Last updated: 1 August 2026
HamzaTech Business (“we”, “us”) provides a cloud-based business management platform covering customer relationships, human resources, inventory, finance and project workflows. This policy explains what personal data we process, why we process it, how long we keep it, and the choices available to you. It applies to our public website and to the authenticated application.
Account information: your name, email address, password hash, and the authentication provider you used (email, Google or GitHub). If you sign in with a third-party provider, we receive your basic profile and email address from that provider, never your provider password.
Workspace content: the business records you create in the product — contacts, deals, employees, products, invoices, projects and files. This content belongs to you. We process it solely to operate the service on your behalf.
Technical data: IP address, browser type and version, device type, operating system, referring page, and timestamps of requests. This is collected automatically in server logs and used for security, abuse prevention and diagnostics.
Support communications: messages you send us through the contact form or by email, retained so we can answer and improve.
We use personal data to create and secure your account, to provide the features you request, to send transactional messages such as password resets and verification emails, to detect and prevent fraud and abuse, to comply with legal obligations, and to improve reliability and performance. We do not sell personal data, and we do not use your workspace content to train third-party models.
Where the GDPR applies, we rely on: performance of a contract (providing the service you signed up for), legitimate interests (security, abuse prevention, service improvement), consent (optional cookies and marketing email, which you may withdraw at any time), and legal obligation (tax and accounting record keeping).
Strictly necessary cookies keep you signed in, remember your theme preference and protect against cross-site request forgery. These cannot be disabled without breaking the service.
Analytics and advertising cookies may be set on our public marketing and editorial pages. Third parties, including Google, use cookies to serve ads based on a user's prior visits to this or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and other sites on the internet.
You may opt out of personalised advertising by visiting Google Ads Settings at adssettings.google.com, or opt out of third-party vendor cookie use at aboutads.info. Most browsers also allow you to block or delete cookies through their settings.
No advertising is served inside the authenticated application, and advertising partners never receive your workspace content.
We share data only with service providers that help us run the platform: cloud hosting and managed database providers, transactional email delivery, error monitoring, and payment processing. Each is bound by contract to process data only on our instructions and to maintain appropriate security. We may also disclose data where required by law, or to protect the rights and safety of our users.
Our infrastructure providers may process data in regions outside your own country. Where data leaves the European Economic Area or the United Kingdom, transfers are covered by Standard Contractual Clauses or an equivalent approved mechanism.
Data is encrypted in transit using TLS and encrypted at rest. Access to workspace records is enforced at the database level with row-level security policies, so a request can only read rows the authenticated user is entitled to see. Administrative access to production systems is limited, logged and reviewed. Passwords are stored only as salted hashes. No system is perfectly secure, and we will notify affected users and any relevant regulator without undue delay if a breach materially affects personal data.
Account and workspace data is retained for as long as your account is active. After you delete your account, active records are removed within thirty days and residual backup copies expire within ninety days. Server logs are retained for up to twelve months. Records we must keep for tax or accounting purposes are retained for the period required by law.
Depending on where you live, you may have the right to access a copy of your personal data, correct inaccurate data, delete your data, restrict or object to certain processing, receive your data in a portable format, and withdraw consent. To exercise any of these, contact us through the contact page. We respond within thirty days and will not discriminate against you for exercising a right.
The service is intended for business use and is not directed at children under sixteen. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this policy to reflect changes in the service or the law. Material changes will be announced in the application or by email before they take effect, and the revision date below will change. Questions about this policy can be sent through our contact page.