Privacy Policy

This Privacy Policy explains how TitanX ("TitanX", "we", "us") collects, uses, shares and protects information when you use TitanX Business Suite, its apps, API and AI connectors (the "Service"). It forms part of our Terms & Conditions.

Contents

1. Who is responsible for what
2. What we collect
3. How we use it
4. Who we share it with
5. AI features
6. Cookies and device storage
7. Security
8. Backups and data loss
9. How long we keep it
10. Your choices and rights
11. Where data is stored
12. Children
13. Changes to this policy
14. Contact

1. Who is responsible for what

1.1 For your account (the owner's and staff logins' names, emails and usage), TitanX decides how the information is used and is responsible for it under this policy.

1.2 For the business records you keep in TitanX — your customers, suppliers, employees, invoices, payroll, documents and so on — your business decides what is collected and why (for a business with several owners, those owners decide), and TitanX processes it on your behalf. You are responsible for having a lawful basis to collect it, for telling those people how you use their information, and for answering their requests. We will help where we reasonably can.

2. What we collect

Information you give us

• Account details: name, username, email address, password (stored only as a salted one-way hash), profile photo, phone number, and two-step sign-in settings.
• Business profile: business name, logo, address, contact details, TIN, VAT registration, bank details you choose to print on documents, and your settings.
• Business records: customers, suppliers, products, stock, invoices, quotes, receipts, expenses, bills, bank statement lines, ledger entries, projects, bookings, support tickets, messages, and documents and photos you upload to the Document Vault or attach to records.
• Staff and payroll: employee names, contact details, TIN, FNPF numbers, pay rates, payslips, leave and timesheets you enter.
• Payments to us: what you bought and when. Card payments are handled by our payment provider; we do not see or store full card numbers.
• Things you tell us: support requests, feedback and messages to the AI assistant.

Information collected automatically

• Usage and security logs: sign-ins, IP address, browser and device type, pages and actions, API and AI connector calls, and an audit log of important changes in your account.
• Devices: for paired tills and printers, the device name, platform, app version and sync status.

3. How we use it

• To provide the Service: store your records, produce documents and reports, send the emails and messages you ask us to send, sync your devices and run the features you switch on.
• To secure the Service: authenticate you, prevent fraud and abuse, enforce rate limits and investigate incidents.
• To bill for plans, storage and AI usage.
• To support you, and to tell you about changes to the Service, your account or these documents.
• To keep the Service working and improve it, using aggregated or de-identified usage information.
• To comply with the law and respond to lawful requests from authorities.

We do not sell personal information, use your business records for advertising, or train AI models on your business records.

4. Who we share it with

We share information only as needed to run the Service, with:

• Infrastructure providers that host our servers and store backups.
• Email and messaging providers that deliver the emails, WhatsApp or Viber messages you or the Service send.
• Payment providers (such as Stripe and M-PAiSA) when you pay us or take payments from your customers.
• AI providers (such as Google's Gemini, or a model that runs on our own servers) when you use an AI feature — see section 5.
• Apps you connect: outside AI apps (such as ChatGPT or Claude), webhooks, API clients and integrations you authorise receive what you allow them to access.
• Government bodies when you choose to send something to them (for example FRCS receipt signing in its sandbox), or when the law requires us to.
• Your own team: staff logins see what their role allows.
• A successor if the Service is sold or reorganised, under this policy.

Each provider handles information under its own terms. We are not responsible for the practices of third parties or of apps you connect.

5. AI features

When you use the AI assistant, scan a receipt or ask for an analysis, the relevant text, records or images are sent to the AI provider to produce the answer. The AI provider processes it under its own terms to return the answer. AI output can be wrong; please check it (see the Terms). The AI Analyst module can be switched off for your business in Settings → Modules, and you can disconnect outside AI apps at any time.

6. Cookies and device storage

We use only the cookies the Service needs: a session cookie to keep you signed in, a security (CSRF) cookie, and small preferences such as light or dark mode, stored in your browser. Our apps keep data on the device so they work offline. We do not use advertising or third-party tracking cookies.

7. Security

We use encryption in transit (HTTPS), hashed passwords, encrypted storage for payment and integration secrets, private file storage, two-step sign-in, role-based access for staff, rate limits and audit logs. However, no method of transmission or storage is completely secure, and we cannot guarantee the security of any information. You are responsible for your passwords, devices and the people you give access to. If we become aware of a breach affecting your information, we will tell you without undue delay where required.

8. Backups and data loss

We back data up regularly and test restores, as a best-effort safeguard. Backups are not guaranteed and data may still be lost. Please export your data regularly and keep your own copies. Our responsibility for data loss is set out, and limited, in the Terms.

9. How long we keep it

• Your account and records: for as long as your account is open, and at least seven years after anyone last used it, matching the record-keeping period Fiji requires of businesses.
• After you delete your account: removed 60 days after you ask (you can cancel within that window); a business you share with another owner stays with them, and purged from backups on their normal rotation.
• Fiscal records, after you delete your account: invoices and credit notes signed by FRCS's production VMS, with the records they depend on (their lines, payments, signed receipts, fiscal activity, signing device and certificate records, the files they show) and only your business's legal name and TIN, because the law requires tax records to be kept. They are held in a locked record nobody can sign in to and that no list, search, export or public link reaches; only TitanX can reach them, to give them to you as their former owner or to an authority legally entitled to them. They are kept until the end of the tax period each belongs to plus seven years, longer while a legal hold applies, and then permanently deleted (see Terms section 6.3).
• Legal holds: an account we must preserve (for example for a court order or an investigation) is not deleted until the hold is released.
• Ask Titan chats: you can delete a conversation yourself at any time (Clear in the chat); the text is then removed for good. Chats you do not delete are deleted automatically 12 months after their last message. A record of what the assistant did (the action log and audit trail) is kept as a security record, without the chat text.
• Security, audit and billing records: as long as reasonably needed for security, disputes and the law.

10. Your choices and rights

• See and export: everything is visible in the app and exportable from Settings → Export & backups.
• Correct: edit your profile and records in the app.
• Delete: delete records, or your whole account from Settings → Cancel account.
• Disconnect: revoke API keys, connected AI apps and devices in Settings at any time.
• Ask us: raise a support ticket in TitanX (Contact TitanX in your account menu) with any privacy question or request; if you no longer have a login, email support@titanx.tech. We may need to confirm your identity first.

11. Where data is stored

Our servers and some of our providers are located outside Fiji, so your information may be stored and processed in other countries whose laws may differ from Fiji's. By using the Service you agree to this transfer. We choose providers that protect information with appropriate safeguards.

12. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect information from children for our own purposes.

13. Changes to this policy

We may update this policy. The version and date at the top show which applies; material changes are notified in the app or by email, and the account owner is asked to agree to them.

14. Contact

Privacy questions or requests: raise a support ticket in TitanX (Contact TitanX in your account menu), or email support@titanx.tech if you cannot sign in.