Privacy Policy

Website: www.appharu.com

AppHaru respects the privacy of website visitors, prospective clients and the individuals whose information is handled in connection with our professional services. This Privacy Policy explains the personal information we collect, how we use and disclose it, where it may be processed, how long it may be kept and how to contact us about it.

1. Who We Are and Which Company Is Responsible

www.appharu.com is operated by App Haru Private Limited, a company registered in Nepal (company registration number 178748; VAT number 606844422), with its business address at Kathmandu Metropolitan City, Ward No. 31, Kathmandu, Nepal. App Haru Private Limited is responsible for personal information collected directly through the corporate website, subject to applicable law.

APPHARU PTE. LTD. is a separately registered company in Singapore (UEN 202318601G), with its registered office at 77 High Street, #10-12B, High Street Plaza, Singapore 179433. It separately manages personal information associated with international client engagements for which it is the contracting entity.

The contracting company for a particular project is identified in the applicable quotation, agreement or invoice. The two companies may coordinate authorised project-related processing and sharing where necessary, subject to their written data-sharing and processing arrangements and applicable legal requirements. They should not be understood as a single legal entity.

2. Scope of This Policy

This Policy covers use of our corporate website, enquiries submitted through its contact form, pre-contractual communications, and personal information in our own client, billing, technical and business records. Where AppHaru processes data solely on behalf of a client while delivering a software, hosting or other project, the applicable client agreement and data-processing terms may also govern that processing.

Third-party websites, separately operated products and client-owned services may have their own privacy notices. This Policy does not automatically govern data collected by an independent client website or application.

3. Personal Information We Collect

3.1 Information you provide directly

Depending on how you interact with the website, you may provide the following information:

• Contact form: full name, telephone number, email address and a message or project requirements.
• Request Info form: full name, email address, telephone number, the type of query and a message.
• Job applications (Careers): full name, email address, telephone number, a CV or résumé file you upload, and the vacancy you applied for. The general application form also asks for your city, education, work experience, skills, expected salary or stipend, availability, optional profile links and your answers to a few questions about your work and interest in AppHaru.
• Get in touch box (website footer): your email address.
• Live chat: any name, email address and messages you choose to share in the chat window.

Please avoid entering unnecessary sensitive personal information, passwords or payment-card credentials into message fields, chat messages or uploaded files.

3.2 Enquiry, client and project records

When you contact us or engage our services, we may maintain related correspondence, project requirements, quotations, proposals, service agreements, contact details, project decisions and other information that you provide as part of the working relationship.

3.3 Billing and accounting records

Depending on the transaction, the relevant AppHaru entity may keep client or business names, billing contacts and addresses where required, invoice numbers, dates, service descriptions, amounts, currencies, payment status, payment dates, transaction references, confirmations and related accounting records.

3.4 Technical, security and analytics data

When you access the website, our hosting, security, content delivery and analytics systems may process technical information such as IP addresses, browser and device details, requested URLs, request dates and times, approximate location derived from network information, error events, security signals, and website usage data. Some information may be collected through cookies or similar technologies.

4. How We Use Personal Information

We process personal information as relevant to the particular interaction for the following purposes:

• Responding to enquiries and communicating with prospective and existing clients.
• Understanding requested services, project requirements and feasibility.
• Preparing proposals, quotations, contracts and pre-contract discussions.
• Following up on projects and delivering agreed services.
• Preparing invoices, receiving and reconciling payments, keeping accounts and fulfilling record-keeping duties.
• Operating, troubleshooting, measuring and securing the website and supporting infrastructure.
• Managing backups, continuity and recovery of legitimate business records.
• Responding to rights requests, security incidents and legal or regulatory requirements.

We use consent where required by applicable law. Depending on the circumstances and governing law, other permitted grounds may include pre-contractual steps, contract performance, compliance with legal obligations or legitimate business purposes recognised by law.

5. Website Forms, Email Handling and Internal Access

Submissions from the Contact form and the Request Info form are sent by email to our business mailbox, info@appharu.com, which is hosted using Zoho Mail. These messages are sent through Zoho Mail email servers. The Get in touch box in the website footer works the same way: your email address is sent to info@appharu.com so that our team can reply. These submissions are not stored in our website database.

Applications sent through the application form on the Careers page, including the attached CV, are sent by email to our business mailbox and are not stored in the website database. Applications received earlier through individual job listings may remain in our website database, with their CV files in Vercel Blob file storage. Access to those applications through our website administration dashboard requires an authorised staff login.

The Owner/Director has direct access to the central mailbox. Where needed to assess or carry out a client project, the Owner/Director may forward relevant information to authorised internal personnel of the Nepal or Singapore company. Such sharing is limited to legitimate project and operational needs.

AppHaru does not operate a newsletter. Contact form, Request Info, Get in touch and job application details are not used to add anyone to an email update or marketing list.

6. Service Providers and Other Disclosures

We may disclose or make information available where reasonably necessary to authorised internal staff, the contracting AppHaru entity, technology and infrastructure providers, banking or payment providers, accountants where engaged, and legal or regulatory authorities where required or permitted by law.

