Privacy policy

This policy explains how Ghalleh, operated by AFAQ AL TATWEER FOR WEBSITES & INTERNET PORTALS, collects, uses and protects your data when you use the app and this website.

Data we collect

• Account data: the shop owner's mobile number, for signing in with a code sent by text message, staff names and roles, and each staff member's PIN, which we store in a scrambled form that cannot be read back. We do not ask for an email address.
• Shop data: its name and type, and what you choose to print on receipts, such as the address, phone, tax number and logo.
• Shop location: if you set it on the map or from your current position, we keep the exact point in a record only the owner and managers can read, and an approximate area of about one kilometre.
• Attendance: when someone clocks in or out, the phone sends its position at that moment only. We check that it is near the shop, then discard the coordinates and keep only the distance from the shop and the time.
• Items and stock: names, barcodes, prices, costs, quantities and stock movements.
• Sales and accounts: receipts, payment methods, returns, debts and payments, expenses, shifts, cash counts and staff pay.
• The shop's customers and suppliers: what the shop enters about them, such as name, mobile number, debts and points, and a company's tax number. We never collect national ID numbers or ID card photos from anyone.
• Photos and files: item photos, supplier invoice photos and PDF files, the shop logo for receipts, repair intake photos, a screenshot you attach to a problem report, and photos you send in the support chat.
• Excel files for import: the file is read on your phone; only the column titles and up to 25 rows are sent, to recognise the columns.
• Messages: problem reports and ideas you send from Help, your messages in the support chat with the Ghalleh team, and your questions to Ghalleh AI.
• Activity log: who changed a price, gave a discount or returned a receipt, drawer differences and team changes, for the owner to see.
• Weekly analysis: a report Ghalleh's server prepares from your shop's figures, which the owner and the managers with the Cost and profit permission can read.
• Technical data: a random identifier the app creates for the device (not the hardware number or the advertising ID), the notification token, the app and system version, and crash logs.
• Install source: when you install Ghalleh from Google Play, the app reads Google Play's install referrer once, meaning the ad or link the install came from (such as utm_source and utm_campaign) and the install time, and stores it with your shop when you create it. We use it to know which of our ads bring shops. The app has no Meta SDK and no Facebook Pixel, does not read the advertising ID, and we do not sell this data or share it with advertisers.
• Crash reports: the Ghalleh app's own crash reporter sends them to Ghalleh's server, and the app contains no outside crash reporting tool. When the app hits an error, it sends the error message and where in the code it happened, the app version, the system type and the device's random identifier, and the server adds the account and shop identifiers. When the server refuses to save a record, the app sends only its type, number, total and the error code. We use these reports only to fix problems. The app contains no advertising tools and does not read the device's advertising ID. The only measuring tool from outside Ghalleh is Microsoft Clarity on the setup screens, as explained below.
• Usage data: the app sends Ghalleh's server numbers about how it is used, so we can see where new shop owners get stuck and which features help them, and improve the app. This covers: opening and closing the app and how long it was used, the screens opened from a fixed list (such as Sell, Items, Debts and Reports), the setup steps and the time each step takes, the use of features such as adding an item, scanning a barcode or recording a debt, without any detail about them, the error codes shown, the device type (phone, tablet or PC), its system and the app version, and a random identifier the app creates when it is installed (not the hardware number or the advertising ID). Usage data never includes customer names or phone numbers, item names, the content of receipts, any amount, notes, or any text you type. We keep it with your shop on Ghalleh's servers, and we do not sell or share it with anyone. You can turn it off in Settings, under "On this device", with "Share usage data to improve Ghalleh"; the device then sends no usage data at all, and sales and the subscription still reach the server because they are your shop's own data.
• Website visit data: we use Microsoft Clarity to understand how visitors use ghalleh.com, such as clicks, scrolling and heatmaps. Clarity masks sensitive text and fields by default.
• Recording the setup screens: we use Microsoft Clarity inside the Ghalleh app on Android and iPhone, on the setup screens only: the welcome screen, the shop's name and type, the ready items, adding the first item, and the practice sale. Clarity records how these screens look and the taps on them, so we can see where a new shop owner hesitates. All text on them is masked and shows as dots, and fields and pictures are masked too. Clarity does not run on the sign in screen (the phone number and the code), on real sales, or in debts, customers, reports or settings, and it stops for good on the device after the first real sale or the end of the practice sale. It does not run in the PC app. We add only the shop type, the ad the install came from and the app version to the recording, never the shop's name, your name or your phone number. Microsoft processes this data on our behalf, and works out the approximate country and city from the internet address. Clarity also stops when you turn off "Share usage data to improve Ghalleh".

