Privacy & your data

Business Core POS · Mawazo Technology
Privacy notice updated 12 November 2026.

Your app records

Products, sales, stock movements, expenses, customers, documents, cash records and business settings are stored locally so the app can work offline. For a normal owner account, automatic backup and multi-device sync are on by default. When the device is online, the account's business snapshot, business profile and sync metadata are stored in Firebase. Account details and authentication are also handled by Firebase.

Your Business Core account

You can create a login, verify your email and request a password reset on this website. Firebase handles account authentication and sends the verification and reset emails. These links complete the action on Firebase’s secure page before returning to the website. Creating a website login does not create or replace business records. Use the same account in the app and console; your device PIN is separate from your account password.

The owner console

Signing in uses the same Firebase project as the app. The console uses essential browser session storage to keep you signed in for the session. Organization records, registered-device names, roles, permissions, suspension or blocking status, sync preferences and administrative activity are stored in Firebase. Admin passwords and device PINs are processed into salted verifiers; plaintext values are not included in activity logs or business exports.

A signed-in device registers basic device information, such as its manufacturer, model, operating-system version and app version, so the owner can recognise and manage it in the console. Blocking a device can sign it out and clear its local Business Core data when it next checks the policy online.

Public Store feedback

Store comments, replies and ratings are public and anonymous. No Business Core account or sign-in is required. An optional nickname and the text you submit are published immediately. Never include passwords, PINs, customer records or personal contact details.

A first-party, HttpOnly cookie lasts up to 180 days so the same browser can change its rating and remove its comments. Clearing this cookie, using another browser or letting it expire loses that management access. Store feedback is stored separately in Cloudflare D1; it is not linked to Firebase sign-in or your business records.

Cloudflare Turnstile checks submissions for bots. The feedback service uses keyed, daily hashes of network addresses for posting limits; it does not store raw IP addresses in its feedback database. Old posting-limit records are cleaned up after seven days when the service next receives submissions. Cloudflare may keep its own service and security logs.

You can report a comment privately, delete your own comments, or use “Manage or erase my feedback” in the Store to remove the comments, ratings and reports managed by that browser across all releases. A deleted comment may leave an empty placeholder so other people’s replies remain readable. Published feedback otherwise remains until its author deletes it or the site owner removes it for abuse. Contact support if you no longer have the management cookie.

Deleting a Business Core app account does not automatically delete anonymous Store feedback, because the two are not connected. Installer downloads are delivered from Cloudflare R2 and may generate normal provider access logs.

Service providers

Cloudflare serves this website. Firebase provides authentication and cloud services. These services receive network and security information needed to handle requests. If enabled for the deployed console, Google reCAPTCHA Enterprise/App Check helps protect backend requests from abuse. This site does not add advertising or behavioural analytics.

Camera, recognition and sharing

The Android app uses camera access for actions you request, such as scanning barcodes. Selected images and PDFs used for stock recognition are processed on the device. When you share a document, the selected external service, such as WhatsApp, handles the shared content under its own policy.

Reminders and online features

If notifications are enabled in the app, device reminders may use locally recorded business conditions. Push delivery may register a device token and delivery metadata in Firebase. The optional currency converter requests rates for the selected base currency; it does not send your transaction amounts or business ledger.

Your choices

You can sign out, control notifications, erase only the local copy on a device, or permanently delete the account and associated cloud data. In the app, open Menu → Settings → Security & account → Delete account and cloud data. Password and PIN confirmation are required. You can also read the deletion instructions or request help on the account deletion page.

Contact

Questions, corrections or recovery requests: info@businesscore.work.

Limited provider security, billing and abuse-prevention logs may remain for the provider's required retention period after an account is deleted. They are not available as a Business Core workspace backup.