Privacy Policy

1. Information we collect

Account data: name, email, phone number, shop name, role.

Operational data: customers and their family members, measurements, orders and garments, fabrics, suppliers, invoices, payments, and any documents you upload to your workspace.

Usage data: log-in timestamps, IP address, browser, pages visited, and actions performed inside the app — used to keep the service secure and to debug issues.

Cookies & local storage: session token, language preference, and dashboard UI state (such as theme and sidebar).

2. How we use your information

To provide, operate, and improve the service.

To keep your account secure and prevent fraud.

Where messaging is enabled, to send notifications on your behalf to your own customers (e.g. order-ready reminders).

To send service announcements (downtime, security advisories, feature updates) to the owners of your workspace.

We do not sell your data. We do not use your operational data to train AI models without explicit consent.

3. Data ownership

You own your data. Every customer, order, garment, and invoice you create remains yours. We act only as a processor on your behalf.

You may request an export of your data at any time. Upon termination, we will return or delete your data within 30 days, except where retention is required by law.

4. Multi-tenant isolation

Each shop's data is logically isolated using row-level security policies in our database. Users of one shop cannot access the data of another shop.

Platform administrators may access a workspace strictly for support purposes; such access is limited, treated as confidential, and never used to disclose your data to third parties.

5. Data hosting & sub-processors

We use Supabase for the database, file storage, and authentication, and Vercel for application hosting.

Where possible, data is stored in the UAE region or its closest data centre.

6. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Passwords are stored as salted hashes, never in plain text.

Access to production systems is limited to authorised personnel and is logged.

We follow industry best practices, but no system is 100% secure. Notify us at alyousefi715@gmail.com if you suspect a breach.

7. Your rights

You may request access, correction, or deletion of your personal data at any time.

You may withdraw consent for non-essential processing.

Contact us at alyousefi715@gmail.com to exercise any of these rights.

8. Retention

Active workspace data is kept while your subscription is active.

Security and access logs are retained for a limited period for safety purposes.

Backups are encrypted and pruned on a rolling window.

9. Children

Khayati is a business service for licensed shops and is not directed at anyone under 18.

10. Changes to this policy

We may update this policy from time to time. Material changes will be announced inside the dashboard at least 14 days before they take effect.

11. Contact

For privacy questions, write to alyousefi715@gmail.com.