PRIVACY POLICY ============== khata.pk · Effective 15 September 2026 khata.pk ("we", "us") is a bookkeeping app for small businesses in Pakistan. This policy explains what information the app handles, why, where it is stored, and the choices you have. It applies to the khata.pk mobile app for Android and iOS and to the account you create in it. 1. Information we collect ------------------------- Category | What | Why - Account: Your name, email address and profile photo from your Google account when you sign in with Google; any phone number or email you add to your business profile. (To create and secure your account and sign you in.) - Business profile: Business name, category, city, logo, invoice settings. (To label your books and print invoices.) - Books you keep: Customers (names, phone numbers, addresses, notes, balances), sales and payments, expenses and receipts, invoices and their line items, products and stock levels, payment reminders. (This is the service: recording and reporting your business activity.) - Contacts: When you choose "add from contacts" on the customer form, the app opens your phone's own contact picker and reads only the single contact you select — its name and phone number — to fill in that customer. (So you don't have to retype a customer already in your phone.) - Photos: Business logo, your profile photo, product photos, expense receipts you choose to attach. (Shown in the app and on invoices.) - Technical: Device type, OS version, app version, sync timestamps, and error details when something fails. (To keep your data in sync and fix problems.) khata.pk does not read your full contacts list — only the one contact you pick. It does not collect your location, precise device identifiers for advertising, or any data from other apps. We do not show ads and we do not sell your data. 2. Customers' information ------------------------- When you record a customer, you are entering information about another person. You are responsible for having a lawful basis to keep it (for example, they are your customer and you keep an account for them). khata.pk processes it only to provide the service to you. Reminders you send by WhatsApp or SMS are sent from your own phone and messaging apps; khata.pk does not send messages on your behalf. 3. Where data is stored ----------------------- Your books are stored on your device (so the app works offline) and synchronised to our cloud database and file storage provided by Supabase, hosted on Amazon Web Services in the Asia-Pacific (Singapore) region. Data is encrypted in transit (TLS) and at rest. Access is restricted by row-level security so that only members of your business can read or change its records. 4. Third parties we use ----------------------- - Supabase (database, authentication, file storage) — supabase.com/privacy (https://supabase.com/privacy) - Google Sign-In (the sign-in method) — policies.google.com/privacy (https://policies.google.com/privacy). When you sign in, Google shares your name, email and profile photo with us; we request no other Google data. Our use of information received from Google APIs follows Google's Limited Use requirements. These providers process data on our instructions. We do not share your data with anyone else except when required by law. 5. How long we keep it ---------------------- For as long as your account exists. Deleted records are kept for 30 days to allow recovery, then removed. Backups roll off within 30 days. 6. Your choices and rights -------------------------- - Access and export: Settings → Export Data gives you CSV and PDF copies of your books at any time. - Correction: edit any record in the app. - Sign out / remove from device: More → Log Out removes your books from that device; they remain in your account. - Delete your account and all data: in the app, go to More → Delete Account and confirm; or request it online at https://khata.pk/delete-account; or email support@khata.pk from the email on your account. Whichever you choose, we delete your account, business, books and photos within 30 days and confirm by reply. Where you are a member of another person's business, records of that business belong to its owner and are not deleted with your account. 7. Security ----------- Sign-in uses Google; sessions are stored in the device's secure storage; the optional app lock adds a PIN. No system is perfectly secure — if you believe your account has been accessed without permission, contact us immediately. 8. Children ----------- khata.pk is a business tool and is not directed to children under 13. We do not knowingly collect their data. 9. Changes ---------- We will post any changes here and update the effective date. Material changes will be announced in the app. 10. Contact ----------- support@khata.pk