Privacy Policy

1. Our commitments

• Your store's data is yours. We never sell it or share it with advertisers, competitors or any commercial party.
• We never ask for your bank password, PIN or banking OTP codes, and we have no access to your bank account.
• The platform admin console does not show receipt images, amounts or account numbers, only counts and dates (receipt counts, last activity, subscription status). Our staff access a store's data only to fix a technical problem the store asks us to fix, or when required by law.
• Reading the receipt text and the first check run on the cashier's phone before upload.
• An image check is an assistive flag only. Only your bank statement confirms that money arrived.

2. Who is responsible for the data

Customer receipts and bank data: the store decides how this data is used; Mowakkad processes it on the store's behalf and instructions only, to organise receipts, detect duplicates and edits, and reconcile with the bank. The store owner confirms they have a legitimate reason to keep payment receipts their customers present, as proof of payment and to prevent fraud.

User accounts and contact requests: Mowakkad is responsible.

3. What we collect

• Receipts: the receipt image and its digital fingerprint (to detect duplicates), and the fields read from it: bank or wallet, reference number, amount, date and time, receiving account, and sender account if shown.
• Check and match results: the check result, whether the receiving account belongs to the store, and the bank match status (confirmed / waiting for bank / needs review).
• Bank data you upload: statement rows or mini-statement screenshots (reference, amount, date, receiving account).
• Account and team: name, phone number, email, store name and logo, branches and their contact details, each member's role, and shifts.
• Activity log: every add, edit, review decision, confirmation or deletion of a receipt, with who did it and when, to protect the owner from internal tampering.
• Contact and demo requests: name, shop name, the shop's public page link, city, phone, number of branches, banks used, and your note.
• Security data: sign-in session data, and bot checks through Cloudflare Turnstile.
• Public website visits: we use Google Analytics on our public marketing pages only (never the dashboard) to count visitors and popular pages, with no data from your store or receipts.

4. The phone app

• The app does not read your photo gallery; it only receives an image the cashier takes, picks or shares (for example from WhatsApp).
• It does not read SMS messages.
• It does not collect your location and has no ads or tracking tools.
• Automatic device backup is turned off, so receipts saved on the phone while offline are not copied into phone backups.

5. How we protect it

• Each store is isolated: the database itself stops any store from seeing another store's data.
• Isolation inside a store: a cashier sees only their own receipts, a branch manager only their branch, the owner and accountant according to their role.
• Private image storage: no image has a public link. Each view needs a temporary link that expires within minutes.
• Encryption: all connections use HTTPS, and data is encrypted on our providers' disks.
• Admin accounts: require two-step verification.

6. Service providers

We use providers to run the service; they process data only for that purpose. Their servers are outside Sudan; we use them so your data is not lost during local power or network outages. By using the service you agree to this transfer.

• A managed cloud database provider: database and sign-in.
• Cloudflare: receipt image storage and bot protection. The bot check (Cloudflare Turnstile) is covered by Cloudflare's Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/
• A cloud server provider in Canada: the check server and reading bank statements you upload.
• A website hosting provider: hosting the website and dashboard.
• Google Analytics: visit statistics for the public website pages only.
• Email and messaging providers: only to send sign-in codes, password reset links and team invites, once enabled.

7. Pilot and improving the check

We use your data only to add you as a tester and contact you regarding the app.

During the first pilot, and only with the store owner's written consent, we may use the store's receipt images and their bank match result to improve the accuracy of Mowakkad's check. This data stays with us, is not used for anything else, and is not shared with anyone.

The store owner can withdraw consent at any time by contacting us, and we will stop using their data for this purpose.

8. Keeping and deleting data

• No permanent deletion inside a store: cashiers and branch managers cannot permanently erase a receipt. Deleting moves it to "Deleted" with a written reason; its reference stays blocked so the receipt cannot be reused, and the owner sees it in the activity log.
• Export: the store owner can export their data at any time.
• Deleting the whole store: the store owner sends a request from their registered phone or email to privacy@mowakkad.app. After verifying identity, we delete all the store's data and images within 30 days, except what the law requires us to keep.
• Contact requests: deleted after 12 months if they do not become an account.

9. Limits of the check

Mowakkad is a tool to organise, check and reconcile receipts. It is not a bank or a payment guarantor. "Waiting for bank" means we found no sign of editing in the image; it does not mean the money arrived. Decisions at the counter, such as handing over goods, are the store's responsibility.

10. Changes and contact

We may update this policy and will tell store owners about any important change in the dashboard or by email before it takes effect.

For questions, or to request a copy or deletion of your data: privacy@mowakkad.app, or mowakkad.app/contact. Responsible party: Mowakkad (مؤكّد).