Jomi Business privacy policy
This page explains in plain words what data Jomi Business receives, why, and how we protect it. We process personal data in line with the law of the Republic of Tajikistan on personal data protection.
1. Who is responsible for the data
Jomi Studio (Dushanbe) is responsible for the data of the owners and staff who sign in to Jomi Business.
The data of a business’s clients and guests (names, phones, purchases, debts, bookings) is entered by the business itself. The business is responsible for keeping it lawfully; Jomi Studio stores and processes it only on the business’s behalf and to run the service.
2. What data we receive
Owner: name, phone number, password (stored only as a protected hash — we never know the password itself), chosen language.
Staff: name, login, PIN (also only as a hash), role and branch.
Business data: products and prices, receipts, shifts, expenses, stock, deals, payroll, bookings — everything you enter.
QR menu guests: the order, the table number and — if the guest chose to give them — a name and phone.
Technical data: the IP address (to limit password guessing and spam orders), the sign-in cookie and the «known device» cookie (so other people’s wrong tries never block your phone), this device’s notification subscription, and in a problem report — the app version and the screen.
3. Why
To run the service: count sales, debts, stock and pay, show reports, take guest orders and send notifications.
To protect the account and the money: limits on sign-in attempts, the activity log, a 24-hour hold on payment details and exports after a password change.
To take subscription payments and answer support requests.
We show no ads, never sell data and use no third-party tracking or analytics.
4. Where data is stored and who else receives it
The service and its database run on the Cloudflare platform, whose servers are in several countries. Data travels only over an encrypted connection (HTTPS). The database is backed up every night and backups are kept for 35 days.
The payment service (if you pay online) receives the amount and the invoice number. The SMS service (if SMS reset is connected) receives the phone number and the code. Telegram receives only the messages you turned on yourself (daily totals, orders).
We pass data to no one else, unless the law requires it.
5. How long we keep it
While you have a business in Jomi Business and for at least 12 months after the subscription ends — or less, if you ask us to delete the data. Backups disappear after 35 days. Sign-in attempt counters by IP are kept from 15 minutes to a day.
6. Your rights
You can see and correct your data in the app, export it («Settings → Backup copy») and ask us to delete the account and the business — write to us in Telegram or by email from the number the business is registered to.
An employee can ask the business owner to change or delete their data; the owner closes their access under «Staff».
7. Cookies and browser storage
We use only necessary cookies: signing in and recognising your device. The browser’s storage keeps your language, a copy of the catalogue for working offline and unsent sales. There are no advertising cookies.
8. How we protect data
Passwords and PINs are stored as hashes, the connection is encrypted, staff have different rights, important actions go into a log, and one business never sees another’s data. If we learn of a leak, we will tell the owners affected.
9. Changes to this policy
If the policy changes, we update this page and its version date, and warn about important changes in the app.