Privacy policy
Last updated
This policy explains what personal data Karobix ("we", "us"), collects when you use our website and point-of-sale service, how we use it, and how you can delete it. Effective date: 10-20-2026.
Who this covers
It covers visitors to our website, people who contact us, and the owners and staff of businesses that use Karobix ("customers"). Our customers also record data about their own shoppers, such as names, phone numbers and delivery addresses. For that data the customer decides what is collected and why, and we process it on their behalf and only to provide the service.
What we collect
Account data: your name, email address, optional phone number and password (stored only as a secure hash). Managers may also set a terminal PIN, which is hashed too. We record when you last signed in.
Google or Facebook sign-in: if you choose "Continue with Google" or "Continue with Facebook", that company sends us your name, email address, whether the address is verified, your account ID with them and a link to your profile picture. We never see your Google or Facebook password, we do not keep access tokens, and we never post or read anything on your behalf. We use this only to sign you in.
Business data: business name and type, branches, staff and staff invitations, products and product photos, stock, suppliers, purchases, transfers, registers and shifts, sales, refunds, discounts, expenses, restaurant tables and orders, and customer records you enter.
Billing data: the plan you choose, bank transfer references and the payment receipts you upload for verification.
Support data: support tickets, your messages and any files you attach.
Contact form data: your name, email, optional phone and business name, your message and your IP address.
Technical data: IP address, browser and device type, and sign-in sessions; an audit log of sensitive actions in a business (such as refunds, discounts above the limit and manager approvals); and error reports that record the account, business and page involved (never what you typed), kept for 30 days.
How we use it
To provide, secure and support the service, and to keep each business's data separate.
To verify payments and manage your subscription.
To reply to your messages and support tickets.
To send service emails, such as email verification, staff invitations, a trial or plan ending, and a warning before an inactive account is deleted. We do not send marketing email without your consent.
To protect our forms against spam and abuse.
To understand how people find and use our website and to measure our advertising, as described below.
Cookies and browser storage
We use cookies that are needed to keep you signed in, remember your sign-in if you ask us to, and protect forms against forgery. The point-of-sale terminal stores your product catalog, display preferences and any sales waiting to be sent in your browser's storage, so the till loads quickly.
Analytics and advertising
On our public website, sign-up and sign-in pages and your account pages, we may use Google Analytics, Google Tag Manager and the Meta (Facebook) Pixel. These tools set cookies and collect information about your device and how you use our pages. The point-of-sale terminal does not load them.
When you create an account, start a trial or pay for a plan, we tell Google and Meta that this happened, including the plan and amount, so we can measure our advertising. When you are signed in we may send them your account ID and a hashed (one-way scrambled) copy of your email address, and we may also send these events directly from our server together with your IP address and browser details. We never share your business records, such as sales, products or customers, with them.
You can block or delete cookies in your browser settings, install the Google Analytics opt-out add-on, and manage ad settings in your Meta ad preferences.
Spam protection (Google reCAPTCHA)
Our contact, sign-up, sign-in and forgot-password forms are protected by Google reCAPTCHA, which collects information about your device and how you use the page and sends it to Google. The Google Privacy Policy and Terms of Service apply.
Who we share it with
We do not sell personal data. We share it only:
With service providers who help us run the service, under confidentiality obligations: Google (sign-in, reCAPTCHA, analytics and advertising), Meta (sign-in and advertising).
Within a business: when you join a business as staff, its owner and the managers they authorise can see your name, email, phone and the actions you take in that business.
When the law requires it, or to protect the rights and safety of our users and the service.
Some of these providers may process data outside Pakistan.
How long we keep it
Business records are kept while the business exists. If a subscription ends, the business becomes read-only and its records are kept so the owner can still see them.
When an owner deletes their account, every business they own is permanently erased with all its records and uploaded files.
If your account appears on another business's records (for example, sales you rang up as staff), deleting it removes your name, email, phone and sign-in methods and locks it, so that business's financial history stays intact.
We may delete accounts whose email address was never verified after 30 days, and accounts with no sign-in for 365 days after emailing a warning 14 days ahead. Accounts belonging to a business on an active trial or paid plan are not deleted this way.
Deleting your account and data
You can delete your account yourself at any time:
Sign in and open Settings → Profile.
Choose Delete account and confirm with your password. If you signed up with Google or Facebook and never set a password, first use "Forgot your password?" on the sign-in page to set one.
This deletes your account and every business you own, as described above, and cannot be undone.
To stop Karobix from signing you in with Google or Facebook, remove it under your Google Account → Security → Your connections to third-party apps & services, or Facebook → Settings & privacy → Settings → Apps and websites. This does not delete your Karobix account, so follow the steps above as well if you want it gone.
Security
We use encrypted connections, hashed passwords and PINs, encrypted storage for secret keys, separation of each business's data, role-based permissions and an audit log of sensitive actions. No system is completely secure, so please use a strong password and keep your Google or Facebook account secure if you sign in with it.
Your choices
You can see and correct your account details under Settings → Profile, delete your account as described above, and ask us for a copy of your personal data or to stop using it for analytics and advertising. Staff of a business using Karobix should first contact that business, as it controls its records.
Children
Karobix is a service for businesses and is not meant for anyone under 18.
Changes
We will post updates on this page and change the effective date. For significant changes we will notify account owners by email.
Contact
Questions about this policy: use our contact page.