One privacy notice for all our services

Scope and roles

This notice applies to Themar, Cashier, WhatsApp Connect, WASLY, Payroll, Attendance (Hadir HR), and Phone Service. It does not apply to external websites or services that publish their own notices.

We act as a controller when we determine the purposes of account, subscription, security, support, and service-operation processing. When an organisation uses our products to manage its customers, employees, or communications, that organisation usually determines the purposes and we process the data on its behalf and instructions. Providers such as Meta may separately process data they receive under their own terms.

Data we process and why

• Account and organisation data: name, contact details, branch, role, permissions, and subscription data to create, operate, and support accounts.
• Business and transaction data: customers, employees, orders, invoices, inventory, taxes, payments, and accounting records to provide management, accounting, and delivery functions.
• Communications and content: contacts, messages, media, files, recordings, and shared location to operate the WhatsApp inbox and customer service.
• Delivery and location data: addresses, coordinates, courier foreground and background location, and proof images to perform, track, and settle deliveries.
• Workforce data: employment identity, attendance, location, salary, entitlements, deductions, and documents to provide attendance and payroll services to employers.
• Device, usage, and security data: device type and identifiers, IP address, sign-in, error, and notification logs to secure, diagnose, and protect the service from misuse.

Depending on the context, we rely on performing the service or contract, meeting legal obligations, legitimate interests that do not override your rights, and consent where required, including certain optional marketing or analytics activities.

Product-specific details

• Themar and CashierProcess organisation, customer, employee, order, invoice, inventory, and device data. Depending on the feature and device, Cashier may request NFC, Bluetooth, location, phone-state, camera, or file-selection permissions. It includes Firebase notifications, analytics, crash reporting, and remote configuration.
• WhatsApp ConnectProcesses contact names and numbers, conversations, messages, images, video, audio, documents, and location. It may request contacts, location, microphone, camera, photos, files, and notification access. WhatsApp traffic passes through Meta and the service uses Firebase notifications.
• WASLYProcesses merchant, customer, courier, order, address, coordinate, identity, document, proof-of-delivery image, rating, wallet, and settlement data. It uses courier foreground and background location while tracking is active and uses Google Maps, Firebase, and Sentry.
• PayrollProcesses employee, employment, salary, allowance, deduction, advance, attendance, payslip, bank or payment, and accounting records on behalf of the employer.
• Attendance (Hadir HR)Processes employee identity, branch, device, attendance times, and location when a location-based attendance action is performed, and uses Firebase notifications.
• Phone ServiceAfter phone permission is granted, reads incoming and missed calls only: caller number, time, duration, and type. It sends the requested recent results to the Cashier master discovered on the local network. It also processes a device identifier, name, model, app version, and local IP address.

Sharing and international transfers

We do not sell personal data. We disclose the minimum needed to hosting and infrastructure providers; Meta/WhatsApp; Google/Firebase and Google Maps; Sentry; mail, payment, or integration providers enabled by the organisation; competent authorities under a binding request; or a lawful corporate reorganisation subject to appropriate safeguards.

Some data may be processed outside your country depending on the product and provider. Before a transfer, we apply the relevant legal requirements and safeguards, minimise transferred data, and review contractual arrangements. You may request current information about processing destinations and safeguards through the privacy email.

Retention and destruction

We retain data while needed to provide the service and then for periods needed for tax, accounting, employment, security, and dispute obligations. Periods vary by category, and closing an account does not erase records that must lawfully be retained or are needed to protect rights.

WhatsApp Connect currently schedules webhook-processing record cleanup after 30 days and old local-media cleanup after 90 days. Other categories are deleted, anonymised, or isolated from active use when their purpose and applicable obligation end. Destruction covers active copies, while backups expire under their secure lifecycle.

Data security

We use technical and organisational measures suited to the nature of the data, including encrypted connections, role-based access, organisation-data isolation, credential protection, security activity logging, and backups. No electronic method is risk-free, so we review controls and limit access by need.

Your rights and choices

Subject to applicable law, you may ask to be informed about processing, access or receive a copy of your data, correct or complete it, request destruction when no lawful retention reason remains, and withdraw consent without affecting earlier processing. Additional rights such as restriction, objection, or portability may apply in your country.

If your data is held in a merchant or employer account, contact that organisation first because it usually determines the processing purposes. You may contact us for assistance; we will verify identity and refer the request to the relevant organisation where needed. We may deny or limit a request when retention is legally required or protecting others prevents full fulfilment, and will explain the reason where permitted.

Children's data

Our business and workforce products are not directed to children. Delivery orders may contain a minor recipient's data supplied by a guardian or merchant to complete the order; we use it only for that service purpose and to the necessary extent.

Cookies and analytics

This privacy site does not set analytics or advertising tools. Web dashboards may use cookies required for session and security functions, and some apps use diagnostics and analytics such as Firebase or Sentry. Where non-essential processing relies on consent, the product provides a way to choose or withdraw as required by its capabilities and applicable law.

Material changes

We may update this notice when products, providers, or legal requirements change. We will update the effective date and provide an appropriate in-service or registered-contact notice for material changes. We do not treat continued use as a substitute for fresh consent where explicit consent is legally required.

Contact and complaints