1. Who We Are

Fatoura is a cloud-based invoicing, billing, and accounting service for Kuwait and GCC businesses, operated by Crowd Agency. When we say "Fatoura", "we", "us" or "our" in this policy, we mean Crowd Agency.

Questions about this policy: info@wecreatecrowd.com

2. What Data We Collect

We collect only what the app needs to function. This falls into four categories:

• Account data: your email address, display name, and authentication provider (Google sign-in or email + password).
• Workspace data: company name, address, phone number, email, tax ID, and any logo, signature, or stamp images you upload.
• Client data you enter: names, email addresses, phone numbers, and postal addresses of your clients. You are the source and controller of this data — we store it on your behalf.
• Document data: invoices, quotes, receipts, credit notes, purchase orders, delivery notes, and expense reports you create — including line items, amounts, dates, currencies, and payment records.
• Plan and settings: your active plan, feature preferences, reminder rules, SMTP configuration (stored encrypted), and WhatsApp API credentials (stored encrypted).

3. Where Data Is Stored

All data is stored on Google Firebase infrastructure in the me-central1 (Gulf / Middle East) region. This includes:

• Firebase Firestore — database (documents, clients, settings, payment records)
• Firebase Authentication — account identity and sign-in
• Firebase Hosting & Cloud Functions — application delivery and backend processing

Google's own privacy policy and data processing terms govern the underlying infrastructure. We do not operate our own database servers.

4. Third Parties That Receive Your Data

We share data with the following third parties, and only to the extent needed for the service to work:

5. You Are the Data Controller for Your Clients' Data

Your clients' names, contact details, and payment records are personal data that you enter into Fatoura. You are the data controller for that data; Fatoura acts as a data processor on your instructions. You are responsible for having a lawful basis to hold and process your clients' information, and for handling any requests your clients make about their data.

6. Data Retention and Deletion

Your data is retained for as long as your account is active. If you delete your account:

• Your workspace data (documents, clients, settings) is removed from active Firestore databases.
• Your authentication record is removed from Firebase Auth.
• Automated backups maintained by Google Firebase infrastructure may retain copies for up to 30 days before they are overwritten.

To request deletion of your account and data, email info@wecreatecrowd.com with the subject line "Account deletion request" and the email address associated with your account. We will process your request within 30 days.

7. Security Practices

We take reasonable technical measures to protect your data:

• All data in transit is encrypted via HTTPS/TLS.
• Firestore security rules restrict each workspace's data to authenticated members of that workspace.
• SMTP passwords and WhatsApp API tokens are stored encrypted and are never returned in API responses.
• Access to the production database is restricted to signed-in, authorised users and Cloud Functions.

8. Changes to This Policy

We may update this policy when the app changes materially — for example, when a new third party is added or a data practice changes. The updated date at the top of this page reflects the most recent revision.

9. Contact

For privacy questions, data access requests, or deletion requests:

info@wecreatecrowd.com