Privacy Policy

This policy explains what personal data SoftSystem Developers collects, why we collect it, who we share it with, and how you can have it removed. It covers softsystem.biz, our retail and ERP software products, and the WhatsApp messaging service we operate for business customers.

1. Who we are

SoftSystem Developers is a software house registered in Pakistan and based in Lahore. We have built retail point-of-sale, inventory and ERP software since 2001, and we provide custom web, application and AI development services.

That address reaches the person responsible for everything in this policy, including access and deletion requests.

2. The two kinds of people this policy covers

Our messaging service has two very different groups of people in it, and we treat their data differently. It is worth being clear about which one you are.

• Business customers. Shops, distributors and companies who use our software, or who connect their WhatsApp Business account to our service so they can send invoices and notifications to their own customers.
• End customers. The people who receive those messages — usually someone who has just bought something from one of our business customers. We hold their data on behalf of that business, not for our own purposes.

If you received a WhatsApp message about a purchase and want it stopped, the fastest route is to reply to that business directly, or to use our data deletion page.

3. What we collect

From business customers

• Business name, contact name, email address, telephone number and business address.
• WhatsApp Business Account identifiers, phone number identifiers, and the access tokens that let us send messages on that account’s behalf.
• Records of support requests and correspondence with us.
• Billing and account records where we invoice for our services.

From end customers

• The WhatsApp telephone number the message is sent to, and the display name WhatsApp provides.
• The content of the message we send — typically an invoice number, date, amount and a PDF of the invoice — together with any reply sent back.
• Delivery status: whether a message was sent, delivered, read or failed, and when.

From website visitors

• Anything you type into a contact or demo form on softsystem.biz.
• Standard server logs kept by our hosting provider, including IP address and browser type.

We do not use advertising or tracking cookies on softsystem.biz.

4. Why we use it, and on what basis

We do not sell personal data, and we do not use end customer numbers for our own marketing. A number given to us to deliver one shop’s invoices is used for that and nothing else.

5. Consent for messaging

WhatsApp requires that a business has the customer’s opt-in before messaging them. That opt-in is collected by the business at the point of sale or sign-up, and the business is responsible for holding it. Our Terms of Service require every business using our service to obtain it, to honour opt-outs, and not to send marketing to people who have not asked for it. Where we are told a person has withdrawn consent, we stop.

6. Who we share it with

• Meta Platforms, Inc. — messages are delivered over the WhatsApp Business Platform, so message content and recipient numbers pass through Meta’s systems and are handled under Meta’s own privacy terms.
• Our hosting provider — our servers and this website are hosted with Hostinger, which stores data at rest on our behalf.
• The business whose customer you are — delivery reports and replies go back to them, since the conversation is theirs.
• Authorities, where we are legally required to disclose something.

Because WhatsApp is operated by Meta, message data is processed on servers outside Pakistan. Connecting a WhatsApp Business account to our service necessarily involves that transfer.

7. How long we keep it

• Message content and delivery status — 12 months, then deleted, unless the business asks us to remove it sooner.
• Access tokens — until the business disconnects their account or the token is revoked, whichever comes first. Disconnection deletes them immediately.
• Business account and contact records — for as long as the business is our customer, and then 12 months.
• Billing records — as long as Pakistani tax law requires, currently six years, regardless of any deletion request.
• Website form submissions — 24 months.

8. Security

Traffic to our services runs over HTTPS. Access tokens are held server-side and are never exposed to a browser. Access to production systems is limited to the SoftSystem staff who need it. No system is perfectly secure, but if a breach affects your data we will tell you and the relevant authority without undue delay.

9. Your rights

You can ask us to do any of the following, and we will respond within 30 days:

• Tell you what data we hold about you.
• Correct anything that is wrong.
• Delete your data — see our data deletion instructions.
• Stop messaging you.
• Provide a copy of what you have given us.

Write to sulaiman@softsystem.biz. If you are an end customer, include the phone number the messages were sent to, so we can find the right records.

10. Children

Our services are sold to businesses and are not directed at children. We do not knowingly collect data from anyone under 18. If you believe we hold a child’s data, tell us and we will remove it.

11. Changes to this policy

If we change this policy we will update the date at the top of the page. Where a change materially affects business customers, we will tell them directly.

12. Contact