Nitaj is a retail accounting and management system for small shops. This page explains who runs it, what the platform holds, where it is held, for how long, and what you can ask us to do with it.
01Who we are
The platform is operated by Ismail A. Amassi, trading as Nitaj, Gaza, Palestine ("we", "the provider"). Every question, request or complaint about this page goes through the contact form, which reaches us directly. We aim to answer within two working days and to resolve a request within thirty days.
02Two different roles
The platform handles two kinds of information, and its role is different for each.
- The merchant's own account. The shop's name, its address on the platform, the owner's login email and any Google or Apple account linked to sign in with, and the subscription that runs it. Here we decide what is collected and why — we are the controller.
- The shop's data. Products, prices, sales, staff, and the shop's own clients — including their names, phone numbers, purchase history and outstanding debts. This belongs to the merchant. We store and process it on the merchant's instruction and for no other purpose — we are the processor. The terms of that relationship are in the data processing addendum.
A shopper whose name appears in a shop's client list never signed up for anything here. Requests about that data go to the shop; we assist the shop, and do not decide on its behalf. If you are that shopper and the shop does not answer, write to us through the contact form and we will forward your request to the shop and tell you what we did.
03Why we process it, and on what basis
- To run the service you asked for. Everything in the merchant's account and the shop's data is processed because it is necessary to provide the service under the terms of service.
- To keep the platform safe. Sign-in attempts, session tokens, device records and the activity log are processed because we have a legitimate interest in preventing unauthorised access and in being able to explain what happened when something goes wrong.
- To tell you things you need to know. The owner's email receives transactional messages only: verification, password resets, a notice whenever a way to sign in is added or removed, backup notices, replies to contact-form messages, and notices of changes to these documents. We send no marketing email.
Palestine has no general data-protection statute in force at the time of writing. We apply the commitments on this page and in the addendum as contractual obligations to every merchant, aligned with the principles of the EU General Data Protection Regulation, and where a merchant is subject to a data-protection law of their own country the addendum is written to meet the processor duties such laws impose.
04What is stored
| Category | Examples | Role |
|---|---|---|
| Merchant account | shop name, subdomain, owner's email, plan, subscription dates; a linked Google or Apple sign-in, if the owner chose one | controller |
| Staff | name, role, hashed PIN | processor |
| Catalogue | products, categories, suppliers, units, prices, stock | processor |
| Sales | orders, order lines, discounts, payments, cash movements, shifts | processor |
| Shop clients | name, phone, purchase history, outstanding balance | processor |
| Devices | a server-generated identifier, a human-readable label (e.g. "Galaxy A15 · Android 15"), last-seen time | processor |
| Files | exports, backup bundles and attachments the shop produced, in private storage | processor |
| Operational logs | activity log entries, sign-in attempts, delivery records for the emails we send | mixed |
The mobile app collects no hardware identifier: no advertising ID, no IMEI, no Android ID. A terminal is identified by a random identifier the server issues at enrolment, which the owner can revoke from the Devices screen. The camera is used in-frame to read barcodes and nothing it sees is stored or transmitted.
05Signing in with Google or Apple
A shop owner can sign in with a Google or an Apple account, instead of an email and password or as well as one. It is optional and it is for owners only; staff keep signing in with their PIN. Each owner chooses which ways to sign in to keep, under Sign-in methods in the settings.
- What we receive. When you choose one, Google or Apple sends us a signed statement that you hold that account: its identifier at the provider, its email address and whether the provider has verified it, and, from Google, your name and the address of your profile picture. Apple shares your name only the first time you use it with us, and only if you choose to, and it can give us a private relay address instead of your own email.
- What we ask for. Only that: who you are, and your email. We get no access to your mail, contacts, calendar or files, and we cannot act in your Google or Apple account.
- What we keep. Supabase, our authentication provider, keeps the link with your sign-in record: the provider's identifier and the details it sent, the name and picture address included where the provider sent them. The email becomes the owner's login email. If you open a shop this way, the name you confirm becomes the owner's name. The activity log records only which method was added or removed.
