Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

Account Registration:

• Organization information: Company name, organization slug, industry, size
• User information: Full name, email address, job title, department
• Contact details: Phone number (optional), office location
• Authentication data: Password (hashed and encrypted)

Operational Data:

• Supply requests: Item descriptions, quantities, justifications
• Catalogue items: Product names, descriptions, pricing
• Sites and areas: Location names, addresses, organizational structure
• Audit logs: User actions, timestamps, IP addresses

Payment Information:

• Billing name and address
• Payment details processed by Paddle Billing (not stored on our servers)
• We receive only transaction confirmations from Paddle

1.2 Information Collected Automatically

• Usage data: Pages visited, features used, time spent
• Device information: IP address, browser type, operating system
• Cookies and tracking technologies for session management and analytics

1.3 Mobile App and Device Features

The OfficeStoreApp Android app opens the same service as the website, so the information above applies to it too. It uses these device features only when you use them:

• Camera: used only to scan QR codes on item labels. QR codes are read on your device; camera images are not stored or sent to us.
• Photos: only images you choose to upload, such as a catalogue item picture.
• Notifications: if you turn them on, we store a notification token for your device so we can tell you when a request needs your approval or its status changes. Turn them off any time in Profile or in your device settings.
• Support chat: if you open the chat, your name, email and messages are shared with our chat provider so we can answer you.

The app does not access your contacts, location, microphone or files beyond those you choose to upload, and it does not show ads.

2. How We Use Your Information

Legal Basis (GDPR): Performance of contract, legitimate interests, consent (for marketing), legal obligation

3. Data Sharing and Disclosure

3.1 Service Providers (Data Processors)

We share data with third-party service providers who process it on our behalf:

• Hosting: Railway (cloud hosting platform)
• Database: PostgreSQL, Redis (session management)
• Payment Processing: Paddle Billing
• Analytics: Google Analytics (with IP anonymization)
• Email: Transactional and marketing email service providers
• Support chat: tawk.to
• Push notifications: delivered through your device's or browser's push service (for example Google Firebase Cloud Messaging on Android). The notification text is encrypted in transit.

3.2 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or valid government request. We will notify you when legally permitted and disclose only the minimum information required.

4. Multi-Tenant Data Isolation

OfficeStoreApp operates as a multi-tenant SaaS platform. We implement comprehensive data isolation to ensure your organization's data is completely separated from other organizations.

5. Data Security

Technical Security

• Encryption: AES-256 at rest, TLS 1.3 in transit
• Access Controls: Role-based access control (RBAC), MFA available
• Infrastructure: Firewalls, intrusion detection, DDoS protection
• Application: Input validation, SQL injection protection, XSS/CSRF protection

Data Breach Notification

In the event of a data breach, we will notify affected users within 72 hours (GDPR) via email and in-app notification, including information about the breach, affected data, and steps to take.

6. Data Retention

Deleting your account: You can delete your own account, or an admin can delete the whole organization, at any time from inside the app or website. This takes effect immediately. Requests you made stay in your organization's records as "Deleted user" without your personal details. See how to delete your account.

Audit Logs: Retained for 7 years to comply with regulatory requirements

Financial Records: Billing and payment records retained for 7 years

7. Your Data Protection Rights

For EU/EEA Users (GDPR)

• Right to Access: Request a copy of your personal data in a structured format
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Data Portability: Receive your data in machine-readable format
• Right to Object: Object to processing based on legitimate interests

For California Users (CCPA)

• Right to know what personal information we collect and how we use it
• Right to delete personal information
• Right to opt-out of sale (Note: We do NOT sell personal information)
• Right to non-discrimination for exercising your rights

8. Cookies and Tracking Technologies

Types of Cookies We Use

• Essential Cookies (Required): Session management, authentication, security
• Functional Cookies (Opt-in): Remember preferences, language settings
• Analytics Cookies (Opt-in): Google Analytics with IP anonymization

Managing Cookies: You can manage cookie preferences in your account settings or browser settings. Essential cookies are required for the Service to function.

9. International Data Transfers

OfficeStoreApp is operated by Sevinfi Solutions, and customer data is hosted on cloud infrastructure in the United States. For users in the EU/EEA, we ensure adequate data protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Encryption during transfer and at rest
• Access controls and data minimization
• Regular compliance audits

10. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your data:

Response Time: We respond to privacy requests within 30 days (GDPR) or 45 days (CCPA).