1. Who is responsible
Aquate Enterprises Pvt Ltd (company registration C13642021, G. Hulhumale' Lot No. 10058, Republic of Maldives) is the data controller for account, identity and usage data. For the business data you enter into the Service (such as employee, payroll, point-of-sale and accounting records), we act as a processor on your behalf; a Data Processing Agreement is available to business customers on request. Privacy contact: mifraah@aquatemv.com.
2. Data we collect
- Account and identity data — name, email and the Google account you sign in with.
- Billing metadata received from Paddle — such as country, plan and transaction references. We do not receive or store full card numbers.
- Usage, log and device data — actions in the app, IP address, browser and timestamps.
- Cookies and similar technologies needed to run the app and keep you signed in.
- Customer business data you upload — staff, payroll, sales, purchase and accounting records.
3. Why we use it
To provide and operate the Service; authenticate users; process subscriptions through Paddle; provide support; secure the Service and prevent fraud; improve our product; and comply with legal obligations.
4. Legal bases
Where the GDPR applies, we rely on: performance of our contract with you; our legitimate interests in operating and securing the Service; your consent (for example, non-essential cookies or marketing); and compliance with legal obligations.
5. Payments and Paddle
Our reseller Paddle.com is the Merchant of Record and processes checkout, billing and payment data as an independent controller. We do not store full payment card details. See Paddle’s Privacy Notice.
6. Processors and sub-processors
- Paddle — payments and Merchant of Record.
- Supabase — database and authentication hosting (EU/US regions).
- Vercel — application hosting and delivery.
- Google — sign-in / OAuth authentication.
7. International transfers
Our infrastructure providers host data in EU and/or US regions. Where personal data from the EEA, UK or Switzerland is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses.
8. Retention
We keep personal data for as long as your account is active and as needed to provide the Service, then delete or anonymise it within a reasonable period after account closure, subject to legal retention requirements and routine backups.
9. Your rights
Subject to applicable law, you may request access to, correction, deletion, restriction or portability of your personal data, and may object to or withdraw consent for certain processing. To exercise these rights, email mifraah@aquatemv.com. You may also complain to your local data protection authority.
10. California rights
If you are a California resident, you have rights to know, delete and correct the personal information we collect, and to opt out of any “sale” or “sharing”. We do not sell your personal information. We will not discriminate against you for exercising these rights.
11. Cookies
We use strictly necessary cookies to run the app and keep you signed in, and may use limited functional cookies. You can control cookies through your browser settings; disabling essential cookies may break core features.
12. Security
We use encryption in transit and at rest, access controls and reputable hosting (Supabase, Vercel). No system is perfectly secure, but we take reasonable measures to protect your data and will act promptly on any incident.
13. Children
The Service is a business product and is not directed to children. We do not knowingly collect personal data from children.
14. Changes and contact
We may update this policy and will revise the “Last updated” date above; material changes will be notified through the Service or by email. Questions: mifraah@aquatemv.com, phone +960 788 5660.