Privacy policy

Bereka Stock is operated by Abdi Mohamed, an individual developer in Ethiopia. Contact berekastock@gmail.com for support and privacy requests.

Information we use

We use your name, email, account identifiers and sign-in details to provide and protect your account. We store the business contact details, staff permissions, products, stock, sales, returns, purchases, debts, expenses and subscription records entered into Bereka Stock. These records may include customer and supplier names, phone numbers, addresses and notes.

Photos you choose for products or your business are uploaded to provide those features. Barcode camera frames are processed on your device. The decoded barcode is sent to look up the product. Camera and photo access are used when you choose the relevant feature.

Barcode scanning uses Google ML Kit. Its SDK can send installation identifiers, device and app information, usage events, processing timings and error codes to Google for diagnostics and usage analytics. Camera image processing takes place on the device; this technical reporting is separate from uploading product photos. See Google’s ML Kit data disclosure.

Why and where information is processed

We use information to run the app, calculate stock and balances, control business access, manage subscriptions, respond to support requests and protect the service. Authorized members see business records according to their permissions.

Supabase provides account, database and file storage services; the current project is hosted in Mumbai, India. Google handles optional Google sign-in and configured account and support emails. Google Apps Script helps us track and delete closed email requests. Cloudflare hosts our administrator and public information websites. Providers may process IP addresses, approximate country or city inferred from those addresses, connection details and security logs to operate and protect the service. We do not request GPS location. Information may be processed outside Ethiopia.

If you choose WhatsApp or Telegram to discuss membership, the app opens that service with a prepared message containing your membership request number, package duration and amount. The service receives information when you use it, under its own privacy terms. Reports you choose to share also go to your selected recipient or service. The current release has optional centralized error monitoring disabled.

Account deletion and business records

Use Profile → Privacy and account deletion, or follow the web deletion instructions. Completed in-app deletion removes your sign-in account and profile, revokes sessions and removes direct identity links from membership history.

In-app deletion can close solely owned businesses with your consent. It preserves historical stock and financial entries with a neutral actor label. Businesses with another owner continue to operate. Shared images may remain with those businesses. Orphan uploads and images belonging to closed businesses are queued for removal.

A verified support request can also be handled through the administrator's deletion workflow, which removes solely owned businesses and their data while preserving shared businesses. Tell support which businesses your request covers. We will confirm its scope before processing.

Retention and security

We use encrypted connections and account and business access controls. Local drafts, preferences and exported files may remain on your devices. Copies shared with other people and historical backups have separate lifecycles.

We keep account and profile information while needed to provide your account, and remove it following a verified deletion request. Business stock and transaction records remain as described above. Business records remain while the business is maintained in the service, including the historical entries described above. A verified support request can remove solely owned businesses and their data. Records shared with a continuing business remain for that business. We do not promise a fixed statutory retention period; if a legal obligation prevents a particular deletion, we will identify the affected records, reason and applicable period in our response.

• Our identified local backups: eligible for deletion 30 calendar days after backup creation and removed at the next hourly cleanup while the computer and owner session are available. Offline time or a failed run can delay removal. This does not promise removal from every backup within 30 days of account deletion.
• Completed deletion records: eligible for cleanup 90 calendar days after completion, normally at the next hourly run. Unfinished work and records still needed by dependent cleanup jobs remain until those jobs are resolved. These records are separate from security logs.
• Support email: removed from our mailbox 6 calendar months after the operator marks the request closed and the hourly tracker records closure, at the next successful cleanup. A new message reopens the request. This policy covers tracked email correspondence, not separate WhatsApp, Telegram or bank records.

We aim to acknowledge deletion requests within 2 business days of receipt and complete deletion within 7 calendar days after account ownership is verified. In-app deletion may finish sooner. If a legal retention requirement affects the request, we will explain the affected data, reason and applicable period.

Provider backups and logs

Removing data from our active systems or mailbox does not immediately remove every provider copy. Google's published deletion process generally takes around 2 months after deletion; its encrypted recovery backups can retain data for up to 6 months. Google describes possible delays and longer retention for purposes such as security and legal obligations. These periods begin separately from our support-request closure period. See Google's retention policy.

Supabase's current Free plan provides 1 day of API/database log history. This is not a deletion deadline for all internal security records or backups. Google and Cloudflare also apply their own service, security and legal retention rules. Provider records and security/audit events may remain for operating and protecting the service, investigating incidents and meeting applicable legal requirements; their retention is separate from completed deletion receipts. We do not promise that every security log is erased within 90 days or that every provider backup is erased within 30 days. See Supabase's plan details and Cloudflare's privacy policy.

Membership messages in WhatsApp or Telegram and payment records have separate lifecycles from our email mailbox. They are used to manage membership, reconcile payments and resolve requests. Contact us to request their deletion. A bank or messaging provider may retain its own copies under its policies; deleting a Bereka Stock account does not delete those external accounts or every copy held by them.

Your choices

You can edit your profile, choose which photos to upload, export permitted records and request account deletion. For access, correction or deletion questions, email berekastock@gmail.com. Keep passwords and verification codes private.