O-Biz privacy policy

Last updated 29 September 2026. O-Biz is an app for running a small business, made by OML LTD ("OML", "we").

In short

• Your business records - sales, invoices, customers, stock, payments, expenses, staff hours - are kept only on your phone or tablet, encrypted. OML does not receive them and cannot see them.
• OML receives only what it needs to activate your shop: an app number, a device key, the app version and your business name. Your Blink application never comes to OML: the app prepares it on your phone and you send it to Blink yourself, with your own WhatsApp or email.
• When you take a QR payment, the amount and a reference go to Blink (Emtel) to make the QR code and to confirm it was paid.
• If your business is on MRA e-invoicing, each invoice, sale and sales return goes from your phone to the Mauritius Revenue Authority, as the law requires.
• No advertising networks, no analytics, no location, no access to your contacts. We do not sell data.

1. What stays on your device

Everything you enter in O-Biz - products and prices, sales and receipts, invoices and quotations, the names and contact details of your customers and suppliers, payments, expenses, stock counts, staff hours and signatures - is stored in a database on the device itself. That database is encrypted (SQLCipher) with a key made on the device and kept in Android's protected key storage. It is not included in Android's automatic cloud backup.

Your PIN is stored only on the device, as a salted one-way hash. OML cannot read it, reset it or unlock the app.

2. What is sent to OML

To activate your shop, check which plan it is on and deliver its Blink and MRA settings, the app sends OML's server (obiz.omlcloud.com):

• the app number the app makes for itself (shown under Settings), and a public key for this device;
• the app version, so we can tell which update a shop is running;
• the business name you entered, so we know which shop is which.

The app also downloads, without sending anything about you, the current terms of use, the notice shown on the opening screen (OML's own news, never a third party's advertising) and the Free plan's limits. Like every web server, ours records the internet address a request came from, in logs kept for security.

Payment settings OML sends back are sealed so that only your device can open them.

3. Applying for Blink QR payments (only if you apply)

To take QR payments, Blink (Emtel Ltd) must check who the business is and who runs it - "know your customer" (KYC), which the law requires of every payment service. O-Biz helps you put the application together on your phone: the business details, the names of the directors or partners and of the person applying, and photographs or PDFs of your papers (ID card or passport, BRN, VAT certificate if registered, company papers, an authorisation letter where needed, and proof of the business bank account).

The app turns these into one file and opens your own WhatsApp or email, addressed to Blink, for you to send. The file goes from your phone to Blink directly. OML never receives it and keeps no copy. It carries this phone's app number, so Blink and OML can tell which phone it came from. Once Blink approves, Blink passes your QR payment details to OML, which sends them - sealed to this phone - so they switch on by themselves.

The photos stay on your phone, in O-Biz's encrypted storage, only until you confirm the application has been sent; they are then deleted. They are never included in a backup file. Blink keeps what you send it under its own KYC and privacy rules.

4. What is sent to Blink (Emtel) for QR payments

When you ask for a QR payment, the app sends Blink, the payment service run by Emtel Ltd, your shop's Blink merchant credentials, the amount, a reference for the request and a short purpose (such as the invoice number). It then asks Blink whether that request has been paid. Your customer pays in their own banking app; O-Biz never sees their card or bank details. Blink processes payments under its own terms and privacy policy.

5. MRA e-invoicing (only if your business uses it)

A VAT-registered business on the MRA's e-invoicing scheme must send each invoice to the Mauritius Revenue Authority as it is issued. If you switch this on, O-Biz sends every invoice, till sale and sales return (credit note) from your phone directly to the MRA's e-invoicing system: your business details, the date and time, the lines, prices, VAT and totals, and - when you name one - the customer's name, address, BRN and TAN. The MRA returns a reference number and QR code, which O-Biz prints on the document. OML does not receive these invoices.

Your MRA login is delivered by OML sealed to your phone, like the Blink settings, and is never in a backup. The record of what was sent to the MRA stays on your phone and in your backups, and cannot be deleted from the app while e-invoicing is on, because fiscal records must be kept.

6. The camera

The camera is used only when you tap Scan, to read barcodes and QR codes, or when you photograph your papers for a Blink application. Scanned codes are read on the device (by Google's ML Kit, on-device) and are neither stored nor sent anywhere; photographs of papers leave the phone only when you send your application yourself (section 3).

7. Fingerprint and face unlock

If you switch this on, Android checks your fingerprint or face and tells O-Biz only whether it matched. O-Biz never receives or stores biometric data.

8. Files you choose to share

Receipts, invoices, reports and backup files are made on the device and go only where you send them - WhatsApp, email, a printer, your own storage. A backup contains your business records (but never your Blink credentials or the device's keys), so keep it somewhere safe.

9. How long data is kept, and deleting it

Records on your device stay until you delete them or remove the app. OML keeps the activation record (app number, device key, business name, app versions, dates) while your shop uses O-Biz, and deletes it on request. OML holds nothing from a Blink application - it goes from your phone to Blink. How to delete your data.

10. Security

Everything O-Biz sends travels over HTTPS. Records on the device are encrypted; payment settings are sealed to the device; the app can lock itself with a PIN, fingerprint or face.

11. Children

O-Biz is a business tool for adults running a business. It is not meant for children.

12. Your rights

Under the Data Protection Act 2017 of Mauritius you may ask OML what it holds about you, and ask for it to be corrected or deleted. Contact us as below.

13. Changes

If what the app collects changes, this page will change first, with a new date at the top.

Contact

OML LTD, Mauritius · +230 5850 1920 - call during office hours, or WhatsApp at any time · www.omlcloud.com