Privacy Policy

1. What we collect

Account details: your name, business name, phone/WhatsApp number, email, city. Business data you enter while using paiyaay: products, stock, customers, suppliers, invoices, payments, vehicles and the rest — this data belongs to your business (see Terms §5). Technical logs: sign-ins, actions and errors, kept to run and secure the service.

2. Your customers' data

Names, phone numbers and khata balances you record about YOUR customers are your records; we process them only to provide the service to you and never use them for anything of our own. Keeping that data accurate and lawful is your responsibility as the business.

3. How we use data

To run the product, to support you (including visible-impersonation support sessions), to send service messages (bills, reminders you trigger, important notices — usually by WhatsApp, because in Pakistan nobody reads email), and to meet legal duties. We do not sell data and we do not run advertising on your data.

4. Who ever sees it

Service providers who host and run paiyaay under contract: our servers (Hetzner, Germany), encrypted off-site backups (Cloudflare R2), and WhatsApp/Meta for messages you send or receive through WhatsApp. FBR/PRAL receive exactly the tax invoices you submit through the FBR add-on, on your instruction. Authorities, only where the law of Pakistan requires it. Nobody else.

On the trade network, other businesses see only what your settings publish: your business name, city, the listings you enable, prices per your visibility dials, and stock as ranges — never your raw books.

5. The website

paiyaay.com uses Google Analytics (via Google Tag Manager) to count visits and understand which pages help. It sets cookies for that purpose. The platform at app.paiyaay.com uses only the cookies needed to keep you signed in.

6. How it is protected

Every business's data is isolated at the database level (row-level security — one business can never query another's rows), connections are encrypted (TLS), FBR tokens are stored encrypted, access inside our team is limited and logged, and backups run daily to storage outside the primary server.

7. How long we keep it

While your account is active, plus 60 days after closure so you can export. Then it is permanently deleted, except: FBR submission records (kept 6 years as tax law requires) and rolling backups, which cycle out within 14 days. Trade-network dispute records are kept while the ban/consequence system needs them.

8. Your rights

See it, export it, correct it, delete it: most of that is self-serve inside the product (export any time; edit anything editable). For anything else — including account deletion — WhatsApp us or write to hello@paiyaay.com and we act within 14 days.

9. Changes and contact

If this policy changes in a way that matters, we tell you in the product or on WhatsApp before it takes effect. Questions: hello@paiyaay.com · WhatsApp +92 310 766 4619 · Paiyaay (Pvt) Limited, Islamabad, Pakistan.