NABOO SYSTEMS NABOO SYSTEMS

Privacy & Security PRIVACY POLICY

Privacy Policy

This policy explains how the NABOO app handles your data when you use it on Android, iOS, Windows, macOS, or the web version.

Last updated: June 10, 2026

1. Introduction

Welcome to NABOO — a store and point-of-sale management system (ERP/POS) developed by NABOO SYSTEMS. We respect your privacy and are committed to protecting your personal data and your business's operational data.

By using the app or our website at naboo.com, you agree to the practices described in this policy. If you do not agree, please do not use the service.

App name
NABOO — Integrated Business Management System
Package ID (Android)
com.basra.storemanager
Developer
NABOO Systems
Contact email
support@naboo.fun

2. Scope of this policy

This policy applies to:

  • The NABOO app installed on devices (Android, iOS, Windows, macOS).
  • The web version of the app hosted on our site.
  • The site's informational pages (downloads, contact, and legal pages).

It does not apply to external sites or services you open from within the app (such as Google pages during sign-in), which are subject to their own policies.

3. Data we collect

3.1 Account and identity data

  • Email address (for registration, OTP, or sign-in via Google).
  • Iraqi phone number (format 07…) when completing the owner's profile.
  • Username and role (owner, manager, employee).
  • The owner's PIN (stored encrypted — hashed with a salt — never stored as plain text).
  • Device identifier and name to link authorized devices to the account.

3.2 Operational business data

When you use the app to manage your store, the following data may be processed:

  • Invoices, sales, returns, and payments.
  • Customer and supplier data, debts, and installments.
  • Inventory, products, barcodes, and product images you upload.
  • Cash register transactions, shifts, and expenses.
  • Reports, dashboards, and operational activity logs.
  • Store settings, permissions, and the loyalty points log.

You are responsible for the accuracy of the data you enter about your customers and employees, and for obtaining any required consent before storing their data in the system.

3.3 Technical data

  • Device type, operating system, and app version (for technical support and security).
  • Anonymized technical error logs (never including passwords or PINs).
  • FCM token for owner notifications (when notifications are enabled).

3.4 Data we do not intentionally collect

  • We do not track your geographic location (GPS) — the app does not request location permission.
  • We do not sell your personal data to third parties.
  • We do not use your data for targeted advertising within the app.

4. How we use your data

  • Creating your account, verifying your identity, and signing you in.
  • Running store management functions (sales, inventory, reports, debts, etc.).
  • Syncing your data across your devices via the cloud when sync is enabled.
  • Sending operational notifications to the owner (alerts, reminders) upon consent.
  • Securing the account and preventing unauthorized access.
  • Responding to your inquiries and support requests.
  • Improving stability and security without using the data for external marketing purposes.

5. Legal basis for processing

We process your data based on:

  • Contract performance: to provide the store management service you requested.
  • Your consent: when enabling optional features (cloud sync, notifications, Google Sign-In).
  • Legitimate interest: for system security, fraud prevention, and service improvement.
  • Legal obligation: when there is an official request under applicable law.

6. Storage and security

6.1 Local storage

Part of your store's data is stored locally on your device in an SQLite database to ensure continued operation even without an internet connection.

6.2 Cloud storage

When sync is enabled, data is uploaded to a secure cloud infrastructure via Supabase, with multi-tenant data isolation so that no store can access another store's data.

6.3 Security measures

  • Encrypted connections via HTTPS/TLS.
  • PIN storage as a hash + salt, never as plain text.
  • Sensitive tokens stored in Secure Storage on the device.
  • Precise permissions for every employee within the store.
  • Soft deletion of financial records instead of unmonitored permanent deletion.

Despite our efforts, no system is 100% secure. We recommend using a strong PIN, protecting your device, and enabling a screen lock.

7. Sharing data with third parties

We do not sell your data. We may share the minimum necessary with trusted service providers:

Service Purpose Data involved
Google Sign-In Owner sign-in with a Google account Email, name, profile photo (per Google settings)
Supabase Authentication, cloud database, sync Account data and store data enabled for sync
Firebase Cloud Messaging Push notifications for the owner Device FCM token, tenant identifier
Firebase Hosting Hosting the site and web version Basic technical connection data for the visit

Each service provider is bound by its own privacy policy: Google, Supabase.

8. Device permissions

The app may request the following permissions — only activated when needed:

  • Internet: for cloud sync and sign-in.
  • Notifications: for operational alerts to the owner (can be disabled from device settings).
  • Camera: for scanning barcodes or capturing a product photo (when you use this feature).
  • Photos/Storage: to choose a product image from the gallery or save an attachment.

You can decline any permission, but some features may not work without it.

9. Cookies

The installed Android/iOS app: does not use browser cookies; it uses secure local storage for the session.

The web version and the informational site: we may use cookies or local browser storage to:

  • Maintain your login session.
  • Remember basic display settings.

We do not use advertising cookies or cross-site tracking. You can delete cookies from your browser settings at any time.

10. Data retention period

  • Account data: for as long as your subscription or active use of the service continues.
  • Store data: until you delete it or request account deletion.
  • Soft-deleted financial records: retained for a limited period for audit and compliance purposes.
  • Support logs: up to 12 months from the last contact, unless the law requires otherwise.

11. Your rights

Under applicable law, you can request to:

  • Access your personal data stored with us.
  • Correct inaccurate data.
  • Delete your account and personal data.
  • Export a copy of your store data (where this feature is available in the app).
  • Withdraw your consent to cloud sync or notifications.

To exercise any of the rights above, email us at support@naboo.fun with the email registered on your account. We will respond within 30 business days.

12. Children's privacy

NABOO is intended for adult store owners and employees, not for children under 13. We do not knowingly collect data from children. If you learn that a child has provided their data, please contact us to have it deleted.

13. International data transfers

Your data may be processed on servers outside Iraq (such as in Europe or the United States) via cloud service providers. We work with providers that comply with recognized security and privacy standards.

14. Updates to this policy

We may update this policy when adding new features or changing our practices. We will publish the updated version on this page with a "Last updated" date. Your continued use of the app after an update means you accept the new version.