Privacy Policy

This policy explains how Storix collects, uses, shares and protects your data, and what rights you have over it. It applies to all of our products:

• The web store-management dashboard at https://store.khaledcode.com and its marketing site.
• The Storix mobile and tablet app for Android and iOS (package ID com.khaledcode.storix), and the Windows desktop build.
• The online storefront your customers open to browse products and place orders.
• The platform-administration app and dashboard used by our own operations team.
• Our support channels: email, phone and WhatsApp.

The service is operated by Khaled Code, Damascus, Syria, reachable at hi@khaledcode.com. By using the service you agree to this policy.

We handle two different kinds of data, and our role differs between them:

• Your account and subscription data (your name, email, phone, company details, subscription invoices): we are the controller and process it to run the platform and provide the service to you.
• The data you enter about your business and your own customers (products, stock, invoices, customer records, pharmacy prescriptions, staff records): you are the controller and we are the processor acting on your behalf. We process it only to operate the service on your instructions, never for our own purposes.

You are responsible for collecting your customers’ and staff data lawfully, and for informing them and obtaining consent where your local law requires it.

We collect only what the service needs to work:

• Account and identity data: name, phone number, email, company/store/branch names, role and permissions, interface language, currency and country. Passwords are stored hashed and cannot be read by us.
• Business data: products, barcodes, prices and costs; stock, batches, expiry dates and serial numbers; sales, invoices and returns; purchases, purchase orders and suppliers; accounting entries and balances; shifts and cash-drawer records.
• Your customers’ data: name, phone number, delivery address and its map coordinates when selected, order history, loyalty points and outstanding debt. In pharmacy deployments this may include prescription details — sensitive data processed solely on your instructions.
• Staff data: name, role, login and activity logs, shift and commission records where used.
• Subscription and payment data: plan, invoices, payment status, and the transfer-proof images you upload for manual payment. We never receive or store full credit-card numbers.
• Technical and log data: IP address, device model and OS, app version, device identifier used for sync, sign-in times, and error/activity logs for security and troubleshooting.
• Content you upload: product images, store logo, attachments, and the text of messages you send through support or the WhatsApp bot.

We do not collect biometric data, do not track your location in the background, and do not use advertising trackers or build profiles for targeted advertising.

The app requests each permission only when the related feature is used. You may decline it, or revoke it later in your device settings — the app keeps working with that feature disabled:

• To provide and operate the service: creating your account, syncing data across your devices, running sales, inventory and delivery operations, and printing receipts — to perform our contract with you.
• To manage subscriptions and billing: activating your plan, issuing invoices, and reviewing payment proofs.
• To send operational notifications: order confirmations, expiry and stock alerts, and WhatsApp messages to your customers when you enable that feature.
• To provide support: answering your questions and investigating issues you report.
• To keep the service secure: detecting unauthorised access, limiting abusive automated use, and investigating incidents — in our legitimate interest in protecting the service and its users.
• To improve the product: analysing aggregate performance and crash data. We never sell or share your data for advertising.
• To comply with the law: retaining accounting records and responding to binding legal requests.

The app is offline-first: your store data is kept in a local database inside the app on your device until it can sync with our servers. Your access token (JWT) is kept in the platform’s encrypted store — Keychain on iOS, EncryptedSharedPreferences on Android.

Uninstalling the app clears the local copy but does not delete your data from our servers — see “Deleting your account and data”.

We do not sell your data or your customers’ data to anyone, and we never share it with ad networks. We share it only in the following cases and only to the extent needed:

Our service providers are bound by agreements restricting their use of the data to performing the service we requested.

Your data may be stored or processed on servers operated by providers in other countries. Where that happens we work with providers offering appropriate safeguards, and transfer only what is needed to operate the service.

• Account and store data: for as long as your subscription is active.
• After an account-deletion request: removed from live systems within 30 days, and purged from backups within 90 days at the latest.
• Accounting records and invoices: kept for the period required by applicable tax and accounting law, even after the account closes.
• Security and sign-in logs: up to 12 months.
• Support correspondence: up to 24 months after the last contact.

You can request deletion of your account and all of your data in any of these ways:

• Email us at hi@khaledcode.com from the address registered on your account, with “Account deletion request” in the subject line.
• Message us on WhatsApp at +965 96090382 from the number registered on your account.
• Use the dedicated data-deletion request page at /data-deletion.

We verify your identity, complete the deletion within 30 days, and confirm it to you. Deletion covers account and user records, products and stock, customers and orders, and uploaded files. Records we are legally required to keep (such as subscription invoices) are excluded, kept isolated, and not used for any other purpose. You may request an export of your data before deletion.

• HTTPS/TLS encryption in transit between your apps and our servers.
• Passwords stored as irreversible hashes using a strong hashing algorithm.
• Each company’s data isolated from every other at the database level (multi-tenant isolation).
• Fine-grained role-based permissions, so staff only see what their job requires.
• Short-lived, revocable access tokens stored encrypted on the device.
• Sensitive integration credentials (such as WhatsApp keys) encrypted before storage.
• Regular backups, and staff access to customer data limited to operational and support necessity.

No safeguard is completely secure. If a breach affects your data we will notify you, and notify the competent authorities where the law requires, without undue delay.

At any time you have the right to:

• Access your data and learn what we process about you.
• Correct inaccurate or outdated data.
• Delete your data and your account.
• Export your data in a machine-readable format and port it elsewhere.
• Object to or restrict certain kinds of processing.
• Withdraw consent at any time (for example location or notification permissions), without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with the competent supervisory authority in your country.

To exercise any of these rights, email hi@khaledcode.com. We respond within 30 days at the latest and may ask you to verify your identity to protect your account. If you are a customer of a store that uses our platform, address your request to that store — it is the controller of your data — and we will assist them in fulfilling it.

The service is intended for businesses and the people who work in them; it is not directed at children. We do not knowingly collect data from anyone under 16, and will delete such data promptly if we become aware of it. If you are a parent or guardian and believe a child has provided us with data, contact us and we will remove it.

The web dashboard uses strictly necessary cookies only: keeping you signed in, remembering preferences such as language and the selected branch, and protecting forms. We use no advertising cookies and no cross-site tracking networks. The mobile app uses on-device storage for the same purposes.

The website loads web fonts from Google Fonts, which means your IP address may reach Google’s servers; system-font fallbacks are provided so the interface works without that request.

If you use Storix to run your store, you are responsible for your customers’ and staff data: collecting it lawfully, informing people through your own privacy notice, obtaining any required consent (especially for sensitive data such as prescriptions), and responding to their requests about their data. We provide the export, edit and delete tools you need to do so.

We may update this policy as the service or legal requirements change. The updated version is published on this page with a revised “last updated” date, and we notify you of material changes by email or in-app at least 30 days before they take effect. Continuing to use the service after that date means you accept the new version.

For any question or request about your privacy or your data:

• Email: hi@khaledcode.com
• Phone: +963 993385473
• WhatsApp: +965 96090382
• Address: Damascus, Syria
• Website: https://www.khaledcode.com