HelloZaki — Privacy Policy

Last updated: 29 May 2026

This Privacy Policy explains how HelloZaki ("HelloZaki", "we", "us", or "our") collects, uses, shares, and protects information when you use the HelloZaki mobile application (the "App", package identifier `com.erpapp.frontend`) and related services.

By creating an account or using the App, you agree to the practices described in this Policy. If you do not agree, do not use the App.

1. Who We Are and the Scope of This Policy

HelloZaki provides a mobile assistant that connects to your organization's Odoo Enterprise Resource Planning (ERP) system, letting you search and manage business records (customers, products, sales orders, and invoices) and use an AI chat assistant, document scanning, and voice input.

The App is primarily a business-to-business (B2B) tool. This means there are two kinds of data with two different roles:

Your account data — information about you as a user of the App (such as your name, email, and authentication details). For this data, HelloZaki acts as the data controller.
Your organization's business data — the ERP records you access and create through the App, which may include personal data about your organization's customers, suppliers, and contacts. For this data, HelloZaki acts as a data processor acting on behalf of your organization (the data controller). Your organization's own privacy policy governs how that data may be used.

2. Information We Collect

a. Account and Authentication Data

Name and email address
Password (stored only as a salted bcrypt hash — never in plain text)
Two-factor authentication secret and recovery codes (stored encrypted)
Language preference
Session information, including IP address and device/browser user-agent string

b. Content You Provide

Chat messages you send to the AI assistant and the assistant's responses
Scanned documents — images you capture or select for text recognition, and the text extracted from them
Voice recordings you submit for speech-to-text transcription

c. Business / ERP Data

When you use the App, you read and create records in your organization's Odoo system. These records can include personal data about third parties, such as:

Customer and supplier names, email addresses, phone numbers, and postal addresses
Tax identification numbers (VAT), customer references, credit limits
Sales orders and invoices, including line items, amounts, and dates

d. Device and Diagnostic Data

App version and basic device information
Crash reports and error diagnostics
Operational logs (such as request timing and which features were used), retained for a limited period for troubleshooting

We do not knowingly collect special-category data (such as health, biometric, or political data) and ask that you not enter it into the App.

3. How We Use Information

We use the information above to:

Provide and operate the App's core features (search, record management, chat)
Authenticate you and keep your account secure (including two-factor authentication)
Process your chat messages, scanned documents, and voice input to produce useful results
Connect to and synchronize with your organization's Odoo system
Diagnose crashes, fix bugs, and improve reliability
Comply with legal obligations and enforce our Terms of Service

We do not sell your personal information, and we do not use your content or business data to train third-party AI models.

4. Third-Party Services (Sub-Processors)

To deliver the App's features, we share certain data with the service providers listed below. Each receives only the data needed for its function.

Provider	Purpose	Data it receives
Odoo (your organization's ERP)	Read and write business records	Customer, product, sales-order, and invoice data
Typesense	Fast search across your records	Names, emails, phones, SKUs, amounts, and other indexed fields
Mammouth (AI / LLM provider)	Power the AI chat assistant	Your chat messages, extracted document text, and relevant record summaries used as context
Groq (speech-to-text)	Transcribe voice input	The audio you record for transcription
Google ML Kit	On-device text recognition (OCR)	Processed on your device — scanned images are not uploaded to Google for OCR
Sentry	Crash and error reporting	Diagnostic data and error details

These providers process data under their own privacy and security terms. Your organization's Odoo instance is operated by or for your organization.

5. Device Permissions

The App requests the following permissions, used only for the stated purpose:

Camera — to scan receipts, invoices, and documents for text recognition
Microphone — to capture voice input for the chat assistant
Photo library — to import existing images for text scanning
Storage — to read and handle selected files
Internet / network — to communicate securely with our servers and the services above

You can revoke any permission in your device settings; some features will then stop working.

6. AI Processing Notice

The App uses artificial intelligence to interpret your messages, scanned text, and voice input. To do this:

Your chat messages, extracted document text, and relevant business-record summaries are sent to our AI/LLM provider (Mammouth) to generate responses.
Voice recordings are sent to Groq for transcription.

AI-generated output may be inaccurate or incomplete. The App may suggest actions such as creating a sales order, invoice, or delivery. You are responsible for reviewing and verifying any AI-suggested action before confirming it. Do not rely on AI output without checking it.

7. Data Retention

We keep information only as long as needed:

Account data — until you delete your account or request deletion
Chat sessions — archived after about one week of inactivity and deleted after approximately 30 days
Chat request logs and AI analytics — about 30 days
AI conversation history — about 30 days
Background sync job history — about 7 days
Web session data — expires after the session ends (typically within a few hours)

Business/ERP data lives in your organization's Odoo system and is retained according to your organization's own policies.

8. How We Protect Your Information

All data in transit is encrypted using TLS (HTTPS).
Passwords are stored as bcrypt hashes; two-factor secrets and session data are encrypted at rest.
Each organization's data is logically isolated from others (multi-tenant separation).
Access to systems is restricted to authorized personnel.

No method of transmission or storage is completely secure, but we work to protect your data using industry-standard measures.

9. Your Privacy Rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Delete your data ("right to erasure")
Port your data to another service
Object to or restrict certain processing
Withdraw consent at any time, where processing is based on consent

If you are in the European Economic Area or the United Kingdom, these rights arise under the GDPR. If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, the right to delete, and the right to opt out of the sale of personal information — note that we do not sell personal information.

To exercise any right, contact us at tech@progistack.com. We will respond within the time required by applicable law. For business/ERP data, please direct requests to your organization, which controls that data.

10. Account and Data Deletion

You can request deletion of your account and associated personal data at any time:

In the App — open Settings and use the account deletion option, where available, or
By email — send a request to tech@progistack.com from your account email address.

Upon a verified request, we delete or anonymize your account data and associated content within a reasonable period, except where we must retain certain records to comply with legal obligations. Business records stored in your organization's Odoo system are deleted according to your organization's policies.

11. International Data Transfers

Your information may be processed in countries other than your own. Where data is transferred internationally, we rely on appropriate safeguards (such as standard contractual clauses) as required by applicable law.

12. Children's Privacy

The App is a business tool and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to This Policy

We may update this Policy from time to time. We will revise the "Last updated" date above and, for material changes, provide notice in the App. Continued use after changes means you accept the updated Policy.

14. Contact Us

For any privacy question or request:

HelloZaki

Email: tech@progistack.com