Draft — pre-evidence-sprint · for warm diligence conversations only
Trust · Legality · Data protection

Trust, in plain sight.

AyByay is a live production system holding real shops' daily takings, their stock, and their customers' credit. This page states exactly how that data is held, on what basis, and what we will never do with it — with nothing claimed that the running build cannot back up.

Database-per-tenant isolation Encrypted off-site backups Demo is write-blocked We never sell data

The promise this whole page keeps: every number here is pulled from live tenant databases, and the exact SQL is available on request. Nothing appears on this page that a query cannot reproduce in front of you. Where a figure has a caveat, we print the caveat — because the honesty is the diligence.

1DB / shop
Isolated tenant database
No shared customer table across shops
0sold
Customer records sold or brokered
Not our model — SaaS subscription, no data resale
0writes
Writes the demo can make
Read-only role, live-verified
R2encrypted
Automated off-site backups
Runs on a schedule, not by hand
1 · Ownership & lawful basis

The shop owns its data. We hold it for the shop.

The simplest, truest framing of the whole arrangement — and the one that decides every question below.

Data controller

The shopkeeper

  • Decides what to record about their own customers
  • Owns the ledger, the stock list, the sales history
  • Can export it or ask for it to be deleted (§5)
  • Is the person their customers already trust with a phone number
processes on behalf of
Data processor

AyByay

  • Stores & serves that data so the shop can run
  • Sends the SMS/WhatsApp reminders the shop asks it to
  • Keeps it isolated, backed up, and recoverable
  • Uses it only to deliver the service the shop pays for

Lawful basis for processing

Processing rests on performance of the service contract with the shop (running its POS, stock and ledger) and the shop's legitimate interest in operating its own business. Customer-facing SMS reminders add a consent gate on top (§2). We are the processor; the shop is the controller of its customers' data.

Bangladesh's comprehensive Data Protection Act is still in draft as of 2026; we do not claim certification under any regime we have not been audited against. What we describe here is the posture the running system actually enforces.

Data minimisation, by design

A shop OS needs a customer's name and a phone number to run a baki ledger and send a reminder — so that is essentially all the customer PII we hold. We do not ask a shopkeeper's customers for national ID, address, date of birth, or payment-card data, and the product has no field for them.

Name Phone number Amount owed / paid No NID · no card · no address
2 · Customer PII — baki phone numbers & SMS

A phone number enters for one reason, and leaves through one gate.

The most sensitive data the platform touches is a shopkeeper's customer's phone number, attached to money owed. Here is its entire life inside AyByay.

✍️

Entered by the shop

The shopkeeper adds a customer's name + phone to their own baki ledger — the same information they already keep on paper.

🗄️

Stored in that shop's DB only

It lands in that one shop's isolated database (§3). No cross-shop customer table exists to leak it sideways.

🔔

Used only for reminders

The number is used to send the baki reminder the shopkeeper chooses to send — nothing else. It powers no ad, no third-party feed.

Consent gate before send
🧹

Removable on request

The shop can edit or remove a customer; on account closure the shop's data — customers included — is exported and deleted (§5).

SMS & WhatsApp reminders are consent-gated and shop-initiated

Reminders are sent by the shopkeeper to their own customers — AyByay does not message a shop's customers on its own initiative, and does not use those numbers for its own marketing. During the current pre-launch phase, the live SMS gateway is pinned to a test recipient so real customers are not messaged before go-live — a deliberate safety catch, not a limitation to hide.

In transit & at rest

  • Served over HTTPS/TLS on Cloudflare's edge
  • Authenticated access with roles & PIN gates on sensitive actions
  • Off-site backups are encrypted before they leave the platform (§4)
  • Access to raw databases is limited to platform operations, not exposed to other tenants
3 · Isolation

One shop can never read another shop's ledger.

AyByay is a database-per-tenant system: each shop's data lives in its own database, not in a shared table filtered by a shop-id in application code. Isolation is structural, not a WHERE clause someone could forget.

  • Every shop gets its own database — sales, stock, customers, baki, all separate
  • There is no global customers table that a bug could spill across shops
  • A control-plane database holds only account/plan records — never one shop's customer PII beside another's
  • Backup, export and deletion all operate at the single-tenant boundary, so one shop's actions never touch another's data

This is the same boundary that makes the honest funnel below reproducible: each shop's numbers come from that shop's own database, queried in isolation.

4a · The demo can look, not touch

Demo access is write-blocked at the role level

The public demo runs on a dedicated tokenized link with a read-only demo role. It cannot create sales, edit stock, send messages, or reach another tenant's data. The write-block and endpoint blocklist are live-verified, not assumed — because a demo anyone can open is exactly the surface an attacker probes first.

Read-only role Endpoint blocklist Seeded demo catalog only

Why this matters for diligence

An investor or partner can open the demo and try to break it without any risk to a real shop's data. The demo is deliberately walled off from the tenant databases above — the cheapest thing to verify, and we made it verifiable on purpose.

