Privacy Policy

Template — last updated October 2026. Review with a legal adviser (GDPR) before launch.

Data controller for platform accounts: ibi apps, Dublin, Ireland, multisilviu@gmail.com. For the stock and supplier data a Customer enters, the Customer is the controller and we act as processor.

What we collect

Account data: name, email, password (hashed), company details (name, address, registration and VAT numbers, contact details).
Billing data: subscription status and Stripe customer/subscription identifiers. Card details are collected and stored only by Stripe — never by us.
Service data: products, suppliers, stock movements, uploaded documents (invoices, delivery notes) and their extracted contents, audit logs of actions taken by users.
Integration data: Epos Now API credentials (encrypted at rest), imported products and sales transactions.
Technical data: IP address, browser type, timestamps, error logs, used for security and reliability.

Why we process it

To provide the Service you subscribed to (contract), to bill you (contract/legal obligation), to secure the platform and prevent abuse (legitimate interest), to send service emails such as verification, password reset, invitations and billing notices (contract), and to comply with law.

AI processing

When you upload a document for extraction it is transmitted to Anthropic's API, which returns the structured contents. Documents are not used to train models under the API terms. You decide what to upload and you review every result before stock changes.

Sub-processors

Cloudflare (hosting, database, file storage) — EU/global edge network.
Stripe (payments, invoicing).
Anthropic (AI document extraction).
Resend (transactional email), where configured.
Epos Now (point-of-sale integration), where connected by you.

Retention

Service data is retained while your company account is active. Closed accounts are deleted 90 days after closure. Pending registrations that never activate are deleted after 60 days. Security logs are kept for up to 30 days (informational) or 6 months (billing events).

Your rights

You can access, correct, export (Settings → Export) and delete your data, object to processing and lodge a complaint with the Data Protection Commission (Ireland). Contact us at the address above.

Security

Passwords are hashed with PBKDF2, sessions use HttpOnly cookies, each company's data is isolated by design and verified on every request, third-party credentials are encrypted, and all traffic uses TLS.

Cookies

We use only strictly necessary cookies (session) and local storage for your preferences (language, theme). No advertising or tracking cookies.