Privacy Policy

Cobitx is responsible for your account, billing and website information. For the business records you enter — parties, invoices, stock and ledgers — we act on your instructions: you decide what goes in, and we store and process it only to run the Service for you.

• Signup and account details: business name, your name, email, phone, city and province, and the plan level you choose. Your password is stored only in hashed form by our authentication provider; we never see it.
• Business records: everything you enter in the Service, including purchases, sales, stock, production, vouchers, ledgers, tax registers, your company logo and the contact details of your trading parties.
• Agreement records: when you accept our policies, the date and time, IP address, browser details and the version of each policy you accepted.
• Technical and security data: IP address, browser and device type, sign-in times and error logs.
• Payment information: card payments are handled by Paddle (outside Pakistan) and Safepay (in Pakistan), and we never receive or store card numbers. They share with us your name, email, country, what you bought and the transaction details; for auto-renew, Safepay keeps your card to charge it each month. For bank transfers we keep the amount and payment reference.
• Messages: what you send us by email or WhatsApp when you ask for help.

• to provide, maintain and improve the Service;
• to verify your email address and set up your workspace;
• to bill you, issue receipts and send renewal reminders;
• to answer support requests;
• to keep accounts secure and prevent fraud and abuse;
• to answer payment disputes and chargebacks with evidence of your agreement and use of the Service;
• to tell you about changes to the Service or these policies;
• to meet our legal, tax and accounting obligations.

We do not sell personal information, and we never use your business records for advertising.

Where the law requires a legal basis (for example for users in the UK or the European Union), we rely on performing our contract with you, our legitimate interest in securing the Service and defending disputes, our legal obligations, and your consent where we ask for it.

Your workspace is visible to you and the users you add. Our administrators can open a workspace to set it up, to support you when you ask, or to investigate a security, billing or technical problem — not for any other purpose.

We use a small number of service providers to run e-Rice. Each receives only what it needs and is bound to protect it:

• Supabase — database and sign-in, including the emails that confirm your address (servers in Singapore);
• Vercel — application hosting (Singapore region);
• Paddle — card payments outside Pakistan, as Merchant of Record;
• Safepay — card payments in Pakistan, including saved cards for auto-renew;
• Cloudflare — domain name service and the security check on the signup form.

We may also disclose information when the law requires it, to Paddle or Safepay, the banks and the card networks during a payment dispute, or to a successor if our business is transferred — in which case this policy continues to protect it.

Your data is stored on servers in Singapore and may be processed by our providers in other countries. We rely on their contractual and security safeguards to protect it wherever it is processed.

We use only the cookies needed to keep you signed in and secure. There are no advertising or third-party tracking cookies. Your browser also stores small preferences, such as whether you have dismissed the install banner, and Cloudflare’s security check may set its own technical cookie on the signup form.

• Account details and business records: for as long as your subscription is active, then 30 days for you to export them, after which they are deleted from our live systems. Backup copies expire on their normal cycle.
• Billing and agreement records: for as long as we need them to answer disputes and to meet tax and accounting law, which can be up to six years after the account closes.
• Security logs: for a limited period, then deleted.

All traffic is encrypted with HTTPS. Passwords are stored only in hashed form. Each workspace is kept separate inside the database by row-level security, so one business cannot read another’s records. No system is perfectly secure, but if a breach affects your data we will tell you as the law requires.

You can ask us to show you the personal information we hold about you, to correct it, to give you a copy, or to delete it, and you can object to or ask us to limit how we use it. Write to info@cobitx.com from your account email; we reply within 30 days and may need to confirm your identity first. Some records — billing records, for example — we must keep by law even after a deletion request. You may also complain to the data protection authority where you live.

e-Rice is a business service and is not meant for anyone under 18. We do not knowingly collect information about children.

When we update this policy, the new version and its date appear at the top of this page. If a change is material, we will tell you by email before it takes effect.