Privacy Policy, Customer Dashboard

1. Controller

Controller is InSoft Online, Karlstraße 18, 72336 Balingen, Germany. Email: info@insoftonline.de. Phone: +49 151 16908778. VAT ID: DE320436561. Website: https://insoftonline.de. Further company details are listed in the Impressum.

2. Who the app is for

The app is for business customers of InSoft Online: shops and companies that use InSoft products. Users manage the company account, subscriptions and systems, support, shop orders, invoices, and profile.

Self-registration is available: company name, contact name, email, password, phone, locale, and acceptance of the terms. Guest mode lets you browse the store catalog without signing in. Account features need a login. The app languages are English, German, and Arabic. The app is not directed at children.

3. Purposes of processing

We process data to create and run your account, sign you in, reset a forgotten password, and resend email verification.

We process data to show your profile, dashboard, subscriptions and systems, shop catalog, cart, checkout, orders, invoices, and support.

We process data to deliver push notifications, realtime support chat, feedback you submit, and a WhatsApp support link when you ask for one.

We process data to keep the service secure, prevent misuse, and meet tax and commercial duties.

4. Categories of data

Account and profile on our server: company name, contact name, email, phone, street, postal code, city, country, preferred language, email verification status, owner flag, and whether the account is active. Your password is stored in protected form. The app does not receive the full password back. We also record sign-in times and failed sign-in attempts, as described in the main account policy.

Google sign-in: name, email, and a technical provider user id. We do not receive your Google password. Details are in section 8.

Shop, orders, subscriptions, and invoices: cart and checkout lines, market, currency, VAT, shipping amounts, billing and shipping address fields used at checkout, payment method id and payment status, order reference, timeline, and notes you provide. Subscription and system metadata (identifiers, dates, modules or products, download URLs). Invoice and billing summary data. Coupon or support-code redemption.

Support and feedback: conversation metadata and message text, feedback category and content, and optional images, files, or audio recordings you attach. If you open WhatsApp support, the chat then runs in WhatsApp.

Device and app: Firebase Cloud Messaging token, stored on the device and sent to our server when you log in. Auth bearer token stored locally. Language preference. Cached profile fields for display. App version and operating system as a normal HTTP user agent. We do not invent extra analytics events. The current iOS privacy manifest declares no tracking and an empty collected-data list. It references UserDefaults and file timestamp APIs used by the platform.

We do not sell personal data. This build does not include Firebase Analytics, Crashlytics, advertising SDKs, or cross-app tracking.

5. Device permissions

Internet: to reach the API, load images, open payments, and run chat.

Camera: photos for feedback or a report, and QR or barcode scan. The camera is not used for background surveillance.

Microphone: an optional voice note on feedback or a report.

Photos, media, and files: so you can attach an image or file you choose. The app does not upload your whole library.

Notifications: support and account push via Firebase Cloud Messaging. Vibration and start-at-boot support local notification delivery.

Deep link insoftapp://payment: return to the app after a payment page.

No continuous GPS tracking and no maps advertising in this app.

6. Where data is stored

On the device: auth token, push token, language, and cached profile fields (local storage).

On InSoft servers: the customer API at https://support.insoftonline.de/customer, for account, shop, orders, invoices, subscriptions, chat, and feedback. Transmission to our backends uses HTTPS.

Firebase: Authentication for Google sign-in, and Cloud Messaging for push.

Pusher Channels: delivery of the realtime support chat.

Payment providers: the payment session and the confirmation, not your full card or bank number. The payment page may open in a web view or in the browser.

Email providers: account and order emails, as in the main privacy policy.

Providers such as Firebase may process data outside the European Union. Where that happens, the transfer is based on an adequacy decision or on standard contractual clauses.

7. Recipients and third parties

InSoft Online operates the backend. Hosting providers run our servers under contract.

Google Firebase provides Authentication and Cloud Messaging. Google Sign-In provides the identity assertion.

Pusher provides the realtime messaging infrastructure for support chat.

Payment providers such as PayPal, Klarna, and Stripe handle the payment. We do not store full card or bank numbers. We keep the payment status and confirmation.

Email delivery providers send account and order mail. WhatsApp (Meta) applies only when you open the WhatsApp support link. WhatsApp’s own terms then apply.

Authorities receive data only where the law requires it. This build has no advertising networks.

8. Sign in with Google

You can sign in with Google. The sign-in window is run by Google Firebase Authentication. If you choose this, we receive your name, your email address, and a technical account identifier. We do not receive your Google password.

We use this data only to create your InSoft account or sign you in, and to link it to an existing InSoft account with the same email address. We do not use it for advertising and we do not sell it.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

This policy does not claim Apple Sign-In for the Customer Dashboard app. Apple sign-in, where the website account offers it, is described in the main account privacy policy.

9. Orders, subscriptions and payments

When you order, we process the cart, checkout details, billing and shipping fields you enter, VAT and shipping amounts, the payment method you select, and the payment status.

Subscriptions and systems show identifiers, dates, modules or products, version, and download links.

Invoices and the billing summary are shown from your account.

Payments are completed by providers such as PayPal, Klarna, and Stripe. The app may open the provider page, then return through the link insoftapp://payment. We do not receive or store your full card or bank details.

10. Support chat, feedback and WhatsApp

Support chat stores conversation metadata and the text you send. Messages are delivered in realtime through Pusher Channels.

Feedback and reports include a category and your text. You may attach a camera photo, a gallery image, a file, or an audio recording. Those attachments are optional.

WhatsApp support: the app asks our server for a WhatsApp link and opens it. Once WhatsApp opens, Meta’s terms and privacy policy apply. We do not read your WhatsApp chats.

11. Push notifications

The app uses Firebase Cloud Messaging. On login it sends the device push token (fcm_token) to our server so we can send support and account notifications.

You can turn notifications off in the operating system settings. That stops delivery on the device. It does not delete account data already on our servers.

12. Guest browsing

You can browse the store catalog without an account. No login token is stored until you sign in.

A language preference may still be saved on the device. Account, orders, invoices, chat, and profile stay unavailable until you log in.

13. Legal bases

Account, orders, subscriptions, and support under the contract: Art. 6 (1) (b) GDPR, including steps before the contract.

Tax and commercial retention of invoices and orders: Art. 6 (1) (c) GDPR.

Security, misuse prevention, and running the service: Art. 6 (1) (f) GDPR.

Optional system permissions such as camera, microphone, and notifications: your consent through the operating-system prompt, Art. 6 (1) (a) GDPR. You can withdraw that consent in device settings.

14. Retention

Account data is kept while the account exists. When you delete the account we delete or anonymise it, except where the law requires us to keep records longer.

Orders and invoices are kept for up to ten years where German commercial and tax rules require it.

Chat, feedback, and attachments are kept for support handling and for as long as needed for the contract or for legal claims. We do not state a shorter fixed period.

Data on the device stays until you log out, clear the app storage, or uninstall the app.

15. Your rights

You can request access, correction, deletion, restriction, and a portable copy. You can object to processing based on legitimate interests. You can withdraw consent where processing is based on consent. You can complain to a supervisory authority. In Germany that is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

To use these rights, or to delete your account, email info@insoftonline.de. We may need to confirm it is you. Where the GDPR applies, we answer without undue delay and within one month.

16. Security

Connections to our services use HTTPS. Access to personal data is limited to staff who need it. Sign-in is protected against misuse.

Protect your device unlock and do not share your password. The app stores a sign-in token on the device so you stay signed in.

17. Children

This is a business app for adults. It is not directed at children. We do not knowingly collect personal data from children.

18. Changes

We may update this policy when the app or our processing changes. The date at the top will change. For significant changes we will tell you in a suitable way, for example in the app or by email.

19. Contact

Privacy enquiries for the Customer Dashboard: info@insoftonline.de · InSoft Online, Karlstraße 18, 72336 Balingen, Germany · Phone: +49 151 16908778 · https://insoftonline.de

Syria branch, for contact only: Damascus, White Bridge · +963 98 222 61 65.