Legal
Privacy Policy
Last updated: [date of publication]
1. Who this policy covers
This policy explains how [BarakahUp legal entity name] ("BarakahUp", "we") handles personal information. It covers three groups:
| Who | Example | Our role |
|---|---|---|
| Merchants | A shop owner who signs up | We decide how this data is used (controller) |
| Staff | A cashier with a PIN | We handle it for the merchant (processor) |
| Shoppers | Someone who orders a cake or gets a receipt | We handle it for the merchant (processor) |
When you shop at a store that uses BarakahUp, that store decides what it collects about you and why. Its own privacy notice applies, and questions about your data should go to the store first. We'll help the store answer them.
This policy also covers visitors to getbarakahup.com and the free demo.
2. What we collect
We collect only what the register and store pages need to work.
| From | What | Why |
|---|---|---|
| Merchants | Owner's name and email login, business name and settings, Stripe account ID, plan and billing details | To run the account and connect payments |
| Staff | Display name, role, PIN (stored only in scrambled, hashed form), a log of actions like sales, refunds and approvals | Sign-in, permissions, and a record the owner can check |
| Shoppers at checkout (optional) | Name, phone or email, rewards points, gift card balances, what they bought | Receipts, rewards and gift cards, only when the shopper gives these details |
| Shoppers who order ahead | Name, email, phone, pickup time, order notes, and for curbside pickup the car description they type | To prepare and hand over the order |
| Shoppers with a saved card | Card brand, last four digits, Stripe customer and card reference IDs | To charge standing orders they agreed to |
| Everyone | Sales and payment records: amounts, items, date and time, payment method | The store's accounts and refunds |
Card numbers. Full card numbers are typed into Stripe's own pages or Tap to Pay, never into BarakahUp, and we never see or store them.
Devices and browsers. The register saves some data on the device so it can work offline (for example sales waiting to be sent, and a copy of the store's products) and remembers light or dark mode. We use no advertising or analytics cookies. Our hosting provider, Cloudflare, sees IP addresses and basic request details to deliver pages and block attacks.
3. How we use it
We use personal information only to:
- run the register, store pages, orders, rewards and gift cards for the merchant
- process payments through Stripe and send receipts the shopper or staff asked for
- keep accounts secure, prevent fraud and fix problems
- bill merchants for their plan and send them service emails (for example a price change or an outage)
- meet legal duties, such as tax records or a valid legal request
What we never do:
- sell or rent personal information
- use it for advertising, or let advertisers track people on our pages
- share one merchant's customer list with another merchant
- contact a store's shoppers for our own marketing
We may use anonymous, combined statistics (for example, total sales across all shops) to improve BarakahUp. These never identify a person or a store.
4. Who we share it with
We share personal information only with the providers below, and only so they can run BarakahUp for us. Each may use it only for that service. All are US companies; Cloudflare delivers pages from servers around the world.
| Provider | What they do for us | What they see |
|---|---|---|
| Stripe | Card payments, saved cards, Tap to Pay, payouts to merchants | Payment details, and name, email and phone on orders |
| Cloudflare | Hosting our websites and payment service; sending receipt emails; forwarding email to our contact address | IP addresses, page requests, receipt email contents |
| Supabase | Database and sign-in for the register (US East data center) | All stored business, staff and customer data |
| Our support inbox (Gmail); web fonts on our pages | Emails sent to contact@getbarakahup.com; IP addresses when fonts load | |
| jsDelivr | Delivering open-source code files to the register | IP addresses when files load |
We also share information when the law requires it (for example a court order), to protect people from fraud or harm, or if BarakahUp is sold or merged (the buyer must keep these promises). Merchants can see their own customers' information.
5. Receipts, emails and texts
- Receipts. When a shopper asks for an email receipt, it is sent from receipts@getbarakahup.com in the store's name. It lists the items, totals, how they paid, and their rewards points if they gave their details. Receipts are not marketing.
- Store messages. Stores on the Customers & Rewards plan may send announcements only to shoppers who opted in. Every marketing email has an unsubscribe link. Text messages are not available yet; when they are, they will need a clear opt-in, honor STOP, and only be sent between 8am and 9pm.
- Saved cards. Shoppers who set up a standing order save their card on a Stripe page that says how and when it will be charged. They can ask the store to stop the order and remove the card at any time.
- Merchants. We email account owners about their account, billing, security and important changes. These can't be turned off while the account is open.
6. How long we keep it and how we protect it
Keeping. We keep a store's data while its account is open, so it has its sales history and customer list. When a merchant closes the account, we delete its data within [90] days. Records we must keep by law, such as billing and tax records, are kept for up to [7] years. A store can delete a shopper's details on request. Stripe keeps its own payment records under its own policy.
Protecting.
- Each business's data is kept separate in the database, and the database itself blocks one business from reading another's.
- Staff PINs are stored only as one-way hashes, and repeated wrong PINs lock sign-in for a while.
- All connections use HTTPS encryption.
- Payment keys live only in encrypted settings on our servers, never in the app.
- Card numbers never touch our systems.
No system is perfectly secure. If a breach affects your personal information, we will tell the affected merchants, and people where the law requires, without unreasonable delay.
7. Your choices and rights
Anyone can ask us to:
- see the personal information we hold about them
- correct it if it's wrong
- delete it
- get a copy in a common file format
Shoppers: your details belong to the store you shopped at, so ask that store first. If you write to us instead, we'll pass your request to the store and help it respond.
Merchants and staff: email contact@getbarakahup.com.
We reply within 45 days. To protect you, we may ask you to confirm who you are first.
Maryland residents. The Maryland Online Data Privacy Act gives Maryland residents the rights above. It also gives the right to opt out of the sale of personal data, targeted advertising and certain profiling. We don't do any of those. If we turn down a request, you can appeal by replying to our answer, and we'll respond to the appeal within 60 days. If you're still unhappy, you can contact the Maryland Attorney General. We won't treat you differently for using these rights.
Other choices: you can check out without giving a name, phone or email, and you can unsubscribe from store emails at any time.
8. Children, changes and contact
- Children. BarakahUp is for businesses and isn't aimed at children. We don't knowingly collect information from children under 13. Stores shouldn't sign up children for rewards or messages. If you think we have a child's information, contact us and we'll delete it.
- Changes. If we change this policy, we'll post the new version here with a new date. For important changes we'll also email merchants at least 30 days ahead.
- Contact. [BarakahUp legal entity name], [mailing address], contact@getbarakahup.com.