- What Google or Apple learns. That you signed in to Nitaj, and when — as the provider of your account, under its own privacy policy. We send it nothing about your shop. If you chose Apple's private relay address, the emails we send you pass through Apple's relay on their way to you.
- Changing it. Adding or removing a method asks you to confirm it is you first, and we email the owner's address each time. Removing one unlinks it at once and deletes the provider's identifier from your sign-in record. You cannot remove your last way to sign in. Everything in this section is deleted with your login when your last shop is purged (see how long it is kept, below).
06Sub-processors and where your data is
| Sub-processor | What it does | Where |
|---|---|---|
| Supabase | the database, authentication, and file storage | Frankfurt, Germany (AWS eu-central-1) |
| Vercel | hosting and delivery of the web application; cookieless, aggregated visit statistics on the public marketing pages; cookieless page-performance timings | United States, with a global delivery network |
| Resend or Mailgun | delivery of transactional email, whichever is configured on the platform | United States |
| Sentry | crash and error diagnostics, only when a reporting key is configured, and with personal data removed before a report is sent | United States |
| Anthropic (Claude) | AI suggestions, only for a shop whose owner has switched AI on; and our own platform operations, described below | United States |
| Google (Gemini API, paid tier) | the same, as a fallback when Anthropic cannot answer | United States |
| OpenRouter | the same, only when we enable it for a feature (it is not enabled today) | United States |
There are no others. No advertising network, no tracking pixels, no third-party scripts beyond the two Vercel measurements named above.
AI providers. Inside a shop, AI features run only after its owner switches AI on in Settings and agrees to a text that names these providers; the owner can switch it off again at any time. What such a feature sends is only what it needs — for example, the names on a bank line and the candidate clients it might belong to — and never a bank account number, a telephone number, a balance or a password. Anything carrying personal data goes only to a provider whose terms say it does not train on it. For these features we keep neither the prompts nor the answers; we record only that a request was made, by which shop, and what it cost.
Separately, for our own operations, we ask an AI provider which shops may need our support. This covers every shop, whether or not it has switched AI on. It sends each shop's operating figures under a number rather than its name: its plan and account state, how long it has existed, days since it last sold and since its till last reported, how many invoices it made in a week, its open support reports, whether it is over its plan's limits or its backup failed, how many staff and products it has, and which app version its till runs; and, for the platform as a whole, how many people reached each step of signing up. It sends no shop name, no owner, no client, no invoice and no amount of money, and only to a provider that does not train on it. We keep the recommendations it returns, for our own reference.
Visit statistics (Vercel Web Analytics) run only on the public marketing pages — the landing, demo, pricing and contact pages — never inside a signed-in shop, the admin panel, or the mobile app. They are cookieless: they store nothing on your device, build no profile of you across sites, and the events they record carry no name, email, phone number or anything typed into a form — only counts, such as "a demo request was submitted".
Performance timings (Vercel Speed Insights) run on every web page, including inside a signed-in shop. They measure how fast a page loaded — the route, the timing figures, the type of device and connection — and nothing else: no cookie, no identifier, no content of the page, no name, and nothing about the shop's records. They exist so that a slow till can be found and fixed.
Your data leaves Palestine. The database is in Frankfurt, Germany, in the European Union, and the other sub-processors are in the United States. Each of them is bound to us by its own published data-processing terms, which include standard contractual clauses for international transfers and a commitment to process data only on our instructions. We will tell merchants at least thirty days before we add or replace a sub-processor, as the addendum sets out.
