run the product you signed up for, which is the whole of what your business data is used for.
• To keep accounts secure: sign-in, device limits, session lists, and detecting abuse.
• To take payment for a subscription and to verify that a bKash transfer actually arrived.
• To send transactional email you cannot opt out of while you have an account — verification, payment receipts, security notices.
• To send product tips and offers, only if you ticked that box, and only until you untick it.
• To understand how people find us and whether our advertising works — see the next section.

The signed-in app uses cookies that are strictly necessary: your session, your active business, your language and appearance settings. There is no way to use an account without these.

Our public marketing pages additionally load Google Tag Manager, which runs Google Analytics and the Meta (Facebook) pixel. These tell us how many people reached a page and how many went on to create an account. They are not loaded inside the signed-in app at all — the screens where your business data lives never call an advertising script.

Because our subscriptions are paid by bKash and verified by a person, sometimes the next day, we also report conversions from our server: when a payment is verified we tell Meta that a subscription was purchased. That report contains the amount, the plan, and — hashed, never in readable form — your email address, mobile number and account id. Hashing means the ad platform can recognise a match without ever receiving the address or the number itself. It also carries the advertising cookie identifiers your browser was holding, which is what links the sale back to the advert that brought you here.

Every such event carries a de-duplication id so a single sale is reported once, not twice.

Visitors in the EU, the UK and Switzerland have all advertising and analytics storage denied until they consent. Elsewhere, including Bangladesh, analytics defaults to on; you can block these cookies in your browser at any time without losing any part of the product.

Only the suppliers it takes to run the service, each with a defined job:

• Hosting and database providers, which store the data.
• Cloudflare, which sits in front of the site and filters abusive traffic.
• Our email provider, for verification, receipts and notices.
• Object storage, for the images and files you upload.
• Google Analytics and Meta, for the marketing measurement described above — marketing pages and conversion events only, never your business data.
• The messaging provider you configure, if you use WhatsApp or SMS reminders.

We do not sell personal data, and we have never done so. We disclose data to authorities only where a valid legal order requires it, and we will tell you unless we are prohibited from doing so.

Traffic is encrypted in transit. Passwords are stored as salted hashes and are not recoverable — not by you, and not by us. Access to a business's data is controlled per user and per module, and every request is checked against those permissions on the server, not merely hidden in the interface.

Each plan caps how many devices may be signed in at once, and you can see and revoke every active session from your profile. Signing a device out takes effect immediately, not when its token happens to expire.

No system is perfect. If a breach ever affects your data, we will tell you what happened, what was affected and what we did about it — promptly, and without waiting to be asked.

Your business data is kept for as long as your account exists, because deleting it is the opposite of what a ledger is for.

If you close your account we delete or irreversibly anonymise your data within 90 days, except records we are required to retain for tax and accounting purposes.

Subscription payment records are kept as long as the law requires. Technical logs are kept for a short period and then discarded.

The advertising identifiers described above are stored as a single current value per account and overwritten, never accumulated into a browsing history.

You can ask us to show you what we hold, correct it, export it, or delete it. Most of it you can do yourself from inside the product; for the rest, email us and we will act within 30 days.

You can withdraw marketing consent at any time — from your profile, or by using the unsubscribe link in any marketing email. Transactional messages about your own account continue, because they are part of the service.

If you believe we have handled your data badly, tell us first at [email protected]. If we cannot resolve it, you may complain to your local data protection authority.

Bisnesy is a tool for running a business and is not directed at children. We do not knowingly create accounts for anyone under 18. If you believe a child has an account, tell us and we will remove it.

When this policy changes we update the date at the top of this page. If a change materially affects how your data is used, we will email account owners before it takes effect rather than relying on you to notice.