1. Who is responsible
Aquate Enterprises Pvt Ltd (company registration C13642021) is the data controller for account, identity and usage data. For the business data you enter into the Service (such as employee, payroll, sales and accounting records), we act as a processor on your behalf; a Data Processing Agreement is available to business customers on request. Privacy contact: info@aquatemv.com.
2. Data we collect
- Account and identity data — name, email and the Google account you sign in with.
- Billing metadata received from Paddle — such as country, plan and transaction references. We do not receive or store full card numbers.
- Usage, log and device data — actions in the app, IP address, browser and timestamps.
- Cookies and similar technologies needed to run the app and keep you signed in.
- Customer business data you upload — staff, payroll, sales, purchase and accounting records.
3. Why we use it
To provide and operate the Service; authenticate users; process subscriptions through Paddle; provide support; secure the Service and prevent fraud; improve our product; and comply with legal obligations.
We do not use your personal data for marketing without your opt-in consent, and we do not use the customer business data you upload for any purpose other than providing, securing and supporting the Service (or as you instruct us). We never sell your personal data.
4. Legal bases
Where the GDPR applies, we rely on: performance of our contract with you; our legitimate interests in operating and securing the Service; your consent (for example, non-essential cookies or marketing); and compliance with legal obligations.
5. Payments and Paddle
Our reseller Paddle.com is the Merchant of Record and processes checkout, billing and payment data as an independent controller. We do not store full payment card details. See Paddle’s Privacy Notice.
Paddle shares only limited order data with us — such as country, plan and a transaction reference — for order fulfilment, support and fraud prevention; we never receive full card details. Bizlight itself is not a payment processor, money transmitter or merchant-services provider: the only payment processed in connection with the Service is your own Bizlight software subscription, collected by Paddle.
6. Processors and sub-processors
- Paddle — payments & Merchant of Record (privacy).
- Supabase — database & authentication hosting, EU/US regions (privacy).
- Vercel — application hosting & content delivery (privacy).
- Google — sign-in / OAuth authentication (privacy).
- Resend — transactional email delivery, e.g. sign-in codes & account notifications (privacy).
A current list of sub-processors and a Data Processing Agreement are available to business customers on request at info@aquatemv.com.
7. International transfers
Aquate Enterprises Pvt Ltd is based in the Republic of Maldives, and our infrastructure providers host data in EU and/or US regions, so your data is processed internationally. Where personal data from the EEA, UK or Switzerland is transferred outside those regions (including to us in the Maldives), we rely on appropriate safeguards such as Standard Contractual Clauses and equivalent measures.
8. Retention
We keep account and usage data while your account is active and delete or anonymise it within 30 days after account closure; encrypted backups are purged within a further 30 days. Where the law requires it, certain records (for example transaction, invoice and tax records) are retained for up to 7 years to meet tax and accounting obligations. The business data you upload follows the export-then-deletion schedule in our Terms.
9. Your rights
Subject to applicable law, you may request access to, correction, deletion, restriction or portability of your personal data, and may object to or withdraw consent for certain processing. To exercise these rights, email info@aquatemv.com. You may also complain to your local data protection authority.
10. California rights
If you are a California resident, you have rights to know, delete and correct the personal information we collect, and to opt out of any “sale” or “sharing”. We do not sell your personal information. We will not discriminate against you for exercising these rights.
11. Cookies
We use strictly necessary cookies to run the app and keep you signed in, and may use limited functional cookies. You can control cookies through your browser settings; disabling essential cookies may break core features.
12. Security
We use encryption in transit and at rest, access controls and reputable hosting (Supabase, Vercel). No system is perfectly secure, but we take reasonable measures to protect your data and will act promptly on any incident.
13. Children
The Service is a business product and is not directed to children. We do not knowingly collect personal data from children.
14. Changes and contact
We may update this policy and will revise the “Last updated” date above; material changes will be notified through the Service or by email. Questions: info@aquatemv.com, phone +960 788 5660.