Privacy Policy

Two different things fall under this policy: (1) this public website, and (2) the DastApp product itself, which businesses ("tenants") register for and use to run their operations. Each tenant's own account holds two kinds of data — their account/billing information, which DastApp controls under this policy, and the business data they enter (employee records, payroll, sales, inventory, financial transactions), which belongs to that business. We process that business data only to provide the service to them, not for our own purposes.

• Contact form submissions: name, company name, email, phone number (optional), team size (optional), and your message.
• Account registration: your name, email, company name, and password (stored as a salted hash, never in plain text).
• Business data you enter: anything you or your team put into the system — employees, attendance, payroll, sales, purchases, inventory, clients, vendors, and financial records. This is your data; we don't use it for anything beyond operating the service for you.
• Billing information: if you're on a paid plan, subscription payments are processed by Stripe. We don't receive or store your full card number — Stripe handles that directly.
• Technical logs: standard server request logs (IP address, browser/device information, timestamps) kept for security and troubleshooting, and error/crash diagnostics captured automatically when something breaks in production.

• To create and operate your account and the workspace your team uses.
• To reply to messages sent through the contact form — a real person reads and answers these.
• To send transactional emails — account invites, password resets, notifications you've triggered (via our email provider, Resend). We don't send marketing email to a list built from account data.
• To process subscription payments for paid plans (via Stripe), where applicable.
• To diagnose and fix bugs when the application errors out in production.
• To keep the service secure — detecting abuse, rate-limiting, and preventing unauthorized access.

• We don't sell your data, or any tenant's business data, to anyone.
• We don't run advertising trackers or ad pixels, and we don't build a profile of you or follow you across other websites. We do count page visits — see "How we measure the website" below.
• We don't let one tenant see another tenant's data. Every account is isolated at the database level (row-level security enforced by the database itself, not just application code), so this holds even if there were a bug in the application layer.

We use Vercel Web Analytics on the public marketing pages to see whether they're actually reaching anyone — which pages get visited, which site referred the visit, and rough country and device type. It sets no cookies, is served from our own domain rather than a third-party ad network, and records visits in aggregate — there is no profile of you, and nothing that follows you to other websites. It runs only on the public pages; what you do inside your own account isn't sent to it.

DastApp doesn't use tracking or advertising cookies. When you log in, your session is kept in your browser's local storage (not a cookie) so you stay signed in between visits — this data never leaves your device except when your browser sends it back to our own API to authenticate your requests.

• All traffic to and from DastApp is encrypted in transit (HTTPS).
• Tenant data is isolated at the database level, with row-level security enforced on every query — not something the application layer has to remember to check.
• Access within a tenant account is role-based, and changes to records are recorded in an audit trail.
• Passwords are never stored in plain text. We use industry-standard hashing, and no one at DastApp can read your password.

No system is perfectly secure, and we don't claim otherwise — but these are real, load-bearing controls, not marketing language.

We keep account and business data for as long as your account is active. If you want your account or data deleted, email us at muhammadtabishkhanzada@gmail.com and we'll take care of it. Contact form submissions that don't turn into a customer relationship are kept only as long as needed to follow up.

You can ask us, at any time, to see what data we hold about you, correct it, export it, or delete it. Email muhammadtabishkhanzada@gmail.com and we'll respond directly — there's no automated request portal today, but every request reaches a real person.

DastApp is a business tool and isn't directed at, or knowingly used to collect data from, children.

If this policy changes in a meaningful way, we'll update the date at the top of this page. We won't narrow your rights over data we've already collected without telling you first.

Questions about this policy or your data — email muhammadtabishkhanzada@gmail.com.