Privacy & your data

Business Core POS · Mawazo Technology
Privacy notice updated 27 September 2026.

Your app records

Products, sales, stock movements, expenses, customers, documents, cash records and business settings are stored locally so the app can work offline. For a normal owner account, automatic backup and multi-device sync are on by default. When the device is online, the account's business snapshot, business profile and sync metadata are stored in Firebase. Account details and authentication are also handled by Firebase.

The owner console

Signing in uses the same Firebase project as the app. The console uses essential browser session storage to keep you signed in for the session. Organization records, registered-device names, roles, permissions, suspension or blocking status, sync preferences and administrative activity are stored in Firebase. Admin passwords and device PINs are processed into salted verifiers; plaintext values are not included in activity logs or business exports.

A signed-in device registers basic device information, such as its manufacturer, model, operating-system version and app version, so the owner can recognise and manage it in the console. Blocking a device can sign it out and clear its local Business Core data when it next checks the policy online.

Service providers

Cloudflare serves this website. Firebase provides authentication and cloud services. These services receive network and security information needed to handle requests. If enabled for the deployed console, Google reCAPTCHA Enterprise/App Check helps protect backend requests from abuse. This site does not add advertising or behavioural analytics.

Camera, recognition and sharing

The Android app uses camera access for actions you request, such as scanning barcodes. Selected images and PDFs used for stock recognition are processed on the device. When you share a document, the selected external service, such as WhatsApp, handles the shared content under its own policy.

Reminders and online features

If notifications are enabled in the app, device reminders may use locally recorded business conditions. Push delivery may register a device token and delivery metadata in Firebase. The optional currency converter requests rates for the selected base currency; it does not send your transaction amounts or business ledger.

Your choices

You can sign out, control notifications, erase only the local copy on a device, or permanently delete the account and associated cloud data. In the app, open Menu → Settings → Security & account → Delete account and cloud data. Password and PIN confirmation are required. You can also read the deletion instructions or request help on the account deletion page.

Contact

Questions, corrections or recovery requests: [email protected].

Limited provider security, billing and abuse-prevention logs may remain for the provider's required retention period after an account is deleted. They are not available as a Business Core workspace backup.