BYZATK

Privacy Policy

Last updated: 8 November 2026

This Privacy Policy explains how The-IK Tech Lab, CR No. 202447-1, domiciled in Manama Municipality, Kingdom of Bahrain ("Byzatk", "we", "us"), collects, uses, shares and protects personal data when you use the Byzatk mobile app and the website www.byzatk.com (the "Service"). The-IK Tech Lab is the data controller (data manager) for your personal data.

We process personal data in line with the Kingdom of Bahrain's Personal Data Protection Law (Law No. 30 of 2018) and, where they apply to you, the data protection laws of the country where you live.

In short:

  • We do not sell your personal data and do not use it for advertising.
  • We never read your SMS inbox or call log.
  • Card numbers are kept to the last 4 digits only.
  • AI only sees what a request needs, with card numbers masked, and cannot change your records.
  • Your data is mainly stored and processed on Alibaba Cloud (Singapore).
  • You can export your data and delete your account at any time.

1. Data we collect

Account data:

  • your name, email address and password (stored only as a one-way hash);
  • your app language, home currency and settings, and which version of our Terms you accepted;
  • if you use Sign in with Apple or Google: the account identifier and email that the provider shares with us (with Apple this may be a private relay address).

Financial records you create:

  • transactions, wallets and balances, budgets, saving goals, subscriptions, loans, recurring entries, categories, tags and notes, bill splits and family-shared items.

These are records you enter or confirm. We are not connected to your bank and cannot see your real accounts.

Bank messages, receipts, statements and documents:

  • When you paste or share a bank message, we read it to create a draft transaction. We do not keep the original message text — only the details read from it (amount, currency, merchant, date, last 4 digits of the card) and a fingerprint used to prevent duplicates.
  • Receipt photos and statement files are read to create drafts. Statement files are deleted after reading unless you choose to keep a copy.
  • Warranty cards, receipts and documents you choose to attach are kept until you delete them.

Automatic capture (only if you turn it on):

  • iPhone: an Apple Shortcuts automation you set up sends the amount, merchant and card name of an Apple Pay payment to Byzatk.
  • Android: with your permission, Byzatk reads payment notifications only from the wallet and banking apps you allow, only while capture is on, and keeps only the payment details — never the notification text.
  • Captured payments wait in a review list until you confirm them.

AI and voice:

  • your questions to the BYZATK assistant and its answers; AI chat history is deleted automatically after 90 days;
  • voice entries, which are converted to text to create a draft.

Device and technical data:

  • device identifier, device name and model, operating system and app version;
  • sign-in sessions and the devices signed in to your account, and your push notification token;
  • IP address and request logs, used for security, abuse prevention and rate limiting;
  • crash reports with technical details of an error (not your financial records).

Purchases:

  • your plan, its dates and the Store's transaction identifiers. We never receive your card or payment details; Apple and Google process all payments.

Support:

  • messages you send us, and information you choose to let our support team see under a time-limited access grant.

Data we do not collect:

  • your SMS inbox, call log or contacts list, or your location;
  • full card numbers, card security codes or online banking passwords;
  • your Face ID or fingerprint, which never leave your phone.

2. How and why we use your data

  • To provide the Service you requested: your account, records, sync, reports, statements, reminders and plan features (performance of our contract with you).
  • To read bank messages, receipts, statements and voice with AI and to answer your AI questions (your consent, which you can withdraw in the app; without it you can still enter transactions by hand).
  • To read Android payment notifications (your consent through Android's permission screen, which you can withdraw at any time).
  • To keep the Service and your account secure, prevent fraud and abuse, enforce limits and fix errors (our legitimate interests and our contract with you).
  • To send service emails and notifications such as sign-in codes, security alerts, reminders you set, and plan and billing notices. You can turn off optional notifications in settings.
  • To comply with the law and respond to lawful requests from authorities.
  • To understand overall use of the Service in a way that does not identify you, and to improve it.

We do not make decisions with legal or similarly significant effects on you based solely on automated processing.

3. Where your data is stored and processed

Your data is mainly stored and processed on Alibaba Cloud (Singapore), including our database, file storage, email delivery and text recognition. AI features are provided by Alibaba Qwen AI (Singapore).

Before anything is sent to the AI, card numbers are reduced to their last 4 digits and only the information needed for the request is included. The AI only reads: it cannot create, change or delete your records, and drafts it suggests are added only after you confirm them. Under our agreement with the provider, your data is used only to answer your request.

4. Who we share data with

We share personal data only with service providers that process it on our behalf, under contract, for the purposes in this policy:

  • Alibaba Cloud (Singapore) — hosting, database, file storage, email delivery, text recognition and Qwen AI;
  • Apple — Sign in with Apple, App Store purchases and push notification delivery on iPhone;
  • Google — Sign in with Google, Google Play purchases, Firebase push notifications and crash reports.

We may also disclose data when the law or a court order requires it, to protect the rights, safety or property of our users or of Byzatk, or to a company that takes over the Service under the same protections (we will tell you first). We do not sell or rent personal data and do not share it with advertisers.

5. International transfers

Our main servers are in Singapore, outside the Kingdom of Bahrain. Apple and Google may process data in other countries. When your data is transferred outside Bahrain or your country, we protect it as required by the Personal Data Protection Law and other applicable law — for example through contractual safeguards with our providers and, where required, your consent. By using the Service you understand that your data will be processed in Singapore.

6. How long we keep data

  • Account and records: while your account is active.
  • After a paid plan ends: the cloud copy of your data is kept for 30 days, then permanently deleted unless you renew; your account, sign-in and billing record remain.
  • Data from a free trial that is not renewed: deleted when the trial ends.
  • AI chat history: 90 days.
  • Statement files you did not choose to keep: deleted right after they are read.
  • Account deletion: after the grace period (currently 7 days), personal data is erased and files are deleted; financial records are anonymised (hidden, free text removed, no link to you). Only billing and security records that the law requires us to keep are retained, without personal details, for as long as the law requires.

7. How we protect your data

  • Data travels over encrypted connections (HTTPS/TLS), and the app's database on your phone is encrypted with a key kept in the phone's secure storage.
  • Passwords are stored only as strong one-way hashes. Sign-in needs a password and a code sent to your email, and the app is opened with a passcode or biometrics.
  • Card numbers are masked to the last 4 digits and bank message text is not stored.
  • Access to our admin systems is limited to authorised staff, protected by strong passwords and two-factor authentication, and recorded in an audit log.

No system is completely secure. If a breach affects your personal data, we will notify you and the competent authority as required by law.

8. Your rights

Subject to applicable law, you have the right to:

  • know what personal data we hold about you and receive a copy (you can also export it from the app);
  • correct inaccurate data (most of it you can edit yourself in the app);
  • delete your data and account (More → Delete account in the app);
  • withdraw your consent at any time, for example for AI reading or Android capture, without affecting processing that happened before;
  • object to processing based on our legitimate interests, and ask us to restrict processing;
  • not be subject to decisions based solely on automated processing with significant effects;
  • complain to the Personal Data Protection Authority of the Kingdom of Bahrain, or to the data protection authority in your country.

To exercise your rights, contact our data protection representative (below). We may ask you to confirm your identity and will respond within the time required by law.

9. Children

Byzatk is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy. The current version and its date are always available in the app and on www.byzatk.com. If a change is important, we will tell you in the app or by email before it takes effect and, where required by law, ask for your consent.

11. Data protection representative and contact

Data controller: The-IK Tech Lab, CR No. 202447-1, Manama Municipality, Kingdom of Bahrain.

Data protection representative:

General support: help@byzatk.com