Privacy Policy

1. Who we are

Wafi Software, House B/109, Road 08, Mohakhali DOHS, Dhaka 1206, Bangladesh, provides a cloud business platform for small and medium businesses — e-commerce order management, point of sale, inventory, purchasing, accounting, reporting and AI customer care. This policy covers wafisoftware.com, the Wafi web application, and every module and add-on inside it. It should be read alongside our Terms of Service.

2. Our role and yours

Two different relationships run in parallel, and the distinction matters:

• For your account. When you register, sign in, get support or pay an invoice, we are the controller of that information and this policy governs it directly.
• For the data you put into the platform. Your products, orders, customers, ledgers and conversations are yours. You are the controller; we are the processor, acting on your instructions. We use that data to operate the service for you and for nothing else — no profiling, no resale, no advertising.

3. What we collect

We do not ask for special-category personal data (health, religious belief, biometrics and the like), and we ask that you do not upload it into free-text fields.

4. Why we use it

• To provide the service — run your workspace, sync stock across channels, produce invoices and reports, deliver AI answers grounded in your own data.
• To set you up — the free customization and onboarding included in your first month, which may involve our team configuring your account and, with your permission, migrating your existing records.
• To support you — diagnose problems and answer questions, which sometimes means a support engineer viewing your data under an access log.
• To bill you — issue invoices and record payments after your free month, if you choose to continue.
• To keep the platform safe and working — monitoring, backups, abuse prevention and audit logging.
• To improve the product — using aggregated, de-identified usage statistics that cannot be traced back to you or your customers.
• To meet legal obligations — tax, accounting and lawful requests from authorities.
• To send service and product messages — outages, releases and billing notices. Marketing emails are sent only with your consent and every one has an unsubscribe link.

We rely on the performance of our contract with you, our legitimate interest in operating and securing the platform, your consent where it is required (such as marketing), and compliance with the law.

5. Connected channels

If you connect WhatsApp Business, Facebook Messenger, Telegram, a payment gateway, a courier or a marketplace, we exchange only the data needed to make that feature work — for example receiving an inbound message and sending your reply, or pushing an order to a courier. Each provider processes that data under its own privacy policy, and you are responsible for holding the accounts and customer consents those providers require. You can disconnect any channel from inside the app at any time; doing so stops future exchanges immediately.

6. AI features & your data

7. Who we share it with

We never sell your data, and we do not share it for advertising. We disclose it only in these cases:

• Service providers (sub-processors) who help us run the platform — cloud hosting and storage, email and SMS delivery, AI providers, payment processing, error monitoring — each under a contract limiting them to our instructions.
• Channels and integrations you connect, as described in section 5.
• Your own users, according to the roles and permissions you configure.
• Professional advisers — auditors and lawyers — bound by confidentiality.
• Authorities, where we are legally required to disclose. Unless the law forbids it, we will tell you first.
• A successor, if our business is merged or acquired. This policy, or one at least as protective, would continue to apply.

A current list of sub-processors is available on request from [email protected].

8. Cookies & analytics

The web application uses strictly necessary cookies to keep you signed in, remember your workspace and protect against cross-site request forgery. On this marketing website we use a small number of preference cookies — for instance remembering which industry view you selected — and privacy-respecting analytics to count visits and understand which pages are useful. We do not run advertising or cross-site tracking cookies. You can block or clear cookies in your browser, though signing in will not work without the necessary ones.

9. How long we keep it

• While your account is active, we keep your data so the platform works and your history stays intact.
• After your account closes, you have 30 days to export everything. After that we delete or irreversibly anonymise it.
• Backups roll off within 90 days of deletion.
• Billing and tax records are kept for as long as Bangladeshi law requires, regardless of account closure.
• Support correspondence is kept for up to 24 months.

10. How we protect it

• Encryption in transit (TLS 1.2 or above) and at rest.
• Passwords stored only as salted hashes — no one at Wafi can read yours.
• Role-based access inside your workspace, so your staff see only what you allow.
• Least-privilege access for our own team, granted only when needed for support and recorded in an access log.
• Encrypted automated backups with tested restores.
• Monitoring, patching and audit logging of significant account actions.

No system is perfectly secure. If a breach affects your data we will notify you without undue delay, describe what happened and what we are doing, and report it to the relevant authority where the law requires.

11. Your rights & choices

For the data we hold about you and your account, you may ask us to:

• Access it, or receive a copy in a portable format;
• Correct anything inaccurate — most fields you can edit yourself in the app;
• Delete it, subject to records we must keep by law;
• Restrict or object to a particular use, including profiling — we do not profile you, but the right stands;
• Withdraw consent where processing relies on it, such as marketing email;
• Export your business records to PDF, Excel or CSV, at any time and without charge.

Email [email protected] and we will respond within 30 days. We may ask you to verify your identity first. If your customers exercise these rights against you, tell us and we will help you respond.

12. Your customers' data

When you use the platform to serve your customers, you decide what you collect from them and you are their controller. Please make sure you have your own privacy notice covering what you collect, that you have any consent your channels or the law require, and that you use the platform's messaging features in line with anti-spam rules. We process that data only on your instructions and delete it on the timeline in section 9.

13. Where data is stored

Your data is hosted on managed cloud infrastructure and may be processed in data centres outside Bangladesh, including in Singapore, the European Union and the United States, by us or by the sub-processors described in section 7. Wherever it goes, it stays protected by contractual safeguards — standard contractual clauses or equivalent — that hold each provider to the standards in this policy. Tell us if you have a specific data-residency requirement and we will discuss what we can do.

14. Children

Wafi Software is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18 as a platform user. If you believe a child's data has reached us in error, contact us and we will delete it.

15. Changes to this policy

We will update this policy as the platform and the law change. For a material change we will notify you by email or in-app at least 30 days before it takes effect. The "last updated" date at the top always reflects the current version, and continuing to use the service after a change takes effect means you accept it.

16. Contact us

If you are not satisfied with how we have handled a privacy question, tell us — we would rather fix it directly. You also have the right to complain to the competent data protection authority in your jurisdiction.