Privacy Policy

Last updated: 1 July 2026

1. What this covers

This policy describes how CaratOS handles data for firms and staff using the Service - inventory, customer records, invoices, cash flow, and related business data.

2. Data we store

• Firm account and staff login details (email, hashed password, assigned role and permissions).
• Business data you enter: inventory, customers, invoices, cash flow, kitty plans, and job-work records.
• Optional integration data, such as a connected Shopify catalogue or WhatsApp business number, only if you configure it.

3. Data isolation

Each firm's data is isolated from every other firm's account. Staff accounts within a firm see only what their assigned role permits - for example, Sales Mode access without visibility into cash flow totals.

4. How we use data

Business data is used solely to operate the Service for your firm: displaying inventory, generating invoices, syncing across your devices, and powering features like the WhatsApp business assistant when enabled. We do not sell business data to third parties.

5. Third-party processors

Certain functionality relies on third-party services to operate - for example, cloud database hosting, and optionally Shopify or WhatsApp when a firm connects those integrations. Data shared with these services is limited to what's required for the feature to function.

6. Data retention

Business data is retained for as long as the firm account remains active. If a firm account is closed, associated data is handled according to applicable retention obligations.

7. Security

Access to firm data requires authentication, and staff permissions are scoped by role. Passwords are stored hashed, not in plain text.

8. Your choices

Firm administrators can manage staff access and permissions directly within CaratOS. For questions about data associated with your firm account, reach out through your CaratOS account.

9. Advertising and lead forms

When you submit an enquiry through a CaratOS ad on Meta platforms (Facebook or Instagram Lead Forms), Meta shares the information you provide in that form with us - typically your name, phone number, business name, and city. We use this solely to follow up about CaratOS and schedule a demo. We do not sell this information, and it is handled under the same protections described in this policy. You can request deletion of enquiry data by replying to any message from our team or contacting us through the details in your ad enquiry confirmation.

10. Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected here with an updated date.