07Cookies
The platform sets functional cookies only. There is no analytics cookie and no third-party cookie of any kind — both Vercel measurements described above are cookieless and store nothing on your device.
| Cookie | What it is for |
|---|---|
nitaj_session | keeps a signed-in staff member signed in |
nitaj_admin | the same, for a platform administrator |
nitaj_store | which store account is signed in |
nitaj_ownersel | which of an owner's shops is currently selected |
nitaj_switched | a one-shot notice that the selected shop changed |
nitaj_till | which till this browser is ringing up on |
nitaj_lang | Arabic or English, per device |
nitaj_oauth | a Google or Apple sign-in in progress, for ten minutes |
nitaj_apple_resume | carries Apple's answer to the page that finishes linking it, for two minutes |
nitaj_sticket | carries a verified Google or Apple sign-in to the step that opens a shop, for fifteen minutes |
nitaj_stepup | proves you confirmed it was you, for five minutes, before a sign-in method changes |
No consent banner is shown because none of these is used for anything but running the service. The light/dark theme is remembered in the browser's own storage on the device and never sent to us.
08How long it is kept
- A live shop's data is kept while the shop is live. Nothing is deleted on a schedule while the subscription runs.
- A shop whose subscription has ended is blocked, not deleted. Its data is kept so that it can be reactivated. If it stays blocked for six months, we may delete it, and we will email the owner at least thirty days before we do, so the shop can be exported or renewed first.
- A deleted shop — closed by its owner, or deleted after that notice — is retained for ninety days and then permanently purged, together with everything that belongs to it.
- Saved exports, reports and attachments in file storage are removed 90 days after they are produced or detached.
- Backup bundles are kept to the most recent few per shop (8 by default) and the older ones are pruned.
- Sync tombstones — which carry no personal data, only "a row with this id is gone" — expire after 30 days.
- Operational logs follow platform-wide retention windows: the activity log is archived rather than deleted after at least 30 days, and sign-in attempt records and expired session tokens are removed after at least 7 days.
09Taking your data with you
A shop owner can export their entire shop — catalogue, clients, sales history, settings — as a single file, at any time, from the store settings. That export is also the termination path: it is offered before a shop is deleted, and it is what the addendum means by return of data.
10Security
Access to a shop's data is scoped to that shop at the database level. Staff PINs are stored hashed, never in plain text. Terminal credentials are revocable from the owner's Devices screen, and a stolen refresh token invalidates the whole device rather than being silently reused. File storage buckets are private; no uploaded file is world-readable. All traffic between your devices and the platform is encrypted in transit.
If we learn of a breach of security that affects a shop's data, we will tell the merchant without undue delay, and in any case within 72 hours of becoming aware of it, with what we know, what it affects, and what we are doing.
11Your rights
If you are a merchant (the owner of a shop), you can at any time:
- See and correct your account details, in the store settings.
- Export your whole shop, from the store settings, in a machine-readable file.
- Delete your shop, by asking us through the contact form; it is retained for ninety days and then purged as described above.
- Object to any processing you believe goes beyond running the service, and ask us anything about what we hold; we answer within thirty days.
- Complain. If you are unhappy with our answer, you may take the matter to the courts of Gaza under the terms of service, or to any data-protection authority that has jurisdiction over you.
If you are a shop's client or a member of its staff, your data is held for that shop and the shop decides about it. Ask the shop first. The shop can correct or delete your record from its clients screen. If the shop does not answer, write to us and we will pass your request to the shop and tell you the outcome. Two things are honestly not yet built and we will not promise them here: a per-client export, and an erasure that reaches every place a name may have gone — receipts already saved, backups already taken, free-text log entries. Both are on our list.
We sell no data to anyone and use it for no purpose other than those on this page.
12Children
The service is for businesses and their staff. It is not directed at anyone under eighteen, and a shop account may only be opened by an adult.
13Changes to this page
The version in force is shown at the foot of this page. If we change this page in a way that reduces your rights or widens what we do with data, we will email every shop owner at least thirty days before the change takes effect, and where possible show a notice inside the product. Corrections and clarifications that do not reduce your rights take effect when published. Continuing to use the service after a change takes effect means you accept it; if you do not, you can export your shop and close it before that date.
14Contact
Questions and requests about this page go through the contact form.