LiteLab Studio Privacy Policy

11. Who we are

LiteLab Studio is operated by Chapter Two Trading FZE, a company registered in the United Arab Emirates ("we", "us", "our"). This policy explains how we collect, use, store, share, and protect personal information when LiteManage, LiteRegister or LiteVRM is used. If you are a visitor to a building that uses LiteVRM, section 8 explains how your visit is recorded.

22. What we collect and why

Your account. Your phone number (used to log in — this is your only credential, no password), and your name. You may add a recovery email.

Your business. Business name, category, hours, tax registration number if applicable, and staff records (name, mobile number, role — visible to you as the business owner to manage your team; staff cannot see each other's numbers).

Your customers. Names and mobile numbers you enter for your own customers, used to identify them in sales, appointments and reminders. Any private notes you add about a customer are visible only to you — not to your other staff, and not shown to the customer.

Appointments. Customer details and any note attached to a booking are visible to any staff member managing appointments, so colleagues can cover for each other.

Booking page (LiteManage). A LiteManage business can switch on a public booking page where anyone can ask it for an appointment or send it a question, without an account. What you enter there — your name, your mobile number, the service and preferred time you choose, and your message — goes to that business. The business decides how it is used and is responsible for it; we store and process it on the business's behalf, only to provide the service to that business, and never for our own marketing. Your name and number are saved as a customer of that business, which its staff can see like any other customer; your request or question is seen by the business's owners and supervisors. We send you nothing when you submit. If the business confirms your appointment, you may receive its usual appointment reminder on WhatsApp. To have your details corrected or deleted, contact the business; if you contact us instead, we will pass your request on to it.

Suppliers. Contact details and any private notes you add are visible only to you.

Payments. We never see or store card details. In LiteManage, payments are records you enter yourself — the amount, date and method — and no payment is processed. In LiteRegister, card payments from your customers are processed by Ziina, through the account you connect; we store only the connection status, a payment reference, and the amount and result of each transaction. Payments to us are processed by Stripe, or by Whop if you bought through Whop (see section 3).

Location. We briefly detect your country from your connection, only to suggest the right dial code when you enter a phone number. We do not store this.

Support messages. If you contact us on WhatsApp or email, we keep the conversation to help you and improve our service, for up to 12 months.

33. Sub-processors

We use the following third parties to operate LiteLab Studio's apps:

• Vercel — hosting and infrastructure; also used to detect your approximate country for phone number entry.
• Supabase — database and authentication. Supabase is ISO 27001 certified and SOC 2 Type II compliant, and offers Data Processing Agreements supporting GDPR compliance.
• Meta (WhatsApp Business) — delivery of login codes, appointment reminders, and support messages.
• MSG91 — backup SMS delivery for login codes, where available.
• Resend — delivery of account emails (password resets, invites).
• Stripe — payments to us: LiteManage subscriptions, the multi-branch admin add-on and LiteRegister token packs.
• Whop — sales of LiteManage through the Whop marketplace, if you buy there.
• Ziina — LiteRegister only: payments from a business's own customers, where the business has connected its own Ziina account.
• Google Analytics (Google LLC) — anonymous, aggregated visitor statistics for our public marketing websites only (litemanage.com and literegister.com). It is not loaded inside the LiteManage, LiteRegister or LiteVRM apps, or on a business's booking page, and never receives your account, business, or customer data.
• Browser push services (for example Google, Apple and Mozilla, depending on your device) — delivery of the notifications you switch on in the app. A notification carries a short line, such as an appointment's time, service and customer name, and the screen to open; never a phone number or an amount of money.

Cookies. The signed-in app uses only the cookies required to keep you logged in. Our public marketing websites additionally set Google Analytics cookies to measure anonymous visitor statistics as described above; these are not set inside the app.

44. Audit records

For security and accountability, LiteLab Studio keeps an internal log of changes made within your account. This log is accessible only to authorised LiteLab Studio personnel for support, security and fraud-prevention purposes, and is not visible to your staff or customers. Clearing or editing information in the app does not remove the earlier version from this internal log.

55. Data retention and deletion

We may deactivate accounts that have been inactive for a long time, after giving notice; you can also ask us to deactivate yours. Once an account is deactivated, you have 60 days to reactivate it by logging in or contacting support. During this window, all your data remains intact.

If the account is not reactivated within 60 days, it moves into a 30-day deletion window during which it can no longer be recovered by logging in. After 90 days in total:

• Personal and contact data is permanently deleted — your customers' names and numbers, appointments, reminders, staff records, private notes, suppliers, and your business profile, along with the login accounts used only for this business.
• Financial and transaction records are anonymized and kept for 7 years — the amounts, VAT figures and dates of your sales and expenses are retained to meet our legal, tax and accounting obligations, but every personal identifier is removed first (customer names and numbers, and staff, supplier and payment references), so the retained records cannot be tied back to an individual. After 7 years these anonymized records are permanently deleted.

