SarrafPro Privacy Policy
SarrafPro is bookkeeping software for currency-exchange and money-transfer shops. It is run by R&R Software Solutions, Erbil, Kurdistan Region, Iraq ("we"). This policy explains what information SarrafPro holds, why, who helps us process it, and the choices you have.
Last updated: 3 November 2026
Two kinds of information:
- The shop's books: accounts, clients, transactions, balances and the vault. These belong to the shop. We store and process them only so that the shop can use SarrafPro.
- The information we need to run the service: the accounts of the people who sign in, security records, and messages we send for the shop.
What we collect
- People who sign in (owners and staff):
- name, phone number and email address;
- role and permissions;
- a password, which we store only in a scrambled (hashed) form that cannot be read back.
When someone sets a password, we check it against a public list of leaked passwords. Only the first 5 characters of its hashed form are sent, never the password itself.
- The shop's records, entered by the shop:
- client and partner accounts (names, phone numbers, cities);
- currency exchanges, transfers, deposits, balances and the vault;
- notes, photos attached to transfers, and the shop's logo.
- Security records:
- sign-ins and sign-in attempts, with the IP address, device and browser;
- one-time sign-in codes;
- remembered devices;
- a log of who created, changed or cancelled each entry, and from which device.
- WhatsApp messages, when a shop uses them:
- the messages a shop's client exchanges with the shop's WhatsApp statement service, and the client's phone number;
- the statements and notices sent to them.
- Our public website:
- what you type into the trial request form;
- a bot check on that form;
- aggregate visit statistics. These do not identify you.
Why we use it
- To run SarrafPro for the shop: keeping its books, producing statements and reports, and sending the WhatsApp messages and emails the shop has switched on.
- To keep accounts safe: sign-in codes, detecting suspicious sign-ins, and the change log.
- To support the shop when it asks for help.
We do not sell any information. We do not use the shop's books or its clients' details for advertising. We do not show adverts inside SarrafPro.
Who helps us process it
| Provider | What for | Where |
|---|---|---|
| Our database and sign-in provider | Database, sign-in and file storage | Frankfurt, Germany (EU) |
| Our hosting provider | Hosting the website and producing PDF documents | Washington, D.C., United States (server functions and PDF documents); the web pages are served from a global network |
| Meta (WhatsApp Business) | Sending and receiving WhatsApp messages | Meta's data centres |
| Our email provider | Sending emails (reports, alerts) and receiving mail sent to support@sarrafpro.app | Tokyo, Japan |
| Our bot-check provider | The bot check on public forms | A global network |
| Our AI provider | The in-app AI assistant. It is switched off for every shop today; if we switch it on for a shop, the assistant's questions and answers pass through this provider | United States |
Each provider processes the information only to provide its service to us.
How the shop's data is protected
- Every shop's data is kept separate from every other shop's. A user can see only the shops they belong to.
- All traffic is encrypted (HTTPS).
- The owner decides what each staff member can see and do, and can set the hours when they may sign in.
- Every change to an entry is logged and cannot be deleted by anyone in the shop.
- Copies of the data:
- the live database;
- an automatic daily backup, kept for 7 days;
- with offline reading, a copy on each of the shop's devices, so its books can be read offline (the last 60 days plus anything not yet synced);
- a sealed backup file the owner can download at any time.
How long we keep it
- We keep the shop's information while its subscription is active.
- After a shop stops using SarrafPro, we keep its data for 90 days so it can return, then delete it. The daily backups are overwritten within a further 7 days.
- A shop's owner can choose how long the change history is kept.
Your choices and rights
- A shop owner can:
- download a full copy of the shop's data at any time;
- correct any record;
- ask us to delete the shop's account and data.
- A shop's client whose details a shop keeps should contact that shop first: the shop decides what it records. They can also contact us, and we will pass the request to the shop.
- WhatsApp: a client can stop the statement service by asking the shop. Shops decide which clients receive messages.
How to ask us to delete your data
Message us on WhatsApp at +964 751 953 0372, or email support@sarrafpro.app, from the phone number or email on the account. Say which shop it concerns. We confirm the request with the shop's owner, then delete the data within 14 days and tell you when it is done.
Children
SarrafPro is a business tool and is not meant for anyone under 18.
Changes to this policy
If we change this policy in a way that matters, we will tell shop owners inside SarrafPro before the change takes effect.
Contact
R&R Software Solutions, Erbil, Kurdistan Region, Iraq
WhatsApp: +964 751 953 0372
Email: support@sarrafpro.app