LiteRegister Privacy Policy

Operated by Chapter Two Trading FZE · United Arab Emirates

Last updated: October 6, 2026

1. Who we are

LiteRegister is operated by Chapter Two Trading FZE, a company registered in the United Arab Emirates ("we", "us", "our"). This policy explains how we collect, use, store, share, and protect personal information when LiteRegister, LiteManage or LiteVRM is used. If you are a visitor to a building that uses LiteVRM, section 8 explains how your visit is recorded.

2. What we collect and why

Your account. Your phone number (used to log in — this is your only credential, no password), and your name. You may add a recovery email.

Your business. Business name, category, hours, tax registration number if applicable, and staff records (name, mobile number, role — visible to you as the business owner to manage your team; staff cannot see each other's numbers).

Your customers. Names and mobile numbers you enter for your own customers, used to identify them in sales, appointments and reminders. Any private notes you add about a customer are visible only to you — not to your other staff, and not shown to the customer.

Appointments. Customer details and any note attached to a booking are visible to any staff member managing appointments, so colleagues can cover for each other.

Suppliers. Contact details and any private notes you add are visible only to you.

Payments. We never see or store your card details. Card and payment processing is handled entirely by Ziina, through the account you connect. We store only the connection status, a payment reference, and the amount and result of each transaction.

Location. We briefly detect your country from your connection, only to suggest the right dial code when you enter a phone number. We do not store this.

Support messages. If you contact us on WhatsApp or email, we keep the conversation to help you and improve our service, for up to 12 months.

3. Sub-processors

We use the following third parties to operate LiteRegister:

• Vercel — hosting and infrastructure; also used to detect your approximate country for phone number entry.
• Supabase — database and authentication. Supabase is ISO 27001 certified and SOC 2 Type II compliant, and offers Data Processing Agreements supporting GDPR compliance.
• Meta (WhatsApp Business) — delivery of login codes, appointment reminders, and support messages.
• MSG91 — backup SMS delivery for login codes, where available.
• Resend — delivery of account emails (password resets, invites).
• Stripe — payment processing for card payments, token purchases and LiteManage subscriptions.
• Ziina — payment processing for customers in the UAE, where a business has connected their own Ziina account.
• Google Analytics (Google LLC) — anonymous, aggregated visitor statistics for our public marketing website only (homepage, pricing, FAQ, About and Contact pages). It is not loaded inside the LiteRegister or LiteManage apps and never receives your account, business, or customer data.

Cookies. The signed-in app uses only the cookies required to keep you logged in. Our public marketing website additionally sets Google Analytics cookies to measure anonymous visitor statistics as described above; these are not set inside the app.

4. Audit records

For security and accountability, LiteRegister keeps an internal log of changes made within your account. This log is accessible only to authorised LiteRegister personnel for support, security and fraud-prevention purposes, and is not visible to your staff or customers. Clearing or editing information in the app does not remove the earlier version from this internal log.

5. Data retention and deletion

If your account is deactivated — after 120 days of inactivity, or at your request — you have 60 days to reactivate it by logging in or contacting support. During this window, all your data remains intact.

If the account is not reactivated within 60 days, it moves into a 30-day deletion window during which it can no longer be recovered by logging in. After 90 days in total:

• Personal and contact data is permanently deleted — your customers' names and numbers, appointments, reminders, staff records, private notes, suppliers, and your business profile, along with the login accounts used only for this business.
• Financial and transaction records are anonymized and kept for 7 years — the amounts, VAT figures and dates of your sales and expenses are retained to meet our legal, tax and accounting obligations, but every personal identifier is removed first (customer names and numbers, and staff, supplier and payment references), so the retained records cannot be tied back to an individual. After 7 years these anonymized records are permanently deleted.

Before deletion, you are responsible for exporting any records you need. We recommend doing this during the 60-day recovery window.

Support conversations are kept for up to 12 months. Internal audit records are retained separately for security and legal purposes, as described above.

