Privacy policy

This policy applies to the public ZAFSO website, invited user accounts, organization and shop workspaces, customer and supplier records, invoices, and related support or security communications.

An organization using the workspace decides what customer, supplier, staff, and transaction information its authorized users enter. That organization is responsible for collecting and using this operational information lawfully. ZAFSO operates and secures the platform and handles account and service information as described here.

Account information. We process names, email addresses, password hashes, account status, assigned role and shops, invitation records, and whether credentials or Google sign-in are connected. When Google sign-in is used, Google provides basic profile information such as name, email address, and profile image according to the permission screen shown by Google.

Business and transaction information. Authorized users may enter organization and shop identity, addresses, phone numbers, GSTINs, products, stock movements, suppliers, customers, customer phone or WhatsApp numbers, purchases, sales, returns, payments, invoices, outstanding balances, and correction reasons.

Technical and security information. We may process IP addresses supplied through our hosting and Cloudflare infrastructure, request timestamps, authentication events, rate-limit records, device or browser information present in standard requests, and append-only audit events about sensitive workspace activity.

Communications. We process information included in support requests, invitations, password-reset requests, transactional emails, and invoice-delivery requests.

We use information to authenticate invited users; enforce shop and role permissions; operate inventory, checkout, purchasing, payments, invoices and reports; send account emails through Resend; deliver an invoice when an authorized user requests it through WhatsApp; prevent duplicate or abusive activity; investigate errors; maintain financial and security audit trails; and comply with applicable obligations.

We do not currently use the workspace data for behavioural advertising, and we do not sell personal information.

Information is visible to authorized owners, managers, and cashiers according to their role and assigned shops. We also use service providers needed to operate ZAFSO, including hosting and network providers, MongoDB for data storage, Google for optional sign-in, Resend for transactional email, and Meta when a user sends an invoice through WhatsApp.

Each provider handles information under its own terms and privacy commitments. We may also disclose information when legally required, to protect people or the service, to investigate misuse, or as part of a business reorganization subject to appropriate safeguards. We do not give one organization access to another organization’s shop database.

ZAFSO uses cookies and similar browser storage that are necessary for authentication, session continuity, security, and user-requested preferences. We do not currently place third-party advertising cookies on the public site.

We use access controls, password hashing, encrypted transport, database isolation, rate limiting, transaction safeguards, restricted operational routes, and audit records. No system can guarantee absolute security, so owners should remove access promptly when staff leave and users should protect their credentials.

We retain account and workspace information for as long as the organization uses ZAFSO and as needed for security, dispute resolution, contractual, tax, accounting, or other legal purposes. Posted financial documents, inventory movements, ledger entries, and audit events may be retained longer because they form part of the organization’s business record. Expired invitation and password-reset records are scheduled for automatic deletion, while backups may persist for a limited restoration cycle.

Our providers may process information in India or other countries where they operate. Where information crosses borders, we rely on the provider’s contractual and security measures and any safeguards required by applicable law.

Depending on your relationship with ZAFSO and applicable law, you may request access to or correction of personal information, ask for deletion where retention is not required, withdraw a consent, raise a grievance, or ask how information is being used. Workspace customers and suppliers should ordinarily contact the organization or shop that collected their information first.

Account holders may contact us directly. We may need to verify identity and authority before acting, and some requests may be limited where records must be preserved for financial integrity, fraud prevention, legal compliance, or the rights of others.

The restricted operations workspace is intended for adults authorized to work for an organization and is not directed to children. Organizations must not create staff accounts for anyone who cannot lawfully agree to these terms.

We may update this policy as the service, providers, or legal requirements change. Material updates will be posted here with a revised effective date and, where appropriate, communicated to account holders.

For a privacy question, rights request, or grievance, email [email protected]. Please describe your relationship with ZAFSO and the organization or shop concerned, but do not email passwords or full payment details.