Legal & Trust Center
One place for every policy, written to describe the product as it actually works today rather than how it might work later.
Version 1.0 · Professional review status
Effective 30 August 2026 · Last updated 30 August 2026. These documents describe how Business OS 365 works today. They are prepared for professional Malta/EU legal review and are not legal advice. Nothing here is certified, audited, regulator-approved or lawyer-approved. These documents are prepared for professional Malta/EU legal review before general availability, and several clauses are deliberately marked as reserved rather than guessed. No badges, certifications or audit claims appear anywhere on this site.
Email and password sign-in through Supabase Auth with required email verification, and no social sign-in. Access is by invitation during private preview. Traffic is served over HTTPS, database row-level security keeps a member inside their own company's records, and roles — owner, admin, manager, staff — govern what each person can reach. No certification or guarantee is claimed.
Server-side we hold profiles, companies, memberships and billing metadata. Your operational zone records are a separate matter entirely — they stay in your browser on your device.
Stripe processes payments, subscriptions and the customer portal. Card details are entered on Stripe surfaces and stay with Stripe; this product stores subscription metadata and provider identifiers only.
Business OS 365 Intelligence is deterministic and local. It reads records that already exist, sends nothing to an external AI provider, stores no conversations, and never acts on your behalf.
Inventory, Suppliers, Sales & Invoices, Expenses and Staff records live in your browser's local storage on the device in use — not in a server database. They are not synchronised across devices and are not backed up by us.
Three providers are involved today: Lovable, Supabase and Stripe. No analytics platform, marketing tool, CRM or external AI provider is used.
Only providers with active implementation evidence are listed.
Provider
Application hosting, build and delivery of the web application.
Requests served to the application, plus operational error diagnostics.
Provider
Authentication and the server-side database holding profiles, companies, memberships and billing metadata. Supabase Auth also sends account emails such as verification and password reset.
Email address, display name, company and membership records, billing metadata.
Provider
Payment processing, subscriptions and the customer billing portal where paid access applies.
Payment and card details entered on Stripe surfaces, subscription state.
Business OS 365 is operated by YK Digital Marketing in Malta.
Full operator and contact details — including registered address, company registration and VAT information where applicable — are to be finalised before publication.
Until a published contact address is finalised, legal, privacy and billing requests should be raised through the account or workspace channel you were invited with. A dedicated legal contact address will be published here before general availability.