6. International use

LiteManage has no country restriction and can be used from anywhere. Your data is stored on servers operated by our infrastructure providers; by using LiteRegister or LiteManage, you consent to your data being processed in the country where those servers are located, which may not be the UAE. We apply the same protections to your data regardless of where it is processed.

7. Your rights

You can access, correct, or request deletion of your personal information at any time by contacting support or, where the app allows it, by editing it directly. If you are located somewhere with specific legal rights over your data, we will honour those rights on request. If you visited a building that uses LiteVRM, see section 8 for how to have your visitor records deleted.

8. LiteVRM — visitors to buildings

This section applies if you visit a building, office or residence that uses LiteVRM, our digital visitor register, and to the businesses that run it.

Who is responsible for your data. The building — the property owner, management company or other organisation that runs the register at reception — decides why and how visitors are recorded. It is the controller of your visitor data. We provide the LiteVRM software and store the data on its behalf, and only use it to provide the service to that building. Questions or requests about your visit are best sent to the building: each building shows its own privacy contact on its visitor notice, which you can read from the sign at reception or by asking the security staff.

What is recorded about a visit. Your name; the unit, company or person you are visiting; the reason for your visit; and the times you arrived and left. Depending on the building's rules, it may also record your mobile number, vehicle plate, visitor pass number, the type and number of your ID, whether your ID is being held at reception, and notes made by its staff. If a building corrects a record, the change and the reason for it are kept with the record. ID cards are never copied or photographed. ID numbers are stored encrypted. The full number is shown only to the building's security staff, on that visit's record, and to our support team when needed to support the building (each time recorded, as below); everywhere else only the ID type and last 4 characters are shown.

Watchlist. A building can keep its own watchlist — for example, people who are not allowed in — so its staff are warned at check-in. An entry holds a name, a mobile number or a one-way fingerprint of an ID number (with the ID type and last 4 characters — never the number itself), and a note. A warning never blocks entry on its own; the building's staff decide. Each entry must be reviewed by the building's supervisor once per visit-retention period; an entry that is not reviewed stops warning, and is deleted after two periods without a review.

Who can see it.

• The building's security staff (its supervisors and guards) — the visitor records of that building only.
• The building's management company, where one manages the building through LiteVRM — reports with ID numbers masked to the type and last 4 characters. Every time management looks at visitor records it is recorded, and the building's supervisors can see who looked, when, and what they searched for.
• Our support team — read-only, only when needed to support the building, and each time with a recorded reason. The building's supervisors can see the dates on which our support team viewed their records.
• The public notice page for each building shows only the building's name, its notice and privacy contact, and its retention periods — never anything about any visitor.

Visitor records are not shared with other buildings, and are not used for marketing.

How long it is kept. Each building sets its own periods, within limits we enforce:

• Visit records are kept for between 1 and 24 months (12 months unless the building chooses otherwise), then deleted, together with their corrections.
• ID numbers are deleted sooner — after at least 7 days and no later than the visit period (180 days unless the building chooses otherwise). The ID type and last 4 characters stay with the visit until the visit record itself is deleted.
• A record is kept past these periods only while the visitor is still recorded as inside the building, or while their ID is still being held at reception.
• Watchlist entries that a building has removed are deleted once they are older than the visit period.
• Records of who viewed visitor data (management and support access) are kept for 24 months.

Deletion runs automatically every night.

Deleting your details. You can ask the building to delete your visitor records. The building's supervisor erases them in place: your name is replaced with "Erased visitor", and your mobile number, pass number and ID details are removed; once everyone on a visit has been erased, the visit's own details (who was visited, the company, vehicle, notes) are cleared too. The number of visits stays in the building's counts. A record cannot be erased while you are still recorded as inside, or while your ID is being held at reception. An erasure is recorded with its date, who carried it out, the reason and the number of records — never your name or number. If you send a request to us instead, we will pass it to the building and help it respond.

Our internal change log. For LiteVRM, our internal record of changes notes only which record changed and when — not visitor names, mobile numbers or ID details.

Where it is stored. Visitor data is stored on the infrastructure described in section 6.

9. Contact

Questions about this policy: support@literegister.com, or WhatsApp +971 55 884 3288.