Privacy notice
Version 0.1 (DRAFT), 5 November 2026. This text is a draft. It can change before the service starts for paying customers.
This notice tells which personal data Taraazu processes, why, for how long, and which rights you have. [OPERATOR NAME] ("we", "us") operates the service.
1. Two roles
- The data of a workspace. A business (the customer) uses a workspace to keep its books. The business data in the workspace is the data of the customer: for example its parties, the CNIC numbers of its customers, its employees and its documents. The customer is the controller of this data. We process it only to give the service, as the data processing terms tell.
- Our own data. We are the controller of the user accounts, the sign-in data, the security log and the billing data.
2. The data that we process as the controller
| Data | Why | How long |
|---|---|---|
| The user account: name, e-mail address or username, language, theme | To let the user sign in and use the service | While the account is in a workspace; then with the workspace (section 5) |
| The password (only a one-way hash) and the second sign-in step (an authenticator key, sealed, or a passkey) | To protect the account | The same as the account |
| The sign-in sessions and the security log: the time, a one-way hash of the IP address, the name of the browser and the device, the action | To protect the service and to investigate a misuse | The events of a workspace: while the workspace exists. The events of the platform: 2 years |
| The technical log: errors and the time of each request | To find and fix errors | 30 days |
| The billing data: the legal name, the address and the tax number of the customer, the invoices | To send invoices and to obey the tax law | 10 years |
We do not sell personal data. We do not use personal data for advertising.
3. Cookies and the browser storage
- The service uses only the cookies that the sign-in needs. They keep you signed in and protect the sign-in.
- The browser keeps your choice of the language and the theme, and some choices of the screen (for example the open menu groups).
- There is no analytics and no tracking, in the product and on the help site. For this reason, there is no cookie banner.
4. Support sessions
To help a customer or to investigate a problem, our staff can open a support session in a workspace:
- The staff member gives a reason. The session starts as view only.
- A change needs a second confirmation by the staff member. Changes are possible for 30 minutes at most.
- Staff cannot change the passwords, the users or the roles of the workspace.
- The platform records each action of the session. The workspace does not see the support session. A change in a support session shows in the workspace as a change by the user that the staff member acted as.
5. Retention and deletion
- When a workspace ends, it is read-only for a retention window (90 days by default). Then we delete all the data of the workspace. The backups that contain the data expire up to 30 days later.
- We keep the invoices and the billing data for 10 years, because the tax law can require it.
6. Where we store the data
We store the data with Oracle Cloud Infrastructure in Germany (Frankfurt). The data is therefore stored outside Pakistan. A second copy of the backups is with Cloudflare in the European Union; we encrypt each backup before the upload. The list of sub-processors shows each company that processes data for us.
7. Security
We protect the data, for example: an encrypted connection (HTTPS), one-way hashes of the passwords, a second sign-in step, sealed CNIC numbers, a strict separation of the workspaces, and a security log of the important actions.
8. A breach of personal data
If we know of a breach of personal data, we tell the administrators of each affected workspace within 7 days. We tell them what happened, which data is affected, and what the workspace must do.
9. Your rights
- About the business data of a workspace (for example if you are a customer of a shop that uses Taraazu): ask the business. If you ask us, we send your request to the administrators of that workspace within 7 days, and we help them.
- About your user account, your sign-in data and the billing data: you can ask us for a copy, a correction or the deletion of the data. We answer within 30 days. We keep data that the law tells us to keep.
10. Language and changes
The Urdu text is a translation. If the two texts do not agree, the English text applies. We publish each new version of this notice on this page, with the version and the date.
11. Contact
[OPERATOR NAME], [REGISTERED ADDRESS]. E-mail: [CONTACT E-MAIL].