Privacy Policy

1.In short

• Your books are yours: you own the data and can export it at any time.
• We use data to provide, protect and improve the service. We never sell personal data or use it for advertising.
• Ask Shihab and receipt reading use AI models from a service provider, and the system itself does the arithmetic. No entry posts without the approval of a person or a rule a person wrote.
• You can delete your own account whenever you want, in the app or on the website.
• Questions and requests: [email protected]

2.Who we are

Shihab Accounting is a product of Shihab AI ("Shihab", "we"). Shihab AI is a trading name of M W Yahia, a sole trader in the United Kingdom. For any privacy question, email [email protected].

3.Our role and yours

• Your account and your staff's and accountant's accounts (name, email, password, role): we are responsible for them.
• The data you enter in or connect to your books, including the names and numbers of your customers, suppliers and staff and their pay: your company is responsible for it, and we process it on your behalf and on your instructions as a service provider.
• If you connect Shihab AI, we read your restaurant's orders from it read-only, and never write anything to it.

4.Data we collect

• Account: name, username, email, phone number if you add one, the password as a secure hash only, the role and the branches allowed.
• The books: invoices, expenses, entries, cheques, bank accounts, items, stock, payroll and attachments (photos of receipts and cheques, bank statements).
• Sales: till orders, Shihab AI orders and delivery apps, with the channel, branch, payment method and the customer details they carry.
• Voice and messages: your questions to Shihab, typed or spoken, voice notes and what you say in «Talk to Shihab», with the text we make from them, and the photos you send on WhatsApp to be read.
• Photos and videos: the photos you take or pick in the apps and on the web (receipts, cheques, bills, waste, orders) and the photos and videos you send to Ask Shihab. A video is kept with a few still frames taken from it and its sound.
• Cameras: if the owner turns on Shihab Eyes, pictures, short clips and events from the branch's IP cameras (a clip carries sound only if the owner turns sound on), kept for the number of days the owner sets. By default only the owner sees them, and every look is logged.
• Devices: for each app sign-in, the device name and model, the system and app versions and an install ID; the push notification token; and for each till device its registration, approval and last use.
• Location: the apps never ask for your location. If your company uses clock-in from a phone's browser, a punch records the time and, only if you allow it in the browser, where you were at that moment.
• Subscription: the company name, billing address and subscription status. Card details go to Stripe directly and never pass through our servers.
• Security: sign-in times, the IP address and browser or device of each session, and an audit trail of every change to the books. App lock with Face ID or a fingerprint is done by your phone: we never receive it.

The apps contain no advertising and no analytics tools from other companies, and they do not track you across other companies' apps or websites.

5.How we use data

• To run the books, reports, returns, alerts and the daily summary.
• To answer your questions, read receipts and statements, and propose matches and entries.
• To send the notifications you turned on (alerts and approvals) to your phone.
• To keep the service secure, prevent abuse and fix errors.
• To improve the service. We do not use your books to train other companies' AI models, and we never share your figures with another company.

6.Artificial intelligence

Ask Shihab and the reading of receipts, cheques, bank statements, photos and videos use AI models from OpenAI acting as our service provider. We send only what the question or document needs. When you talk with Shihab or record a voice note, your speech is turned into text by Soniox, and Shihab's spoken answers are made by ElevenLabs, both acting as our service providers. Figures and totals are computed by the system in code, and the model never posts or pays anything on its own.

7.Who we share data with

• The people you give access to your company (your staff and your accountant or accounting office), each within their role.
• OpenAI (United States): the models behind Ask Shihab and reading, as a service provider.
• Soniox: turns your speech into text, as a service provider.
• ElevenLabs: makes Shihab's voice for spoken answers, as a service provider.
• Stripe: subscription and payment processing.
• Meta: if you turn on the daily summary or reading on WhatsApp, messages go through the WhatsApp Business Platform under its terms.
• Cloudflare: delivers and protects our website.
• Apple and Google: push notifications to your phone (Apple Push Notification service and Firebase Cloud Messaging).
• Authorities, only when the law requires it.

The service runs on servers we operate ourselves, currently in the United Kingdom. We do not sell personal data or share it with data brokers.

8.How long we keep data

• The books, attachments and the audit trail: while your subscription is active, and after it ends for the retention period your company sets (15 years by default, because the law asks businesses to keep their accounting records), unless you ask us to delete them sooner after downloading your archive. Drafts can be deleted at any time.
• The full text of questions to Shihab and its answers, kept for troubleshooting: 30 days.
• Voice recordings, photos and videos you send to Ask Shihab: until you delete your account, unless they are attached to a posted document.
• Camera pictures and clips: for the number of days the owner sets (1 to 90), then they are deleted.
• User accounts: while the account is active. When you delete your account, your login and personal details are removed at once, or within 30 days for a company owner (see Delete your account). What the law requires the company to keep, such as posted invoices, stays with the company, with your name replaced by «Deleted user».
• Server logs: a short time for security, then overwritten automatically.
• Support emails: as long as needed, and no longer than 2 years.

9.Security

• Every connection uses HTTPS, and passwords are stored only as secure hashes.
• Each company sees only its own data, access depends on the role, and a branch manager sees only their branch.
• Posted entries never change, and every change is written to the audit trail with who made it and when.
• A backup every night and an encrypted off-site copy, with a restore we test every month.
• If a breach affects your data, we will tell you and the authorities as the law requires.

10.Your rights

Depending on where you live, you can ask for a copy of your data, its correction, its deletion, to restrict or object to its use, or to receive it in a common format. You can delete your own account yourself, in the app or on the website: see Delete your account. You can also complain to a data protection authority, such as the Information Commissioner's Office (ICO) in the United Kingdom. Email [email protected] and we answer within 30 days, free of charge. If you are a customer or supplier of a company that uses Shihab Accounting, we pass your request to that company, because it is responsible for your data.

11.International transfers

Most companies that use Shihab Accounting are in Palestine. We process data on our servers in the United Kingdom, and our service providers process it in other countries, including the United States. Where the law requires it, we protect these transfers with appropriate safeguards such as the standard contractual clauses.

12.Changes

If we change this policy, we publish the new version here with a new date, and we tell you about significant changes in the product or by email before they take effect.

13.Contact us

Privacy and support: [email protected]

WhatsApp: +44 7343 126953