This Privacy Policy explains how KarbarX ("KarbarX", "we", "us") collects, uses, stores and protects information when you use the KarbarX website, web application, mobile app and related services (together, the "Service"). By using the Service you agree to this policy.
1. Who is responsible for data
KarbarX is business software. Each business that signs up (a "Workspace") enters its own records — products, invoices, customers, suppliers, employees and accounts. For that business data, the Workspace owner decides what is collected and why, and KarbarX processes it on the owner's behalf to provide the Service. For account and website data (for example, your sign-up details and how you use our website), KarbarX is responsible.
If you are a customer, employee or partner of a business that uses KarbarX and you have a question about your data, please contact that business first. We will help them respond.
2. Information we collect
Account information
- Name, email address, phone number, business name and password (stored only as a secure hash).
- Subscription and payment records (plan, billing dates, payment references). We do not store full card numbers.
- Optional security settings such as two-step login keys (we store only the public key) and authenticator settings.
Business data you enter
- Products, stock, purchases, invoices, quotations, payments, expenses and accounting entries.
- Customer, supplier, driver and employee records — names, phone numbers, addresses, balances, and documents or photos you upload.
- HR records such as attendance (including the time and IP address of QR attendance scans) and salary information.
- Notes, calendar entries and messages created inside the Service.
Usage and device information
- Log data such as IP address, browser type, pages visited, and the time and date of requests.
- An audit trail of changes made inside a Workspace, when the Workspace owner turns this on.
- Push-notification subscription details, if you allow notifications.
3. How we use information
- To provide, maintain and secure the Service, including backups and fraud and abuse prevention.
- To send the messages you or your Workspace ask us to send — invoices, payment confirmations, reminders and alerts by SMS, email, WhatsApp link or push notification.
- To provide optional features you turn on, such as the AI assistant or Google Calendar sync.
- To give support, process payments and communicate about your account.
- To understand usage and improve the Service, using aggregated information wherever possible.
- To comply with legal obligations under the laws of Bangladesh.
4. Google user data
If you choose to connect Google Calendar, KarbarX requests the calendar.app.created permission only. With it we:
- Create one calendar named "karbarX – your business" in your Google account.
- Add, update and remove events in that calendar only, so it shows the business dates you can already see inside KarbarX (deliveries, cheques, due dates, your notes and similar).
We cannot read or change any of your other calendars or events. We store your Google access tokens encrypted, and use them only to keep that one calendar in sync. You can disconnect at any time from the Business Calendar page, or revoke access from your Google Account settings.
KarbarX's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for advertising, is not sold, and is not used to train AI models.
5. Sharing and service providers
We share information only when needed to run the Service, with providers bound to protect it:
- Hosting and storage — our servers and cloud file storage (for example Cloudflare) for uploaded files and backups.
- SMS and email providers — to deliver the messages you or your Workspace send.
- Payment providers — to process subscription payments.
- AI provider — if your Workspace turns on the AI assistant, your questions and the related business figures are sent to Google Gemini to produce an answer.
- Google — only if you connect Google Calendar, as described above.
We may also disclose information if required by law, court order or a government authority, or to protect the rights and safety of our users and the public. If KarbarX is merged or sold, data may transfer to the new owner under this same policy.
6. Cookies and local storage
We use essential cookies to keep you signed in, protect forms against forgery and remember your language. The app also stores small preferences in your browser (for example table filters or a draft form) and may cache pages for offline use. We do not use third-party advertising cookies.
7. Security
- Encrypted connections (HTTPS) between your device and our servers.
- Passwords stored as one-way hashes; sensitive keys and tokens stored encrypted.
- Each Workspace's data is kept separate from every other Workspace.
- Role-based permissions so owners decide what each staff member can see.
- Optional two-step login with a key file or authenticator app.
- Regular backups.
No system is perfectly secure. If we learn of a breach that affects your data, we will notify affected Workspace owners without undue delay.
8. Retention and deletion
We keep Workspace data for as long as the account is active. Some audit records are deleted automatically after a set period. If a Workspace is closed, we delete or anonymise its data within a reasonable time, except where we must keep records to meet legal, tax or accounting obligations, or to resolve disputes. Backup copies are overwritten on their normal cycle.
To request deletion of your account or Workspace, email us at the address below.
9. Your choices and rights
- Access and correction — you can view and edit most information directly in the app.
- Export — Workspace owners can export reports and request a copy of their data.
- Deletion — you can ask us to delete your account, subject to the legal holds above.
- Notifications — you can turn off push notifications in your browser or in your notification settings.
- Connected services — you can disconnect Google Calendar or turn off optional features at any time.
10. Children
The Service is for businesses and is not directed to children under 18. We do not knowingly collect personal information from children.
11. Changes to this policy
We may update this policy from time to time. We will change the "Last updated" date above, and for significant changes we will notify Workspace owners by email or inside the app.
12. Contact us
Questions or requests about privacy:
KarbarX, Bangladesh
Email: hello@karbarx.com