Relevant providers include Vercel (website hosting, and Blob storage for CV files uploaded with earlier job-listing applications), DigitalOcean (Spaces document storage), Zoho Mail (business email), Google (Google Analytics for website measurement), our website database hosting provider (earlier job-listing applications), Crisp (live chat), Zoho Invoice and other accounting tools where used, and Cloudflare (content delivery, reverse proxy and website security). Excel files and PDF documents are also used in financial administration. The specific processing undertaken depends on the tools and configurations in use.

We do not provide customer personal information to external freelance contractors for project work under our current operating arrangements. This does not mean that infrastructure, email, analytics, banking and other contracted service providers never process information when delivering their services.

Information may also be disclosed to investigate security incidents, establish or defend legal claims, meet lawful requests, or protect rights and safety where permitted by applicable law.

7. International Storage, Backups and Transfers

7.1 Website hosting and primary financial storage

Our corporate website is hosted on Vercel, with Cloudflare in front for content delivery and security. Website requests may be processed on Vercel infrastructure outside Nepal and Singapore, including in the United States. We use DigitalOcean Spaces in Singapore (SGP1) for primary cloud storage of relevant financial and business documents. Those documents may also be maintained on company computers.

7.2 Nepal company financial backups

App Haru Private Limited maintains a separate backup or replication arrangement in Nepal for its own financial documents. The backup service is outside DigitalOcean. Backup records are private and accessible to the Owner/Director and authorised internal Technical or Accounting Team members.

7.3 Singapore company financial backups

APPHARU PTE. LTD. maintains a separate financial-document cloud or backup storage arrangement located in Singapore. The designated Nepal company financial backup does not include the Singapore company’s financial records.

7.4 Cross-border processing

Information relating to Nepal business activity may be processed or maintained on infrastructure located in Singapore and, where applicable, copied to Nepal-based backup storage. Information may also be shared between the two AppHaru entities when needed for authorised projects. Technology providers may process service-related data in jurisdictions beyond the designated storage regions. Applicable cross-border transfer and protection obligations are addressed according to the relevant entity, processing activity and law.

8. Invoices, Payments and Financial Information

Either App Haru Private Limited or APPHARU PTE. LTD. may issue an invoice in its own legal name depending on the client, project and contractual arrangements. Payment is received in the business bank account of the company that issued the invoice. Clients follow the payment instructions provided in their invoice or agreed business communications.

Payments may be made through bank transfer, direct deposit or applicable business collection accounts and payment arrangements. We do not identify a single collection-wallet provider because accepted business payment arrangements may vary.

Our corporate website does not currently provide an online card-payment checkout. We do not request card numbers or CVV codes through such a checkout. Banks, collection-account services and other payment providers may process payment information under their own applicable privacy terms and regulatory obligations.

Financial information and records may be prepared, managed or stored using Zoho Invoice, Excel spreadsheets, PDFs, other accounting software, DigitalOcean Spaces, company computers and the relevant backup storage arrangements.

9. Information Security and Incident Response

We use technical and organisational safeguards appropriate to our operations to protect information against unauthorised access, misuse, alteration or loss. Our website and contact form use HTTPS. Two-factor or multi-factor authentication is enabled for the Zoho Mail and DigitalOcean accounts. Financial documents stored in primary DigitalOcean Spaces are private, with direct file access restricted to the Owner/Director.

Backup environments have separate access arrangements. We review those environments and additional security improvements, including encryption and authentication controls, as part of our security management.

No electronic transmission or storage method can be guaranteed completely secure. AppHaru has a written security incident response procedure. The Owner/Director leads its response, supported by the relevant technical personnel for investigation, containment and remediation. Notifications to affected individuals or authorities are made when required by applicable law.

10. Retention and Deletion

We keep enquiry emails and associated correspondence for as long as reasonably necessary for enquiries, project communications, follow-up and relevant business or legal obligations. No universal fixed retention period has been adopted for all enquiries.

Job applications and uploaded CV files are kept for as long as reasonably necessary for recruitment and related legal obligations.

AppHaru-controlled website server access and error logs are ordinarily retained for seven (7) days, according to our stated configuration. Retention by Cloudflare, Zoho, Google or other service providers may differ and is governed by their configurations and arrangements.

Website server snapshots and backups are performed manually, rather than as an assumed continuous automatic backup process. Financial and accounting records may need to be kept for longer periods required for accounting, taxation, financial reporting, legal claims or regulation.

Nepal company external financial backup records are kept according to business and legal needs without a single fixed retention period. Singapore financial backup retention depends on its separate arrangements. Deletion from active systems, backups and replicas may not occur at the same time, and recovery capabilities differ between backup and replication services. We review deletion requests subject to legitimate retention duties and relevant technical capabilities.

11. Cookies, Cloudflare, Google Analytics and Live Chat

With your consent, our website uses Google Analytics to understand website traffic and usage. Analytics technologies may process device, browser, interaction and similar usage information and may use cookies or related technologies, subject to the actual website settings.

