Privacy Policy

1. Two kinds of data

• Account data — your email, password (stored only in scrambled form) and the companies you belong to. We decide how this is used.
• Business data — what a company enters or receives through its public pages: orders, bookings, guest, member and patient details, sales. The company decides how this is used; we store and process it on the company's behalf. For questions about this data, contact the business first.

2. What we collect

• When you sign up: email address, password, the date you accepted these documents.
• When you use a company's systems: whatever you and your team enter.
• When a customer uses a public page: the details they type in, such as name, phone, email, delivery address or member code.
• Technical data: IP address and browser signals used by our security check (Cloudflare Turnstile) to stop bots, and server logs kept for troubleshooting.
• Cookies: only the ones needed to keep you signed in and remember your language. We do not use advertising or tracking cookies.

3. Why we use it

• to provide the service you asked for (the contract with you);
• to keep accounts and companies secure and separate, and to stop abuse;
• to send service emails — invites, password resets, important notices;
• to meet legal obligations, such as keeping payment records.

We do not sell personal data and do not use it for advertising.

4. Who helps us run the service

We use these providers. They process data only on our instructions:

• Supabase — database, sign-in and file storage (servers in Mumbai, India);
• Vercel — hosting of the website (servers in Mumbai, India);
• Cloudflare — the security check that stops bots;
• Google (Gmail) — sending invite and password-reset emails.

Because these servers are outside Mongolia, using the service means your data is transferred abroad. We choose providers with strong security and data protection commitments.

5. How long we keep it

Account and business data is kept while the account or company is active. When a company is closed, its data is deleted within 30 days, unless the law requires longer (for example accounting records). Security logs are kept for a short time, normally no more than 30 days.

6. Security

Connections are encrypted (HTTPS). Every company's data is separated by database rules, so one company can never see another's. Access inside a company follows the roles set by its owner. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

7. Your rights

You can ask to see, correct or delete your personal data, and withdraw consent you have given. On your account page you can change your password, leave a company and delete your account yourself; deleting it stops your sign-in straight away and removes the account after seven days - inside that week, write to us and we can put it back. Afterwards nothing of yours is left, while the businesses keep the sales and receipts their books require, without your name on them. For anything else write to us — we answer within 30 days. For business data (for example a booking you made at a hotel), the business can help first.

If you think we handle your data unlawfully, you may also complain to the National Human Rights Commission of Mongolia.

8. Children

Redi accounts are for businesses and their staff, not for children. Businesses must not enter children's personal data without the consent the law requires.

9. Changes and contact

We will update this policy when our practices change and tell owners about important changes in advance.

Contact about privacy: agaraa247@gmail.com