KasaJet

This Privacy Policy and User Agreement explains how KasaJet collects, uses, stores, shares, protects, and deletes information when you use the KasaJet mobile application, web dashboard, backend API, and related services (collectively, the "Service"). If no language or country is selected, this English version is the default version and is prepared primarily for users in the United States, including California residents where the CCPA/CPRA, CalOPPA, COPPA, and other applicable U.S. privacy rules apply.

KasaJet is a cloud-based POS, inventory, invoice, stock, customer account, supplier, reporting, barcode, camera scanning, OCR, notification, and subscription management service for small businesses. By creating an account, logging in, uploading content, scanning barcodes, taking photos, using notifications, purchasing subscriptions, or continuing to use the Service, you acknowledge this Policy and agree to the User Agreement section below.

• Data controller / service operator: KasaJet / Tolga Gencosman.
• Privacy contact: t.gencosman@gmail.com.
• Scope: This Policy covers Android, iOS, web panel, backend APIs, uploaded files, account and business records, subscription records, push notifications, security logs, and support communications.
• No sale of personal information: KasaJet does not sell personal information and does not share personal information for cross-context behavioral advertising.

• Account and identity data: email address, full name, phone number where provided, password hash, role (owner/manager/staff), permissions, branch assignment, language preference, authentication token/JWT, password reset token hash and expiry, login state, account status, creation and update timestamps.
• Business profile data: business name, owner relationship, business phone, address, tax number, plan, settings, branches, branch addresses, branch phones, and default branch information.
• Product and inventory data: product names, barcode numbers, product categories, units, purchase and sale prices, tax rates, product images, thumbnails, favorite status, active/inactive state, minimum stock levels, expiry tracking settings, stock quantities, stock lots, expiry dates, stock movements, transfers, adjustments, counts, and related notes.
• Sales and accounting data: receipts, sale line items, receipt number, subtotal, discounts, tax amount, total, payment method, cash received, change amount, sale status, refund/cancellation information, cashbox/reporting data, price history, export data, and user who performed the transaction.
• Customer and supplier data entered by business users: names, phone numbers, addresses, notes, balances, credit limits, transactions, supplier payments, supplier adjustments, supplier orders, order items, and related commercial records.
• Invoice and OCR data: invoice number, invoice date, supplier, branch, invoice image, image path, raw OCR text, extracted product names, quantities, unit prices, line totals, matched product IDs, invoice status, notes, price suggestions, and confirmed invoice items.
• Camera, barcode, and image data: camera frames used for barcode scanning and expiry-date scanning, product photos captured or selected by you, invoice photos captured or selected by you, and image metadata needed to upload or process the file. Barcode and expiry-date scanning may run on the device; invoice OCR images may be sent to the server and Google Cloud Vision for text recognition.
• Device, security, and technical data: IP address, user ID where available, business ID where available, login time, last login time, rate-limit records, security logs, request errors, server logs, app version, operating system context, Firebase Cloud Messaging token, notification preferences, and notification dispatch records.
• Subscription and purchase data: RevenueCat app user ID, entitlement, product/package identifiers, purchase and renewal status, expiration time, cancellation/refund status, webhook event data, and subscription audit logs. Payment card details are processed by Google Play/App Store payment systems and are not stored by KasaJet.
• Local device storage: secure login token in Flutter Secure Storage, app preferences in SharedPreferences, selected language, onboarding/session state, notification preferences, branch or UI preferences, and other local settings needed for the app to function.
• Support and communications: emails, messages, screenshots, issue descriptions, deletion requests, privacy requests, and metadata needed to answer your request.

• Camera: used to scan product barcodes, capture product photos, capture invoice photos for OCR, and read expiry dates using on-device text recognition. Camera permission is requested only for user-facing features initiated by the user.
• Photo/gallery access through picker: used when you choose an existing product or invoice image. KasaJet does not request broad media library access for unrelated purposes.
• Internet and network state: required for login, synchronization, API requests, subscriptions, invoice OCR, image uploads, barcode database lookups, and reports.
• Bluetooth / Bluetooth scan / Bluetooth connect: used to discover and connect to supported thermal printers for receipt or label printing. Bluetooth scan is marked as not used for location.
• Notifications, boot completed, wake lock, and background work: used for low-stock/expiry alerts, notification delivery, dispatch tracking, and restoring scheduled work after restart.
• Vibration/haptics: used for scan confirmations and notification feedback.

• To perform the service contract: account creation, authentication, POS operations, stock management, barcode scanning, invoice OCR, reporting, branch/personnel management, subscription access, printer workflows, and synchronization.
• With consent or at your direction: camera capture, gallery selection, push notifications, optional product/invoice image uploads, OCR submission, and support communications.
• Legitimate business interests: fraud prevention, security, rate limiting, service reliability, debugging, abuse prevention, backup integrity, customer support, and product improvement.
• Legal obligations: accounting, tax, consumer, payment, dispute, fraud, and regulatory compliance.
• Vital or public-interest purposes: only if required by law or emergency authority; KasaJet is not designed for medical or emergency decision-making.

