Privacy Policy
1. Who we are
Taf9eel (تفصيل) is a system for running a tailor shop, built in the Kingdom of Bahrain. This policy explains what the Taf9eel app and website hold, why, where it is kept and what choices you have. It is written for shops and their customers in Bahrain, where the Personal Data Protection Law (Law No. 30 of 2018) applies.
2. Shops and their customers
- Shops: the business that signs up, its owner and its staff.
- Customers of a shop: the people whose orders and measurements a shop records in Taf9eel.
A shop decides what it records about its own customers and is responsible for that information. Taf9eel stores and processes it for the shop, on the shop's instructions, and does not use it for anything else.
3. What we hold
- The shop's account: the sign-in email address and password (the password is kept only as a secure hash by our sign-in provider), and the shop's name, phone number, address, commercial registration and VAT numbers, logo and settings.
- Staff: each person's name and role, and a 4-digit PIN that is kept only as a hash.
- The shop's records: customers' names, phone numbers and areas; a company's VAT number and address; if a customer gives them, the day and month of their birthday (never the year) and how they found the shop; family or company members; measurements and their history; photos the shop takes of pieces, fabric, deliveries and receipts; preferences and notes; orders, invoices, payments, refunds, expenses, stock, suppliers and staff pay.
- Activity: a log of who did what and when (for example who changed a price), and a record of the WhatsApp messages staff opened from the app.
- On the device: a copy of recent data, kept in the browser so the app keeps working without the internet, and anything entered while offline until it is sent. So that the app can also open without the internet, the device keeps the shop's details and settings, its garment templates, and the names, roles and languages of its staff (never their PINs or pay). Signing out clears the copy of recent data and these details; entries typed offline and not yet sent stay on the device until they sync (they are sent when the same shop signs in on it again).
We do not collect payment card numbers. Neither the app nor the website shows adverts or loads advertising or analytics trackers.
4. Why we use it
- To provide the service the shop signed up for: orders, measurements, invoices, reports, backups and support.
- To keep accounts secure: PIN checks, actions only the owner can take, and the activity log.
- To manage the subscription: the trial, payments and renewal reminders.
We do not sell or rent information, and we never use a shop's customer list to market to those customers.
5. Messages to customers
WhatsApp messages such as "order received", "ready" or a balance reminder open in the shop's own WhatsApp, and the shop's staff press Send.
A shop can also switch on automatic messages. Taf9eel then sends a few kinds of message itself (order ready, a fitting reminder, a collection reminder, delivery on its way) through Meta's WhatsApp Business Platform, from the shop's own WhatsApp Business number. For each message Meta receives the customer's phone number, the message template and its language, and the details the message carries: the customer's name, the order number and the shop's name, plus the balance (order ready, collection reminder, delivery), the fitting time (fitting reminder), the date the order became ready (collection reminder) and the driver's name (delivery on its way). A test message the owner sends from Settings goes only to the number the owner types and carries Meta's ready-made greeting, with no customer details. The shop's access token is stored so that only the sending service can read it, and the shop can switch the messages off or disconnect at any time.
6. The order tracking page
Each order can have a private link that the shop shares with its customer. It shows the order's stages, dates and balance, and the shop's address. Anyone holding the link can open that page, so it should not be posted publicly. The link stops working 30 days after the order is delivered.
7. Where it is kept
Shops' data is stored by Supabase on servers in Mumbai, India (Amazon Web Services region ap-south-1), the nearest region to Bahrain that Supabase offers. The website and the app's files are served by Vercel. Information always travels encrypted (HTTPS), and each shop's records are walled off in the database so that no shop can read another's.
8. How long we keep it
- For as long as the shop's subscription is active.
- When a trial or paid period ends there is a 7-day grace period; after that the account becomes read-only and its data stays available for export.
- Backups are taken every night so data can be restored after a mistake. Each night's backup is kept for 30 days, and the one taken on the first of each month for 12 months, so a record deleted in the app can remain in a monthly backup for up to 12 months. When a shop is deleted, its backup files are removed 30 days after the last one.
- Invoices and payments may need to be kept for as long as tax law requires a shop to keep its records.
9. Your choices
- A shop can export all its data at any time: a full backup, and Excel or CSV exports.
- A shop can correct its records, archive customers, and delete a customer who has no orders.
- A shop can ask us to delete its account and data: see Data deletion.
- A customer of a shop should contact that shop to see, correct or delete their information; we help the shop do it.
10. Children
A shop may record children's measurements as part of a family. The shop is responsible for having the agreement of a parent or guardian.
11. Changes to this policy
A new version is published on this page with its date. Before a significant change takes effect, shops are told in the app or on WhatsApp.
12. Contact
WhatsApp +973 3686 6622