Cloudflare supports website delivery and security, including an active Web Application Firewall (WAF) and security rules. Cloudflare may process network addresses, request details, security events and necessary security-related identifiers or cookies as part of protecting and delivering the site.

With your consent, our website uses Crisp to provide a live chat window. Crisp may use cookies or similar technologies to keep your chat session and process the messages you send, under its own privacy terms. Our website administration area also uses a necessary login cookie for authorised staff.

When you first visit our website, a cookie banner lets you choose "Accept all", "Reject non-essential" or "Cookie settings". Google Analytics and Crisp live chat are only loaded if you allow them. Necessary cookies, such as those used for security and to remember your choice, are always on. Our Gallery page can show posts and photos from our Facebook page, but only after you click "Show photos"; Facebook may then set its own cookies under its privacy policy. You can change your choice at any time using "Cookie settings" in the website footer, and you can also manage or delete cookies through your browser settings.

12. No Sale of Personal Information and No Newsletter

AppHaru does not sell customer personal information or share it with unrelated third parties for those third parties’ own marketing purposes. Our use of Google Analytics and necessary infrastructure providers is described separately in this Policy and is not intended to be concealed by this statement.

If you leave your email address in the Get in touch box, we use it only to reply to you. You can ask us to delete it at any time by writing to info@appharu.com.

13. Your Privacy Rights and Requests

Depending on the laws that apply to you and to the relevant AppHaru entity, you may be entitled to request access to personal information, correction of inaccurate details, withdrawal of consent where applicable, deletion where available under law, or information about how your data has been used or disclosed. Not all rights apply in every jurisdiction or circumstance.

Send requests to info@appharu.com. The Owner/Director oversees receipt and review of such requests and may require reasonable identity verification before releasing or changing personal information. We aim to acknowledge an initial request within seven (7) business days. This is an acknowledgement target, not a guarantee that every request will be fully resolved within seven business days. Applicable statutory deadlines take precedence.

We assess each request with regard to the responsible contracting company, legal requirements, third-party processing, security and applicable accounting or retention obligations. Where applicable, individuals may also contact the relevant data protection authority.

14. Children’s Privacy

Our website and professional services are directed primarily to adults, professionals and business organisations. We do not specifically target individuals under 18 years of age or knowingly solicit or collect their personal information through our website contact form.

If we learn that a child has provided personal information without appropriate authorisation, we will review the circumstances and take appropriate action, which may include deletion where required or appropriate under applicable law. Parents or legal guardians may contact info@appharu.com with relevant concerns.

15. Singapore Data Protection Officer

APPHARU PTE. LTD. has appointed its Owner/Director as its Data Protection Officer (DPO) for Singapore privacy matters. The DPO can be contacted at info@appharu.com. The appointment does not transfer responsibility for information collected through the Nepal-operated website from App Haru Private Limited to the Singapore company.

16. External Links and Other Websites

Our website may link to external resources and independent third-party sites. Their handling of information is governed by their own privacy practices, which we encourage visitors to review. We are not responsible for the privacy practices of websites that we do not operate, except to the extent required by applicable law.

17. Client Confidentiality

In addition to the protections described in this Policy, the following commitments apply to confidential information about our clients:

• AppHaru will not reveal confidential information about a client's business or affairs to third parties, except to suppliers who have signed appropriate confidentiality agreements, or where the client has given specific permission.
• AppHaru may provide client information to legal or government authorities where required, through authorised and lawful procedures.

18. Client Projects, Intellectual Property and Governing Law

18.1 Agreements

• An agreement is made between AppHaru and the other party before a project begins.
• Agreements may be made with another company, an organisation or an individual.
• Projects are carried out according to the terms and conditions agreed between AppHaru and the other party or parties.

18.2 Service delivery

• Project deliverables are provided as an electronic copy (e-copy) or hard copy, according to the client's preference.
• Communication may take place by email and other online channels as needed.
• Clients are responsible for settling all outstanding dues before receiving the final deliverables.

18.3 Intellectual property

• AppHaru will not engage in any action that could harm a client's intellectual property or the client's rights to it.
• AppHaru is not responsible for any violation of intellectual property rights, or theft, connected to documents, information or data provided by the client, during or after the project.

18.4 Governing law

• The relationship between AppHaru and a client is based on the agreed terms and conditions.
• In the event of a disagreement or uncertainty, the agreement will be governed by and interpreted in accordance with the laws of Nepal, unless the applicable agreement with the contracting AppHaru entity states otherwise.
• Clients should read, understand and agree to these terms before engaging in any project or service offered by AppHaru.

19. Changes to This Privacy Policy

We may update this Policy to reflect changes to services, technology, legal requirements or information practices. Updated versions will be published on www.appharu.com, and the “Last Updated” date will be revised to the actual date of publication. For significant changes to the handling of personal information, we will provide an appropriate website notice. Where additional consent or notice is required by law, we will take the required steps.

20. How to Contact Us

For website privacy enquiries, personal information requests or concerns about this Policy, use the following contact details: