This Privacy Notice explains how Khaled Atieh, sole proprietor trading as Baji ("we", "us", "our"), collects and uses personal data when you use the Baji software service (the "Service") or interact with us. Baji acts as the data controllerfor personal data collected through the Service, except where we act as a processor for our business customers in respect of their end-customer records they upload to Baji.
1. Data we collect
- Account & identity: name, email address, password (hashed), business name, role.
- Merchant content: business details, branch details, packages, and the customer records you choose to store in Baji (customer name, phone number, package activations).
- Support communications: messages you send to us, including any attachments.
- Usage & technical data: log data, device and browser identifiers, IP address, approximate location derived from IP, feature usage and diagnostics.
- Cookies & similar: strictly necessary cookies for authentication and security; optional analytics cookies where enabled.
Payment card data is collected directly by our Merchant of Record, Paddle, and is not stored by us. We receive limited billing metadata (plan, status, invoice references) from Paddle.
2. How we use your data & legal bases
- To provide the Service — create your account, run packages and passes, deliver support (legal basis: performance of a contract).
- To secure the Service — prevent fraud and abuse, monitor for security incidents (legitimate interests / legal obligation).
- To improve the Service — analyse usage in aggregate, fix bugs (legitimate interests).
- To communicate — send transactional emails such as sign-in codes, password resets, receipts and service notices (contract). Marketing emails only with your consent, and you can opt out at any time.
- To comply with the law — tax, accounting, and legal obligations (legal obligation).
3. Who we share data with
- Merchant of Record (Paddle) — to process sales, subscriptions, invoicing, tax, and customer refunds. See Paddle's Privacy Notice.
- Service providers / subprocessors — cloud hosting and database (Supabase / AWS regions used by Lovable Cloud), email delivery, error monitoring and analytics tooling. We only share what is needed and require appropriate confidentiality and security terms.
- Professional advisers — legal, accounting, and audit advisers where necessary.
- Authorities — when required by law, court order, or to protect rights and safety.
We do not sell your personal data.
4. International transfers
Baji operates from Kuwait. Some of our subprocessors are located outside your country of residence (including the EEA/UK, United States, and Middle East regions). Where personal data is transferred internationally we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms recognised under applicable law.
5. Retention
We keep personal data for as long as necessary to provide the Service and for legitimate business purposes (for example, tax and accounting records for the period required by law). When we no longer need it, we delete or anonymise it. If you close your account, we delete your account and associated personal data within 90 days, except records we are legally required to retain.
6. Your rights
Depending on your location, you may have rights to:
- access the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete data, subject to legal retention obligations;
- restrict or object to certain processing;
- request a portable copy of the data you provided to us;
- withdraw consent where we rely on it; and
- complain to your data protection authority.
To exercise any of these rights, email hello@bajikw.com. We aim to respond within one month.
7. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, encrypted storage, access controls, principle-of-least-privilege service roles, and audit logging. No system is perfectly secure — please help us by using a strong password and keeping your credentials confidential.
8. Cookies
We use strictly necessary cookies to keep you signed in and to protect the Service from abuse. Where we use analytics or marketing cookies we ask for your consent first and you can change your choice at any time from the cookie preferences link in the footer of the Service.
9. Children
Baji is intended for use by businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Changes to this notice
We may update this notice from time to time. If we make material changes we will notify you by email or in-product before they take effect.
11. Contact
Data controller: Khaled Atieh, trading as Baji, Kuwait. Email: hello@bajikw.com.