Legal & Trust Center
One place for every policy, written to describe the product as it actually works today rather than how it might work later.
Version 1.0 · Professional review status
Effective 30 August 2026 · Last updated 30 August 2026. These documents describe how Business OS 365 works today. They are prepared for professional Malta/EU legal review and are not legal advice. Nothing here is certified, audited, regulator-approved or lawyer-approved. These documents remain prepared for professional Malta/EU legal review, and several clauses are deliberately marked as reserved rather than guessed. No badges, certifications or audit claims appear anywhere on this site.
Email and password sign-in through Supabase Auth with required email verification, and no social sign-in. Workspace access is invitation-based. Traffic is served over HTTPS, database row-level security keeps a member inside their own company's records, and roles — owner, admin, manager, staff — govern what each person can reach. No certification or guarantee is claimed.
Server-side we hold profiles, companies, memberships and billing metadata. Your operational zone records are a separate matter entirely — they stay in your browser on your device.
Stripe processes payments, subscriptions and the customer portal. Card details are entered on Stripe surfaces and stay with Stripe; this product stores subscription metadata and provider identifiers only.
Business OS 365 Intelligence is deterministic and local. It reads records that already exist, sends nothing to an external AI provider, stores no conversations, and never acts on your behalf.
Inventory, Suppliers, Sales & Invoices, Expenses and Staff records live in your browser's local storage on the device in use — not in a server database. They are not synchronised across devices and are not backed up by us.
Three providers are involved today: Lovable, Supabase and Stripe. No analytics platform, marketing tool, CRM or external AI provider is used.
Only providers with active implementation evidence are listed.
Provider
Application hosting, build and delivery of the web application.
Requests served to the application, plus operational error diagnostics.
Provider
Authentication and the server-side database holding profiles, companies, memberships and billing metadata. Supabase Auth also sends account emails such as verification and password reset.
Email address, display name, company and membership records, billing metadata.
Provider
Payment processing, subscriptions and the customer billing portal where paid access applies.
Payment and card details entered on Stripe surfaces, subscription state.
Provider
Sending application emails, including private demo request notifications and demo approval or decline messages.
Recipient name and email address, and the demo request details included in the message.
Business OS 365 is operated by Abdulfattah Youssif Kabayare, trading as YK Digital Marketing, a self-employed (sole trader) business in Malta.
Business address: San Albert, Gzira, Malta. VAT number: 3287-2911.
Legal, privacy and billing requests can be raised by email at yousefkabayre@gmail.com or by telephone at +356 7956 6697.