• Google Firebase / Firebase Cloud Messaging: used for push notification token handling and notification delivery.
• Google Cloud Vision API: invoice images submitted for OCR may be sent to Google for text extraction.
• RevenueCat: used to manage subscriptions, entitlements, purchase state, and webhook events.
• Google Play / Apple App Store: used for app distribution and payment processing.
• Hosting, database, email, and infrastructure providers: used to run the API, store data, send password reset emails, serve uploaded files, and keep backups/logs.
• Legal and compliance recipients: courts, government authorities, payment processors, auditors, or advisors where required by law or needed to protect rights.

We require service providers to process data only for the service purposes described here, subject to confidentiality and security obligations where applicable.

• Operational account, business, inventory, customer, supplier, sale, stock, invoice, and uploaded image records are retained while the account or business workspace is active and as needed to provide the Service.
• When an eligible owner deletes an account, KasaJet deletes or de-identifies personal account and business content to the extent technically and legally possible. Product images and invoice images associated with the deleted business may be removed from storage.
• Subscription records, payment audit records, tax/accounting records, security logs, IP logs, rate-limit records, and abuse-prevention logs may be retained where legally required or necessary for fraud, dispute, security, and compliance purposes.
• Backups may retain deleted data for a limited technical backup cycle before being overwritten, unless retention is required for security, legal claims, or compliance.
• Local data on your device can be cleared by logging out, uninstalling the app, clearing app data, or using account deletion where available.

• Passwords are stored as cryptographic password hashes, not plain text.
• Authentication uses JWT/session mechanisms and secure local token storage on supported platforms.
• Transport security uses HTTPS/TLS in production. Cleartext traffic is disabled for release Android builds.
• Access control is role and permission based. Business data is scoped by business and branch.
• Rate limiting, IP logs, error logs, upload validation, MIME checks, path traversal protection, and file size/type restrictions are used to reduce abuse.
• No system can be guaranteed 100% secure. You are responsible for strong passwords, device security, and controlling staff permissions.

Your data may be processed in Türkiye, the United States, the European Economic Area, or other countries where KasaJet or its service providers operate infrastructure. When personal data is transferred internationally, KasaJet relies on your instructions/contract performance, service provider agreements, Standard Contractual Clauses, adequacy mechanisms, or other lawful transfer mechanisms as applicable.

• You may request access, correction, deletion, portability, or information about categories of personal information collected, used, disclosed, or shared.
• California residents may have rights under CCPA/CPRA to know, delete, correct, opt out of sale/sharing, limit use/disclosure of sensitive personal information where applicable, and not be discriminated against for exercising rights.
• KasaJet does not sell personal information or share it for cross-context behavioral advertising. If this changes, this Policy and the app controls must be updated before the change takes effect.
• You may disable push notifications from device settings or in-app settings, revoke camera permission in Android/iOS settings, and stop optional image uploads by not using those features.
• Requests can be sent to t.gencosman@gmail.com. We may need to verify your identity and authority before acting on a request.

KasaJet is intended for business use and is not directed to children under 13 in the United States or to children below the applicable digital-consent age in other jurisdictions. Business owners are responsible for creating staff accounts only for authorized personnel and obtaining any workplace notices or consents required by local law.

• Eligibility: You must be legally able to operate or represent the business using KasaJet and must provide accurate information.
• Account responsibility: You are responsible for credentials, staff permissions, business records, uploaded files, legal basis for customer/supplier data entered into KasaJet, and all activity under your account.
• OCR and barcode accuracy: Barcode lookup, expiry-date scanning, invoice OCR, price suggestions, reports, tax calculations, and AI/automation outputs may be incomplete or inaccurate. You must verify all business, tax, invoice, inventory, and accounting records before relying on them.
• Acceptable use: Do not upload unlawful, infringing, malicious, sensitive, or unrelated content. Do not attempt unauthorized access, scraping, reverse engineering, abuse of APIs, or circumvention of subscription limits.
• Subscriptions: Premium features are managed through Google Play/App Store and RevenueCat. Cancellations, refunds, and renewals are subject to the applicable store rules and local consumer law.
• Limitation: KasaJet is a business software tool, not legal, tax, accounting, or financial advice. To the maximum extent permitted by law, the Service is provided without warranties beyond mandatory consumer rights.
• Governing law: For U.S. users, applicable U.S. federal and state laws apply to mandatory privacy rights. Contract disputes are otherwise governed by the laws stated by the operator or required by mandatory local law.

We may update this Policy when the Service, permissions, providers, laws, or data practices change. Material changes will be reflected by changing the "Last Updated" date and, where required, by additional notice. Contact: t.gencosman@gmail.com.