4b · Backups & recovery

Losing a shop's data would be unforgivable, so we don't rely on nobody-forgetting.

AUTOMATED
Scheduled encrypted backups to R2
Tenant data is backed up to off-site object storage on a schedule, encrypted before it leaves the platform. It is not a manual chore someone can skip.
RESILIENCE
Offline-first client, so a shop keeps trading
The app is designed and bench-tested to keep billing through multi-hour load-shedding and connectivity loss, syncing an outbox when the network returns — data is not lost when the internet is.
RUNBOOK
A documented deploy & restore runbook exists today
Recovery is written down, not held only in the founder's head — see continuity (§6). A second person holds emergency deploy/restore access now.

We state recovery honestly: automated encrypted backups and a written restore runbook exist. We do not claim a formally tested RPO/RTO SLA we have not measured — that is a milestone the raise funds, not a badge we wear early.

5 · The shop's data belongs to the shop

Take it with you, or have it erased.

📤 Export

A shop's data is exportable through a backup/export endpoint — the shopkeeper is never locked in, and can carry their sales, stock and customer records out. Owning your own history is also the switching cost that keeps us honest about earning renewal.

🗑️ Deletion

Because each shop is a separate database, closing an account means removing that shop's data at its own boundary — customers, ledger and all — without touching any other tenant. Individual customer records can be edited or removed by the shop at any time.

6 · The boundary lines

What we deliberately do not do.

A trust page that only lists what we do is half a page. These are the lines the business is built to hold.

✅ What we do

  • Hold each shop's data in its own isolated database
  • Collect only the customer name + phone a ledger needs
  • Send reminders only when the shopkeeper chooses to
  • Back up encrypted, off-site, on a schedule
  • Let a shop export or delete its data
  • Earn revenue from a subscription the shop pays for

🚫 What we never do

  • Sell, rent, or broker any shop's or customer's data
  • Build a cross-shop customer profile or shared contact graph
  • Message a shop's customers on our own initiative or for our marketing
  • Ask a shop's customers for NID, address, or card details
  • Let the public demo write to, or read from, real shop data
  • Claim a certification, an SLA, or traction we have not measured
7 · The thing you'd otherwise find yourself
0real paying shops today

We are pre-revenue by design. The only rows in the payments table are two SSLCommerz sandbox ৳299 test charges on an empty, zero-sale test shop, placed six minutes apart on 2026-07-15 — integration testing, not revenue.

We show you this so you don't find it in diligence and wonder what else was hidden. Surfacing it is worth more than the two charges ever could be. The seed exists to answer the only two questions that carry money — will a shop pay, and will it stay — not to dress up a number we don't have.

8 · The live funnel — every row survives a query

Seven real shops, named honestly — including the empty ones.

Selective transparency reads worse than full disclosure, so the empties are on the list too. One definition throughout: active = at least one sale in the trailing 7 days.

7real shops signed up (2 internal test tenants excluded)
3have transacted (≥1 sale)
2in genuine daily/repeat use — jamaltara, banbro
0paying real taka — what the raise buys

Detail: jamaltara & banbro in real use · alnoor early (4 products, 3 sales) · ziadsshop, rizzatrading, smcommunication, luvensy signed up but not yet onboarded. Comped plans, zero billed — never presented as paying customers.

Daily-use proof jamaltara — cloth shop
550
products
58
sales
32,813
through the till
585
active baki · 3 of 21 customers
Active 17 of 30 days in July — granular beats "billing daily," and it survives a live dashboard check.
Catalog-import proof only banbro — grocery / import
1,626
products in the single import
the Prokriyon opening-stock batch
2,163
total catalog now
grown since — never "one session"

৳5.04M inventory, at-cost, import day — AI-mapped from a PrimeERP export in one session, billing the same day. Described strictly as onboarding proof; it billed on 7 days then went quiet, so we never call it "daily use."

9 · Continuity

A live production system, and a plan that doesn't depend on one person being fine.

Why this belongs on a trust page

The platform holds real shops' daily data, built solo. That is both the achievement and precisely why continuity matters — a single-operator system carrying other people's data is a data risk, not just a hiring gap, and we treat it as one.

What exists today (not a budget line)

  • A second person holds emergency deploy/restore access now
  • A documented deploy/restore runbook already exists
  • Automated encrypted R2 backups already run
  • A second set of eyes already reviews the first — the LTV/CAC math on our own deck was red-teamed and corrected before any investor saw it

Reproducibility & sourcing

Every internal figure on this page traces to a live tenant-database query, stored so it can be run in a screen-share. Every external comparison in our wider materials carries its publication, year and scope. If a number can't survive a live query or a named source, it is not on the page.

Live D1 pull · 2026-08-01 evidence.sql on request Draft · pre-evidence-sprint

Want to detonate a claim?

Good. That's what this page is for. Ask for the SQL behind any number, or open the write-blocked demo and try to break it. Nothing here is meant to survive only until you look closely — it's built to survive exactly that.