Privacy policy

Who we are

SAHI Company for Computer Systems Development and Consulting Limited, Gulan Street, English Village, No:134, Erbil-KRG-Iraq. For anything on this page, write to support@sahi.company.

Who can use SAHI ONE

Accounts are opened for the company's staff by its administrator, by invitation. Nobody can sign up on their own, and the system is not offered to the public or to children.

What we keep

About a person who has an account:

• Account details: name, work e-mail address, phone or WhatsApp number, role, department and job title, and a profile picture if one is added.
• Staff record, where the company has filled it in: home address, date of birth, the date you joined, an emergency contact (a name, a phone number and how they are related to you), notes, and employment documents that were uploaded.
• Sign-in: your password is kept only in a scrambled form that cannot be read back, by the service that signs you in. If you switch on two-step sign-in, its secret is kept the same way.
• The work you record: quotes, invoices, deliveries, stock movements, repair jobs, expenses, advances and similar records carry the name of the person who wrote or changed them.
• Money between you and the company: advances you were given and what you spent from them, the expenses and receipts you entered.
• Photographs and documents you attach: receipts, signed papers, delivery photographs, product pictures. You choose each one from the camera or your photo library; the app does not look at anything you did not choose. Before a photograph is uploaded, the details the camera wrote into it — the place it was taken, the camera, the time — are removed.
• A record of activity: who signed in and who did what, with the time, the internet address (IP) and the type of browser or device. It is kept for security and to answer "who changed this?".
• Notification choices and devices: which messages you want, and, if you switch notifications on for a device, the address your browser or phone gives us so a message can reach it.
• Cookies: one set keeps you signed in; a few remember choices such as the language of the help pages. There are no advertising cookies.

About other people, typed in by staff in the course of business:

• Business contacts: names, phone numbers, e-mail addresses, postal addresses and tax numbers of customers and suppliers and of the people who work for them.
• Payment details of the companies we pay: bank names and account numbers on bank transfer forms.
• The name of the person who signs for a delivery or accepts a quote, and the signed paper itself.

What we do not do

• We do not ask for your location and the app does not use it.
• We do not read your address book, your calendar or your photo library.
• We do not track you across other apps or websites, and there is no advertising in SAHI ONE.
• We do not use analytics or advertising kits from other companies.
• We do not sell personal data or pass it on for anyone else's marketing.

Why we keep it

To run the company's daily work — selling, buying, stock, service, deliveries, money owed and paid — to keep the records a business must keep, to tell the right person when something needs them, and to keep the system secure.

Who handles the data for us

SAHI ONE runs on services provided by other companies. They handle the data on our instructions:

• Supabase — the database and the sign-in service. The records listed above are stored here, in the European Union.
• Vercel — hosts the application. Every request passes through it, and it keeps technical logs of requests.
• Bunny CDN (bunny.net) — stores the photographs and documents that are attached.
• Twilio — delivers WhatsApp messages. It receives the phone number a message goes to and the text of the message.
• Anthropic (Claude) — helps staff write product descriptions, choose product pictures, translate a short note, read supplier payment documents, check the photograph of a signed delivery receipt and read the photograph of an expense receipt. It receives the text or the document concerned, which can include the names and bank details printed on a supplier's invoice, the name and signature a customer's representative wrote on a delivery receipt, and whatever a shop printed or wrote on a receipt (its name, a vehicle's number).

When you switch notifications on for a device, the message travels through the notification service of that device's maker (Apple, Google, Mozilla or Microsoft). For the iPhone app that is Apple's push service, and we keep the address (a device token) Apple gives the app for your phone until you switch notifications off, sign out, or your account is closed.

A few other services are used without any personal data: product picture search receives a product's name, and exchange-rate sources receive nothing about anyone.

How long we keep it

Business records are kept for as long as the company needs them for its work and its bookkeeping duties. When someone leaves the company their account is closed, so it can no longer be used; the records they wrote stay, because they are the company's records.

Your choices, and closing an account

You can see your own details on the account page and ask the administrator to correct them. Because accounts are opened by the company, there is no sign-up and no self-service deletion inside the app: to have your account closed and your personal details removed, write to support@sahi.company. We will close the account and remove what we are not obliged to keep; the records you wrote for the company, and the record of activity, stay as the company's records.

How it is protected

The connection is encrypted, every person sees only what their role allows, and important actions are recorded. No system is perfectly safe; if you think your account has been misused, write to us at once.

Changes to this page

If what we keep or how we handle it changes, this page is updated and the date at the top changes with it.

Contact

support@sahi.company