Privacy Policy

1. Who operates JadeedX ERP

Jadeedx (PVT) Limited operates JadeedX ERP, a cloud business application for Pakistani companies. Jadeedx runs the software, hosts your data, and decides how accounts and security work. Each customer company decides what it enters about its own buyers, suppliers, and staff. Jadeedx processes those records only to provide the ERP.

Contact: support@erp.jadeedx.com, +92 339 2003691.

This policy is written in plain English. Pakistan does not yet have a general personal-data law in force. Article 14 of the Constitution recognises privacy. The Prevention of Electronic Crimes Act 2016 addresses cybercrime. A Personal Data Protection Bill has been discussed but is not law. We do not claim GDPR compliance or statutory data-subject rights that do not exist. We offer access, correction, and deletion as Jadeedx's own practice when you contact us.

2. Account and sign-in data

• Name, email, role, optional Pakistan mobile number, phone-verification time, language preference, and avatar style
• Passwords stored as bcrypt hashes in our database (not Supabase Auth)
• One-time sign-in and password-reset codes stored as hashes, short-lived, with limited attempts
• Cloudflare Turnstile when configured, to reduce automated sign-in abuse

3. Business records your company enters

Your company controls the content it types or uploads. That may include:

• Company profile: name, NTN, STRN, address, phone, email, province, FBR POS identifier, logo
• Customers and vendors (including CNIC and tax registration details)
• Invoices, purchase documents, line items, and related financial records
• Catalog items and inventory data
• HR and payroll: employee name, CNIC, phone, salary, joining date, payroll runs, advances, overtime, and loans

4. Email, WhatsApp, and document messages

When your company sends document emails, we transmit recipients, subject, body, and the invoice PDF through Resend. Email delivery logs are kept for your tenant. When a mobile number is on an account, we may send sign-in codes, password notices, and other transactional messages through Meta WhatsApp. WhatsApp delivery is best-effort and does not block email if it fails.

5. FBR digital invoicing

When your company fiscalizes a sale invoice, invoice data and the company's FBR bearer token are sent to PRAL/FBR APIs. Validate and post request and response payloads are stored on that company's account for audit and support. Outbound FBR traffic may route through a proxy so PRAL can allow the source IP address.

6. Optional AI features

When the platform has enabled AI for your company, content may be sent to the configured provider. Examples include purchase PDF or image extraction, Insights questions, document email drafts, and name translation. Providers may include OpenAI, Groq, Google Gemini, Cloudflare Workers AI, Mistral, Cerebras, or Firecrawl, depending on platform settings. Provider API keys are stored encrypted server-side.

7. Avatars

User avatars load from DiceBear. Your browser requests an image whose seed combines your user id and chosen style, so DiceBear receives that seed and your connection metadata.

8. Cookies and on-device storage

We do not use analytics or advertising cookies at this time.

• jadeedx_session: essential session cookie, httpOnly, about 7 days, Secure in production
• jadeedx-locale: language preference cookie, and the same key in local storage
• Local storage may also hold theme (fbr-erp-theme), cookie-consent choice, sidebar collapse preference, PWA install-prompt dismissal, and some Insights UI preferences

9. Hosting and processors

The application runs on Vercel. Database records are stored in Supabase PostgreSQL. Production data is hosted in Asia Pacific (Tokyo) and may also be processed in other countries where Vercel, Supabase, Resend, Meta, Cloudflare, PRAL, and any enabled AI provider operate.

10. Security

We use HTTPS, a signed session cookie, bcrypt password hashing, and encrypted storage for sensitive platform secrets such as AI provider keys.

11. How long we keep data

We keep data while your company account is active and as needed to run the service. To request access, correction, or deletion, email support@erp.jadeedx.com. Your company remains responsible for tax and business records Pakistani law requires it to retain. If you install the app as a PWA, the device may cache the app shell; business records stay on our servers.

12. Children and sale of data

JadeedX ERP is not intended for anyone under 18. We do not sell personal data.

13. Changes and governing law

We may update this policy. The date at the top shows when it last changed. This policy is governed by the laws of Pakistan. Questions: support@erp.jadeedx.com, +92 339 2003691.