AyByay is a point-of-sale, stock and credit-ledger app for small shops in Bangladesh. This page says exactly what we hold, why we hold it, who can see it, how long we keep it and how you get rid of it — in plain words, with nothing hidden in a footnote.
Last updated: 10 August 2026 · Applies to the AyByay web app at shadhurs.aybyay.com, the AyByay Android app (com.aybyay.app), and this website.
The whole policy in one line: your shop's data belongs to your shop. We hold it so the app can run, we never sell or rent it to anyone, and you can export it or delete it at any time without asking our permission.
When you sign up we take the shop name and shop type, the owner's name, a mobile number (verified with a one-time SMS code) and a password. If the owner creates staff logins, we hold each staff member's name, phone number and role. If you buy a paid plan, we hold the reference number of the bKash or Nagad transaction. We never see or store card numbers.
Everything the shop enters into the app: products and prices, sales and purchases, stock levels, the credit ledger, expenses, suppliers, settings and reports. This is the shop's own bookkeeping. We are holding it on the shop's behalf.
A shop can show a QR code on a receipt or at the counter. A customer who scans it fills in their own details on their own phone: name and mobile number, and optionally WhatsApp number, email, gender, age band, area, birthday and language. The form cannot be submitted without ticking the consent box. We also record which QR or receipt it came from, a rough device type, and a hashed IP address to stop abuse.
A shopkeeper can build their customer and supplier list from the contacts already saved on their phone. Because this is other people's data, it has its own section below and its own rules.
Most shopkeepers in Bangladesh already keep their customer list somewhere: in a paper notebook, and in their phone. This feature moves that list into the ledger so credit balances can be tracked properly. Because it involves people who are not our users, it is the most carefully limited thing the app does.
There are three ways, and every one of them starts with the shopkeeper choosing to do it. Nothing happens in the background, and nothing happens at first launch.
The names and phone numbers are sent over an encrypted connection to that one shop's own database on our servers, and held in a contacts list that only that shop can open. The shopkeeper then marks people as a customer, a supplier, both, or neither. Marking someone a customer creates a customer record so their credit balance and purchase history can be tracked. Someone left unmarked simply sits in the contacts list until the shopkeeper gets to them.
Contacts are also matched against the customer records the shop already has, so the same person does not end up in the ledger twice. That matching happens inside the shop's own database. It is never done across shops, and one shop's contacts are never compared against another shop's.
The three limits that matter: we take only a name and a phone number; those records are visible only to the one shop that imported them and to nobody else, including other shops on AyByay; and we do not send them to any third party, any advertiser, any data broker, or any artificial-intelligence service.
If a shop has saved your name and number, you can ask that shop to show you what they hold, correct it, or delete it — they can do all three from inside the app. If the shop does not respond, write to us at [email protected] and we will act on it. We will never publish a contact list, sell one, or make one searchable by anyone outside the shop that holds it.
We do not profile users, we do not build audiences, we do not run advertising, and we do not use anyone's data to train an artificial-intelligence model.
No advertiser, data broker, credit bureau or marketing company receives anything from AyByay. There is no advertising SDK in the app and no analytics service that receives personal data.
Two suppliers process data strictly on our instructions, only so the service can function, and are not permitted to use it for anything of their own:
Imported contacts are never sent to either of the above beyond storage, and never to any artificial-intelligence service. Where the app uses AI to read a photographed invoice or suggest a product category, contact names and phone numbers are not part of what is sent.
The only other circumstance in which we would hand over data is a valid, lawful order from a competent authority — and we would tell the affected shop unless the law forbids it.
We will also say the honest part out loud: no system anywhere is completely breach-proof. If something does happen, we act quickly and tell the people affected rather than hoping nobody notices.
Nothing here needs our approval, and nothing here is buried. If you would rather we did it for you, the email route at the bottom works too.
Before deleting anything, an owner can export the shop's data — products, customers, sales, purchases, expenses — to CSV or JSON from Settings, then My data export. Your records leave in a format you can open elsewhere.
To request deletion of your account and its data without doing it yourself, or to ask a shop to remove your details as one of its customers or contacts, email [email protected] from the address or with the mobile number on the account. Say which shop and what you want removed. We will confirm the request, act on it, and write back when it is done. If you are a shop's customer rather than a shop owner, talking to that shop directly is usually the fastest route, and we are the fallback if they do not respond.
One consequence worth stating plainly: deleting a shop's account removes the shop's own books. We cannot get them back for you afterwards, and neither can anyone else. Export first.
AyByay is business software for adults running a shop. It is not directed at children under 13 and we do not knowingly collect their data. If we learn that we have, we delete it.
We operate from Bangladesh. The data is held on Cloudflare's cloud infrastructure, which means servers may sit outside Bangladesh. Wherever it physically sits, the rules on this page apply to it, and the encryption and isolation described above travel with it.
We have shaped this policy around the direction Bangladesh's personal data protection rules are taking — consent before collection, a limited and stated purpose, and a real route to correction and deletion. This is an honest description of how we work. It is not a claim to hold any certification.
As the product grows this policy will be updated. Anything significant is announced inside the app, and the date at the top of this page always shows when it last changed. We will not quietly widen what we collect and leave you to spot it.
Questions, corrections, complaints, or a deletion request: [email protected].
If you are a customer of a shop that uses AyByay, start with that shop — they hold your record and can change it immediately. We are here if they do not.
This policy is also published in Bangla for shopkeepers at shadhurs.aybyay.com/privacy. Both versions describe the same practices; if they ever appear to differ, tell us and we will fix it.