Who can see my customers' data?

It is a question almost nobody asks before choosing a business app, and that becomes urgent afterwards. The names, phone numbers and purchase history of your customers are the data of real people, who gave them to you — not to a software supplier they have never heard of.

What «in the cloud» means in practice

It means that data sits on a computer that is not yours, and that the app on the phone is a window onto it. That is not a flaw in itself: it is how almost everything works today, and it brings real advantages — you see it from several devices, you do not lose it if the phone drops.

But it changes the answer to the question in the title. When the data lives elsewhere, it can be seen by:

• the supplier, or rather the people who work there and have access to the systems for maintenance and support;
• their own suppliers in turn — whoever hosts the servers, whoever sends the emails, whoever does the analytics;
• anyone who gets in where they should not, the day something goes wrong;
• whoever buys the company, if one day it is sold, along with everything else.

None of those four is necessarily acting in bad faith. That is not the point: they are four possibilities that exist only because the data left your phone.

The question worth asking anyone

Before uploading your customer records anywhere, it is worth asking three things and expecting precise answers:

• where the data physically sits, and under which law;
• who else can read it, besides you;
• what happens if I stop: do I get it back? in what format? within how long?

If the first two answers are vague, the third will be vaguer still.

Your customers' data is your responsibility, not your supplier's. Even when it sits on their server.

That is not only a principle: in Europe, whoever collects their customers' data answers for it, and the supplier hosting it is one link in the chain, not a substitute.

What changes if it stays on the phone

If the data never leaves the device, the list above gets much shorter: it can be seen by the people holding the phone, and that is it. There is no server to breach because there is no server; no supplier who can read it because they do not have it; nothing that changes hands if a company is sold.

Yataio works this way. Customers, items and sales live in the phone's memory, are not sent to any server and do not pass through any artificial intelligence. There is no account to open — so there is no profile of you anywhere either.

The other side, said upfront and not later

There is a price, and it is only fair to know it before choosing: if the phone breaks or is lost, nobody can recover the data for you, because nobody else has a copy. It is exactly the same reason nobody else can read it.

So the backup is yours to make, and it needs making: Yataio makes a password-protected copy, on the phone or on your own cloud, and subscribers can have it made automatically at regular intervals. Keeping it on something other than the same phone is the whole point.

The detail of what stays where is in the guide; the backup is explained here. On working without a connection, I wrote here.