Privacy Policy

Last updated: 10 November 2026

Baqilak is a mobile app that helps small sellers in Oman record customer orders, deposits and payments. This policy explains what information we hold, why we hold it, and the choices you have. We wrote it to be read, not skimmed past.

Who we are

Baqilak is operated by Qorinx OÜ, registry code 17422930, Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond, 15551, Estonia. Email: [email protected]. In this policy, "we" and "us" mean Qorinx OÜ. This policy covers the Baqilak app and website.

Two kinds of information

For account administration, support, security and subscription management, Qorinx OÜ is the data controller: we determine why and how your personal data is used.

For customer and business records you enter, you determine why the data is collected and used. We process those records on your instructions to provide Baqilak. You are responsible for the information you give your customers and for your lawful basis for processing their data.

What we collect

The marketing website does not offer account sign-in or collect payments. It uses self-hosted Sentry for error and sampled performance monitoring. It does not use advertising pixels. With your permission, Google Analytics measures page visits and clicks on App Store and Google Play links, including the source of the visit. With your permission, Microsoft Clarity records website interactions to provide heatmaps and session recordings. Clarity does not load before you accept analytics. We do not send app account identifiers to Clarity, and advertising storage is denied. Advertising personalization and Google signals are disabled. You can decline or withdraw permission using Analytics choices in the footer.

We remember your website analytics choice on your device for 180 days. With permission, we also remember the campaign source for the current browser tab session and Google Analytics and Microsoft Clarity may set analytics cookies. Declining clears their first-party analytics cookies and the saved campaign source and stops future analytics collection. Store links contain campaign labels that let Apple and Google report aggregate store performance; they do not identify individual installers to us.

The app uses Google Analytics for Firebase for usage statistics. Collection is enabled by default and can be switched off in Settings under Privacy. Advertising personalization is disabled. Switching off usage statistics does not disable authentication, subscription processing or error monitoring.

Account details: email address, display name, authentication identifiers, and information supplied by Apple or Google if you choose social sign-in. Firebase Authentication handles email/password sign-in and account verification.
Business profile: business name, owner name, business category and business phone number.
Customer details you enter: customer names, phone numbers and any notes you add.
Order and payment records: items, prices, due dates, deposits, payments, refunds and notes.
Settings: language, reminder templates and privacy preferences.
Subscription information: app account identifiers, purchase and transaction identifiers, subscription status and entitlement history. App stores handle your payment details.
Technical information: device and app version, usage events, diagnostic errors, account identifiers used for troubleshooting, and service and security logs.
Support information: your contact details and the content of messages you send us.

How we use it

We do not sell personal data. We do not use your customers' phone numbers to contact them, market to them, or share them with advertisers.

To provide the app: storing orders, calculating balances and showing what is due or overdue.
To authenticate you, protect accounts and investigate errors or misuse.
To prepare WhatsApp reminders when you request them.
To manage subscriptions and respond to support requests.
To understand app usage and improve the service, subject to your analytics setting.
To meet legal obligations and establish, exercise or defend legal claims.

Order notifications

With your permission, we send payment-due notifications to your device through Firebase Cloud Messaging. We store an encrypted push token and your device timezone to schedule reminders at 09:00 in your local time. The timezone is updated when you open or resume the app. Tapping a notification opens the relevant order after sign-in. Notifications do not send WhatsApp messages to your customers. Turn notifications off in your device settings to stop receiving them. Inactive device registrations are deleted after 90 days, and delivery records after 60 days.

WhatsApp reminders

Baqilak does not send messages on your behalf. When you tap a reminder, the app opens WhatsApp on your phone with a prepared message. You choose whether to send it. Once a message is in WhatsApp, it is handled under WhatsApp's own terms and privacy policy. Opening WhatsApp does not tell us whether a message was delivered or read.

Your responsibilities for customer information

Because you choose what to record about your customers, you are responsible for having a lawful reason to keep their details and to contact them, for example to follow up on an order they placed with you. Record only what you need, and keep it accurate.

Legal bases

As an Estonian operator, we process personal data under the GDPR and other applicable data protection laws. Account and subscription processing is necessary to perform our agreement with you. Security, troubleshooting and service improvement serve our legitimate interests in running a reliable service, subject to your rights. We also process information to comply with legal obligations. Where consent is required, that processing requires your consent and you may withdraw it.

We need account information to provide access and subscription information to enable paid features. Without the required information, we cannot provide those services. Customer records are processed on your instructions; you determine the lawful basis for collecting and using them.

Hosting and international processing

Our application servers and primary database are hosted by Hetzner in Germany, EU. This does not mean all services process data only in the EU. Firebase Authentication processes authentication data in the United States. Google analytics, Microsoft Clarity and RevenueCat may also process data outside the European Economic Area, including in the United States.

International processing is subject to the applicable provider data processing terms and transfer safeguards, including European Commission standard contractual clauses where applicable. Contact [email protected] for information about the safeguards relevant to your data or to request a copy.

How long we keep it

We keep account and business records while your account is active. When you request account deletion in Settings, normal access is suspended and a 30-day restoration window begins. Sign in and choose Restore account before the scheduled deletion date to cancel deletion and keep your account and records.

After the 30-day window, the account becomes eligible for permanent deletion through our scheduled deletion process. This removes the sign-in account and records of businesses that have no other members. Records belonging to a business with other members remain available to that business. If deletion encounters an error, we retry it. Permanent deletion ends the account restoration option.

Backup copies are retained for a maximum of 60 days from their creation. Data already removed from the live service may remain in an earlier backup until that backup expires. Backup retention does not extend the 30-day account restoration window or guarantee recovery after permanent deletion.

Support correspondence is retained for handling the request and any related dispute. Security and error records are retained according to their purpose, including investigating an incident and verifying its resolution. Records required for accounting or legal claims may be retained for the applicable statutory retention or limitation period. These exceptions do not require retaining all of your business records.

Security

Data is encrypted in transit (HTTPS). Each business's records are isolated from every other business, and access is checked on the server for every request. Exports are available only to the signed-in account owner. No system is perfectly secure, and we will notify you and the competent authority of a personal data breach as the law requires.

Your rights

Contact [email protected] to exercise your rights. Your customers should normally contact you about their business records; if they contact us, we will help route their request appropriately. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or another competent supervisory authority. Your rights depend on the applicable law and the circumstances of the processing.

Request access to your personal data and correction of inaccurate information.
Request erasure, restriction of processing or data portability where the law provides these rights.
Object to processing based on legitimate interests and withdraw consent where processing relies on consent.
Export orders and customers using the features available to your plan, or contact us to exercise your data protection rights.
Request account deletion in Settings and restore the account during the 30-day window.

Children

Baqilak is for sellers aged 18 or over. We do not knowingly create accounts for children.

Changes to this policy

If we make material changes, we will tell you in the app or by email before they take effect. The date at the top shows when this policy last changed.

Contact

Questions or requests about privacy: [email protected].