Before deletion, you are responsible for exporting any records you need. We recommend doing this during the 60-day recovery window.

Support conversations are kept for up to 12 months. Internal audit records are retained separately for security and legal purposes, as described above.

66. International use

LiteManage has no country restriction and can be used from anywhere. Your data is stored on servers operated by our infrastructure providers; by using LiteManage, LiteRegister or LiteVRM, you consent to your data being processed in the country where those servers are located, which may not be the UAE. We apply the same protections to your data regardless of where it is processed.

77. Your rights

You can access, correct, or request deletion of your personal information at any time by contacting support or, where the app allows it, by editing it directly. If you are located somewhere with specific legal rights over your data, we will honour those rights on request. If you visited a building that uses LiteVRM, see section 8 for how to have your visitor records deleted.

88. LiteVRM — visitors to buildings

This section applies if you visit a building, office or residence that uses LiteVRM, our digital visitor register, and to the businesses that run it.

Who is responsible for your data. The building — the property owner, management company or other organisation that runs the register at reception — decides why and how visitors are recorded. It is the controller of your visitor data. We provide the LiteVRM software and store the data on its behalf, and only use it to provide the service to that building. Questions or requests about your visit are best sent to the building: each building shows its own privacy contact on its visitor notice, which you can read from the sign at reception or by asking the security staff.

What is recorded about a visit. Your name; the unit, company or person you are visiting; the reason for your visit; and the times you arrived and left. Depending on the building's rules, it may also record your mobile number, vehicle plate, visitor pass number, the type and number of your ID, whether your ID is being held at reception, and notes made by its staff. If a building corrects a record, the change and the reason for it are kept with the record. ID cards are never copied or photographed. ID numbers are stored encrypted. The full number is shown only to the building's security staff, on that visit's record, and to our support team when needed to support the building (each time recorded, as below); everywhere else only the ID type and last 4 characters are shown.

Watchlist. A building can keep its own watchlist — for example, people who are not allowed in — so its staff are warned at check-in. An entry holds a name, a mobile number or a one-way fingerprint of an ID number (with the ID type and last 4 characters — never the number itself), and a note. A warning never blocks entry on its own; the building's staff decide. Each entry must be reviewed by the building's supervisor once per visit-retention period; an entry that is not reviewed stops warning, and is deleted after two periods without a review.

Who can see it.

• The building's security staff (its supervisors and guards) — the visitor records of that building only.
• The building's management company, where one manages the building through LiteVRM — reports with ID numbers masked to the type and last 4 characters. Every time management looks at visitor records it is recorded, and the building's supervisors can see who looked, when, and what they searched for.
• Our support team — read-only, only when needed to support the building, and each time with a recorded reason. The building's supervisors can see the dates on which our support team viewed their records.
• The public notice page for each building shows only the building's name, its notice and privacy contact, and its retention periods — never anything about any visitor.

Visitor records are not shared with other buildings, and are not used for marketing.

How long it is kept. Each building sets its own periods, within limits we enforce:

• Visit records are kept for between 1 and 24 months (12 months unless the building chooses otherwise), then deleted, together with their corrections.
• ID numbers are deleted sooner — after at least 7 days and no later than the visit period (180 days unless the building chooses otherwise). The ID type and last 4 characters stay with the visit until the visit record itself is deleted.
• A record is kept past these periods only while the visitor is still recorded as inside the building, or while their ID is still being held at reception.
• Watchlist entries that a building has removed are deleted once they are older than the visit period.
• Records of who viewed visitor data (management and support access) are kept for 24 months.

Deletion runs automatically every night.

Deleting your details. You can ask the building to delete your visitor records. The building's supervisor erases them in place: your name is replaced with "Erased visitor", and your mobile number, pass number and ID details are removed; once everyone on a visit has been erased, the visit's own details (who was visited, the company, vehicle, notes) are cleared too. The number of visits stays in the building's counts. A record cannot be erased while you are still recorded as inside, or while your ID is being held at reception. An erasure is recorded with its date, who carried it out, the reason and the number of records — never your name or number. If you send a request to us instead, we will pass it to the building and help it respond.

Our internal change log. For LiteVRM, our internal record of changes notes only which record changed and when — not visitor names, mobile numbers or ID details.

Where it is stored. Visitor data is stored on the infrastructure described in section 6.

99. Contact

Questions about this policy: support@litelab.io, or WhatsApp +971 55 884 3288.