This policy explains how Samba.pk ("Samba", "we", "us") handles personal data when you visit samba.pk, create an account, or use the Samba business software (the "Service"). We built Samba for Pakistani businesses and we take the trust of every shopkeeper and their customers seriously.
If anything here is unclear, write to us at support@samba.pk.
1. Who is responsible for your data
For your account, billing and our website, Samba is the controller of your personal data.
For the business records you enter into Samba — your customers, suppliers, staff, sales, purchases and ledgers ("Customer Data") — your business is the controller and Samba acts only as a processor on your behalf. See section 9.
2. What we collect
Information you give us:
- Account details: name, email address, phone number, business name, and a password (stored only as a one-way hash).
- Business setup: branches, staff members you invite, tax and settings you configure.
- Customer Data you enter while running your business in Samba.
- Messages you send to our support team.
Information collected automatically:
- Technical data: IP address, browser and device type, pages requested and timestamps, kept in server logs for security and troubleshooting.
- Error reports: when the app crashes we record the error, the page and browser details so we can fix it.
- Preferences stored in your browser, such as theme, language and branding (see section 8).
Information from others:
- If you choose "Sign in with Google", Google shares your name, email address and profile picture with us.
- If you connect WhatsApp, Meta shares the identifiers of the WhatsApp Business account you authorise.
3. How we use it
- To create and secure your account and let you sign in.
- To provide the Service: store and process your business records, generate invoices, reports and documents you request.
- To send messages the Service needs to send: verification codes, password resets, staff invitations, receipts, and notifications you enable (email, SMS, WhatsApp, push).
- To bill you for paid plans and keep financial records the law requires.
- To provide support, investigate problems and keep the Service secure and available.
- To improve Samba using aggregated, non-identifying usage information.
We do not sell personal data, and we do not use your Customer Data for advertising.
4. Google user data
When you sign in with Google we request only your basic profile (name, email address, profile picture) to create and authenticate your Samba account. We do not request access to your Gmail, Drive, Contacts or any other Google data.
We use this information only to sign you in and identify your account, we do not share it with third parties except the service providers listed below who help us run Samba, and we do not use it for advertising. Samba's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Samba at any time from your Google Account settings (Security → Third-party apps with account access).
6. Where data is stored and how long we keep it
Samba is operated from Pakistan. Our servers and databases are hosted in data centres in the European Union, and some of our providers process data in other countries. By using Samba you understand that your data is transferred outside Pakistan for these purposes; we choose providers with strong security and data-protection commitments.
- Account and Customer Data: kept for as long as your account is active.
- After you close your account or a subscription ends: you can export your data for 30 days, after which we delete it from our live systems within 90 days.
- Backups: kept on a rolling 30-day cycle, so deleted data disappears from backups within 30 days of deletion from live systems.
- Billing records: kept as long as Pakistani tax and accounting law requires.
- Server logs: kept for up to 90 days.
7. How we protect it
- All traffic to Samba is encrypted with TLS (HTTPS).
- Passwords are stored as salted one-way hashes; we can never see your password.
- Each business's records are kept in its own isolated database schema.
- Access is protected by role-based permissions you control for your staff.
- Databases are backed up daily, and stored files and backups are encrypted at rest by our storage provider.
- Only authorised Samba staff can access production systems, and only when needed to run or support the Service.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you without undue delay.
9. Data processing for your business (Customer Data)
When your business stores information about its own customers, suppliers or staff in Samba, we process that Customer Data only on your instructions and to provide the Service. Specifically, we:
- process Customer Data only to provide, secure and support the Service for you;
- keep it confidential and require the same of our staff and sub-processors (section 5);
- apply the security measures in section 7;
- help you respond to requests from people whose data you hold;
- let you export your Customer Data at any time, and delete it when your account ends (section 6);
- notify you without undue delay of a security breach affecting your Customer Data.
Your business is responsible for having a lawful basis to collect the data it enters into Samba and for telling its own customers how it uses their information.
10. Your choices and rights
You can view and update most of your account details in Samba at any time. You can also ask us to:
- give you a copy of the personal data we hold about you;
- correct inaccurate data;
- delete your account and personal data (subject to records we must keep by law);
- stop sending optional notifications — you can also switch them off in settings.
Write to support@samba.pk from the email address on your account. We reply within 30 days. If you are a customer of a business that uses Samba, please contact that business first; we will help them respond.
11. Children
Samba is a business tool and is not intended for anyone under 18. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy as Samba or the law changes. We will change the "last updated" date above and, for material changes, notify account owners by email or in the app before the change takes effect.
13. Contact
Samba.pk, Lahore, Pakistan — support@samba.pk