ProBusiness privacy policy

1. Who we are

ProBusiness is provided by Mohaioo OÜ, a company registered in Estonia (registry code 17524492), Tartu mnt 67/1-13b, Kesklinna linnaosa, 10115 Tallinn, Harju maakond, Estonia. Mohaioo OÜ is the controller of the data of your account, sign-in, consent, the activity log and the operation of the service.

For the business records your company enters in ProBusiness (for example the names of its suppliers and staff), your company decides what is recorded: your company is the controller of those records, and Mohaioo OÜ processes them on its behalf, as its processor, to provide the service.

Contact for any privacy question or request: privacy@mohaioo.com.

2. The data we process

• Account: your name, your email address, the company you belong to, your role (owner or admin) and the screens, actions and sites your company gives you. The platform does not ask for a phone number for your account.
• Sign-in: a one-time link and a 6-digit code are emailed to you; we store them only as hashes, they work once and expire after 15 minutes. A signed-in session in the app stays open up to 90 days after its last use and at most one year after sign-in; in the back office, at most 30 days. Its renewal token is stored only as a hash.
• Business data your company records in the app and syncs with the platform: sites, suppliers (which can include a contact name and phone number), staff (names, payments, working days), products, recipes, purchase orders, sales, payments, stock and stock movements, and the photos and files attached to them.
• Sync: an identifier the app sends for each device and the time of its last sync, so that every device receives the changes of the others.
• Activity log: who did what and when (for example a change of access rights or a migration step), with the email address of the person who did it.
• AI: the AI apps you connect to your company’s data and the log of their requests, and, from the former ProBusiness AI, your consent record and the usage and cost of each past question, without the text (section 7).
• Move to the platform: a backup copy of your legacy database (section 6) and the records of the move (row counts, corrections of derived values).

Technical data: for each request our servers log the method, the path, the response code and the duration. They do not log your IP address, the query string, any header or any request content. Your IP address is used briefly in memory to limit repeated sign-in attempts and is not stored.

We do not use your data for advertising, we do not sell it and we do not track you across other apps or websites. This web page sets no cookies and loads nothing from other sites. The accountant portal only sets functional cookies: one keeps you signed in, and pb_locale remembers the language you chose; neither is used to track you.

3. Why we use it, and on what legal basis

• To provide ProBusiness to your company: accounts and sign-in, sync between devices, the back office we use to manage your company’s access, support, and the move from iCloud to the platform. Legal basis: the performance of our contract with your company (GDPR Art. 6(1)(b)).
• To keep the service safe and reliable: sign-in limits, the activity log and encrypted backups. Legal basis: our legitimate interest in protecting the service and your data (Art. 6(1)(f)).

Subscriptions are bought through the App Store: Apple handles the payment, and we never receive your card details.

4. Who processes data for us

We use these providers. Each one receives only what it needs for its task:

• Hetzner Online GmbH (Germany): our servers, database, file storage, backups and the backup vault are hosted in its data centres in Germany.
• Resend (United States): sends our emails (sign-in links and codes, invitations). It receives the recipient’s email address and the content of the email.
• Cloudflare: answers DNS queries for our domain names. Traffic to the app’s servers does not pass through Cloudflare.
• Google (Google Workspace): hosts our mailbox, so it receives the emails you send to privacy@mohaioo.com.

Apple provides the App Store, App Store payments and, before the move, iCloud; Apple handles that data under its own privacy policy.

Your company’s owner may invite an external accountant, who then gets read-only access to its sales, purchases, suppliers, stock and change history (never its staff or their pay); every view and export is logged, and the owner can revoke the access at any time.

We may disclose data when the law requires it. We do not share data with anyone else.

5. International transfers

Resend is based in the United States, so the data it receives leaves the European Economic Area. This transfer is covered by the Standard Contractual Clauses of the European Commission, included in its data processing agreement. Our servers and storage stay in Germany.

6. The move to the platform and its backup copy

When your company moves from iCloud to the ProBusiness platform, the owner’s device first uploads a backup copy of the company’s legacy database (business tables only), after the owner taps “Export my data”. Then the device uploads the data itself, and we compare both sides before the company switches.

The copy is stored in a separate private storage space in Germany, encrypted (AES-256) with a key derived from a secret that is not stored with the copies. Only our platform administrators can download it, and every download is logged.

We keep this copy until you ask us to delete it. A copy whose upload is never finished, or that fails our checks, is deleted automatically. If a move is cancelled, the data uploaded for it is deleted 30 days later.

7. AI

On devices that support it, the app can answer your questions with on-device AI (Apple Intelligence): it runs on your device, and nothing is sent to us.

The ProBusiness AI that earlier versions of the app offered through our servers has been retired: no question is sent to it any more. The questions, answers and tables it kept are deleted within 30 days of its retirement; the usage and cost of each past question are kept without the text, with your company’s records.

You can also connect an AI app of your choice, for example Claude or ChatGPT, to your company’s data: you sign in with your ProBusiness account and choose the company. That app then reads the data under your own account with its provider, whose terms and privacy policy apply to what it receives. The access is read-only and limited to the company, screens and sites you already have access to. The company’s owner can disconnect the app at any time, and every request it makes is logged (which tool, which kind of record, how many rows; never the rows themselves).

8. How long we keep data

• Account and business data: as long as your company uses ProBusiness. A record deleted in the app is marked as deleted on our servers so that every device removes it. When a company stops using ProBusiness, its data is deleted 90 days later, except what the law requires us to keep.
• Sign-in links and codes: valid for 15 minutes, single use. Sessions: app up to 90 days after last use (one year at most); back office 30 days at most.
• Questions, answers and tables of the former ProBusiness AI: deleted within 30 days of its retirement.
• Backup copy of the move: until you ask us to delete it (section 6). The corrections made during the move are kept with your company’s records.
• Database backups: encrypted, kept 30 days.
• Activity log: 1 year.

9. Security

• All traffic between the app, the back office and our servers is encrypted (HTTPS/TLS).
• Database backups are encrypted before they leave the server; the key that can read them is kept offline, not on our servers.
• Backup copies of the move are encrypted at rest (section 6).
• Sign-in codes, links and session tokens are stored only as hashes.
• The database is not reachable from the internet, and each person reads only what their company gives them access to.

10. Your rights

Under the GDPR you have the right to access your data, to correct it, to have it erased, to restrict its use, to receive it in a portable format, to object to its use, and to withdraw your consent at any time (this does not affect what was done before). The app can also export your company’s data as CSV files.

To use a right, write to privacy@mohaioo.com. We answer within one month. If your request concerns your company’s business records, we may involve your company’s owner, who manages them.

You can also complain to a data protection supervisory authority, for example in the country where you live or work, or in Estonia (Andmekaitse Inspektsioon, the Estonian Data Protection Inspectorate).

11. Children

ProBusiness is a tool for businesses. It is not directed to children under 16, and we do not knowingly collect their data.

12. Changes to this policy

When we change this policy, we publish the new version on this page and change the “Last updated” date. For significant changes, we also tell company owners by email and show a notice in the app.

13. Contact

Mohaioo OÜ, Estonia. Email: privacy@mohaioo.com.