Privacy Policy — pre-release draft

Status: PRE-RELEASE DRAFT. This is not a published policy and has not been reviewed by a lawyer. Qualified legal review in Kosovo (and, if applicable, GDPR advice) is required before this text is treated as binding. Version: draft-pre-release-2026-10-02 Contact (public channel): info@aibokify.com

This document does not claim confirmed compliance with a cited law, provider certification, a named encryption protocol, scheduled backups, penetration testing, universal auditing, subprocessor contracts, incident deadlines, analytics cookies or automated deletion. The hosting region and provider certifications are not verified here.

1. What this draft covers

When you use Aibokify, you may provide account information and business data. This draft describes principles: the kinds of data that enter the product, that your data remains yours, and that you may request access, correction, deletion or export — without deadlines or legal conclusions.

A confirmed operator, appointed DPO and legal address have not been published in this draft.

2. What data you may provide

If you complete the product's fields, they may include:

• account identity (name, email, phone)
• business details you enter (name, NUI, addresses, logo)
• invoices, receipts, payroll and accounts you record
• employee, customer and supplier data you enter

When you scan a receipt, the image may be sent to an OCR provider to extract text. This draft does not assert a contract, location or retention policy for that provider.

Technical data (IP address, browser, errors) may appear with infrastructure or error-monitoring providers when configured. There is no confirmed subprocessor list and no claim that every subprocessor has a GDPR contract with us.

3. What we use it for

The principle is to use it to provide the tools (invoicing, payroll, reporting, account access) and keep the system operating. This draft does not assert that we do not sell data, train models or transfer data outside a region — those operational claims are not substantiated here.

4. Where it is stored — unconfirmed

The code uses Supabase as the primary source for synchronized data. localStorage / IndexedDB are used for caching and may also hold the fiscal queue, settings and key material on the device, depending on which features are enabled. Not all browser data is transient cache. This draft makes no claims about the hosting region, named encryption, password hashing or scheduled backups.

Local data may remain on the device. Signing out does not guarantee that all local data has been deleted; retention depends on the type of data and the browser settings.

5. Third parties

Possible categories (from code, not published contracts):

• database and authentication
• application hosting
• edge services and workers
• OCR when you scan
• email when sending is configured
• error monitoring (if enabled)

Names, locations, SOC certifications and contractual clauses are not part of this draft.

6. How long data is retained

No retention periods or automated deletion are published here. Legal retention of accounting documents requires qualified advice; this draft does not determine that obligation.

7. Your rights (principle, not a deadline)

Depending on the law that may apply to you, you may request:

1. to see what data we hold
2. correction of inaccurate data
3. deletion, subject to any limits the law may impose
4. an export (the product includes an export function)
5. restriction of or objection to a use, if the law provides for it

No response deadline is promised. Send your request to info@aibokify.com. This draft does not name a complaints authority or cite legal provisions as a conclusion of compliance.

8. Security (principle)

We try to protect accounts (passwords, optional 2FA, RLS in code). This draft does not claim named encryption protocols, universal auditing or scheduled penetration testing.

No incident-notification deadline is published here.

9. Cookies

The web application may use storage for sessions and language. This draft makes no claim about analytics cookies.

10. Children and transfers

Do not use the Service for children unless you are authorized. Age rules and cross-border transfers require legal review — this draft does not establish them.

11. Changes

The draft may change during pre-release. No notice period has been published.

12. Contact

info@aibokify.com — no guaranteed response time. No DPO is appointed in this draft.

This text is a development draft, not legal advice. External validation by a qualified lawyer in Kosovo is essential.