How we use data

• Running the service: selling, stock, debts, reports, notifications and attendance.
• JoFotara: sending invoices to Jordan's national e-invoicing system when you turn on the connection in your shop settings.
• Smart features: reading a supplier invoice, understanding voice selling, recognising the columns of an import file, and answering your questions in Ghalleh AI, only when you use them. The weekly AI analysis of your shop is made automatically: the first one 7 days after the shop is created, then every Saturday.
• Security: verifying sign-ins, telling you about new devices, and spotting unusual activity.
• Support and improvement: answering your reports and fixing bugs. Support chat messages and their photos are stored with your shop and used only to answer your shop.
• No ads: we never use your data for ads, and we never sell it.

Sharing data

We do not sell your personal or business data, and we show no ads. Data reaches only the providers that run the app for us, and the bodies you choose to send it to:

• AMS (Advance Messaging Systems), a text message provider in Jordan: when you sign in with your mobile number, Ghalleh's server sends it your number and the message that holds the sign-in code, and AMS delivers it to your phone by text message. We keep the code on Ghalleh's servers only as a hash, to check it. If sending through AMS fails, Google's Firebase sends the code instead.
• Google: Firebase stores the data, photos and files on servers in the European Union (Belgium), sends the sign-in code by text message when it cannot go through AMS, delivers notifications to the phone (Firebase Cloud Messaging), and checks that requests come from the real Ghalleh app (Firebase App Check, with Play Integrity on Android). On Android, Google Play handles subscriptions.
• Apple: on iPhone and iPad, the App Store handles subscriptions, Apple delivers notifications to the device, App Attest checks that requests come from the real Ghalleh app, and Apple's speech recognition turns speech into text for voice selling.
• OpenAI: Ghalleh's server sends OpenAI only what each smart feature needs and nothing else: for the features you use, only when you use them; for the weekly analysis, automatically. Ghalleh AI: your question and the last few turns of the conversation, with the figures from your shop the answer needs, such as sales, item names, prices and stock, which may include customer names and what they owe and the name of whoever opened a shift, never their phone numbers. Supplier invoice reading: the invoice photo or file. Voice selling: the text the phone heard and its alternative readings, with the names, units and prices of the closest items, never a recording. Excel import: the column titles and up to 25 rows. Weekly analysis: the shop's weekly figures as totals and counts, such as sales, receipts, profit, debts by how late they are and expenses, item names with their quantities, amounts, prices and stock, and the shop's type and language, never the shop's name, and never the names, phone numbers or identifiers of customers or staff. This processing happens on servers in the United States. We ask OpenAI not to store the requests, OpenAI does not use them to train its models, and under its policy it may keep them for up to 30 days only to detect abuse, then deletes them.
• The Income and Sales Tax Department: when you turn on the JoFotara connection, each invoice is sent with its lines, totals and your shop's tax details, and for a trade account the company's name and tax number.
• OpenStreetMap: when you open the shop location map, the map images load from its servers, and when you search for a place only the text you typed goes to its search service, Nominatim.
• Open Food Facts: Ghalleh's server sends only the barcode number when you scan an unknown item, to fetch its name, never your prices or anything about your shop.
• Problem reports and ideas: they pass through the ghalleh.com web server to Ghalleh's mailbox, info@ghalleh.com, with your shop's name and type, your role, the app version, the device type and the screenshot if you attached one, never phone numbers or customer data. New messages in the support chat also send the same mailbox a notice with the message text, your shop's name and type, your role, the app version and the device type.
• Speech to text in voice selling: your phone's own speech recognition service does it, under its own terms. On Android it is usually Google's; on iPhone and iPad it is Apple's, and Apple may process the audio on its servers. The audio never reaches Ghalleh's servers or OpenAI; only the recognized text is used, to find the items.
• Legal requests: we may disclose data if the law requires it.

Payments and subscriptions

You subscribe inside the Ghalleh app through Google Play on Android, and through the App Store on iPhone and iPad. There is no other way to pay: no CliQ, no bank transfer and no cash. On the Windows PC app, the shop's plan is managed from the shop owner's phone. The store processes the payment: Google or Apple receives your payment details; Ghalleh receives only the subscription state (the plan, the period, renewal and expiry) and never your card details.

Early sign-ups

If you signed up on this website before the app was released, we keep your name and mobile number, your type of shop and city if you gave them, the time you signed up, and your IP address to block automated sign-ups. We used this data only to tell you when the app was released. We do not sell or share it, and it is kept in Ghalleh's mailbox and in a protected file on the web server that cannot be reached from the internet. We delete it within six months of the app's release; to have it deleted sooner, send a request from the delete account page on this website with the mobile number you signed up with.

App permissions

• Camera: to scan barcodes, and to photograph items, supplier invoices, the shop logo and devices taken in for repair.
• Location: to set the shop's location when the owner asks for their current position, and to confirm a staff member is near the shop at the moment of clocking in or out. We never track anyone, and location never runs in the background. On Android 11 and earlier the system asks for location to search for Bluetooth printers; Ghalleh does not keep or send it then.
• Notifications: for the sale notifications and alerts you choose.
• Bluetooth and nearby devices: to connect printers and scanners.
• Microphone and speech recognition: for voice selling, only while you hold the voice button. Your phone's speech recognition service turns what you say into text; Ghalleh receives only the text and keeps no recordings.

Protecting data

Data is encrypted in transit, and access is protected by sign-in details and the staff permissions the shop owner sets.

Keeping and deleting data

We keep your shop's data while your account is active, so we can show your reports. We keep problem reports, ideas, crash logs and the weekly analysis reports for 12 months, then delete them automatically. We keep usage data for 13 months, then delete it automatically. Microsoft Clarity keeps the setup screen recordings for its own retention period, and we use them only to improve the setup steps. A screenshot attached to a report is deleted from our servers once the report reaches Ghalleh's mailbox. We keep support chat messages and their photos while the conversation is open, and delete them automatically 12 months after it is closed.

You can delete your account at any time. Inside the app: tap the shop name at the top of the Sell screen to open the shop menu, choose Delete account at the bottom, and type the confirmation word. You must be signed in with your mobile number on that phone. Or send a request from the delete account page on this website, and we delete the account within 30 days of verifying the mobile number.

When a shop owner deletes their account, we delete the whole shop from our servers: items, receipts, debts, expenses, the team and the staff accounts, every photo and file of the shop (item photos, supplier invoice photos and files, the receipt logo, repair photos), problem reports and their screenshots, the support chat with its messages and photos, crash logs, usage data and notification tokens, then the owner's account. This happens as soon as the deletion is confirmed in the app. Encrypted backups are kept for up to 14 more days and then deleted automatically, and we delete the copies of reports in Ghalleh's mailbox within 30 days.

What we keep after deletion: if the shop subscribed through Google Play or the App Store, we keep only the subscription record: the plan, its period, status and dates, and the store's subscription reference, without the shop's name, your name or your mobile number. We keep it for 7 years from the deletion because it is part of our financial records, in line with accounting practice in Jordan, then delete it automatically. Deleting the account does not cancel the store subscription, so cancel it yourself: on Android in your Google Play subscriptions, on iPhone and iPad in Subscriptions in your Apple Account (Apple ID) settings. Invoices already sent to JoFotara stay with the Income and Sales Tax Department; they are its records, not ours.

The free trial record: the free trial is once per mobile number, so for each number we keep a small record with a hash of the shop owner's mobile number instead of the number itself, the trial's start and end dates, and the shop's internal identifier. This record stays after the account is deleted, and we use it only to stop repeated free trials.

When a staff member deletes their account, we delete their access, their account, their reports, crash logs, usage data and notification tokens, and their name stays on the shop's receipts and records, and their messages stay in the support chat, which belong to the shop owner.

Children's privacy

Ghalleh is meant for business users aged 18 and over, and we do not knowingly collect children's data.

Changes to this policy

We may update this policy from time to time and will tell you about significant changes inside the app.

Contact

For any question about this policy or your data, email info@ghalleh.com, or send a report from Help inside the app.