Skip to Content
01Legal

Privacy policy

How the XproERP mobile app and this website handle personal data. In short: your business data stays between the phone and your own Odoo server. We receive only what licensing needs, and crash reports.

Last updated: 19 October 2026

Who we are

XproERP is developed by XSquare (Egypt). This policy covers the XproERP app for Android and iOS and the website xproerp.com. Contact: info@xssolu.com.

Your Odoo data

The app connects directly to the Odoo server of your organization. Everything you see or enter in it (contacts, orders, messages, attachments, calls) travels between your phone and that server. XSquare does not receive or store it. Your organization, or its hosting provider, runs that server and decides how that data is handled; ask your administrator about it.

What the app keeps on your phone

  • Your accounts: server address, database and login name, and the Odoo session.
  • Your password, only if you choose "Keep me signed in". It is kept in the phone's secure storage (Android Keystore, iOS Keychain).
  • A cache of menus, views and the records you opened recently, so they stay readable offline.
  • If you use the Point of Sale: the products, prices and customers (names and phone numbers) of the open session, and the orders until they reach your server.
  • Your settings (theme, language, menu style, pinned menus, receipt printer), a random installation identifier and your organization's license token.

"Remove from this device" in the app deletes an account with its session, saved password and offline data. Settings › Offline data clears the cache. Uninstalling the app deletes everything it stored.

What XSquare receives

  • License checks. Each installation asks our license service for a short-lived license. It sends your organization's activation id, the server address and database name, the installation identifier, a one-way hash of the Odoo login (to count users, we cannot read the login from it), the platform and the app version.
  • Trial and activation. When an Odoo administrator starts the free trial or activates a subscription, the app sends the email address that receives the verification code, the server address, the database name and the database's unique identifier.
  • Crash reports. If the app crashes, Firebase Crashlytics (Google) sends us a crash report: the error and where it happened in the app, the device model, the system and app versions, and a Firebase installation identifier. We use them only to fix bugs.
  • Push notifications. When they are available, the app asks for permission to show notifications and receives a Firebase Cloud Messaging identifier. Push notifications are not available yet, and the app does not send this identifier anywhere. We will update this policy before that changes.

The app has no advertising, no analytics and no tracking across apps or websites. We do not sell personal data.

Services the app talks to directly

  • Your Odoo server, for everything you do in the app.
  • OpenStreetMap tile servers, to draw map views (they see your IP address and the map area).
  • For voice and video calls: the other participants' devices (calls are peer to peer), and the connection servers your Odoo is set up with, or Google's public STUN servers if none are set.
  • Your Bluetooth receipt printer, if you pair one.

Permissions

The app asks only when you use the feature: camera (sign-in QR code, barcodes, photos), microphone (calls), photos (attachments), Bluetooth (receipt printer) and notifications. You can refuse or withdraw any of them in the phone's settings; the rest of the app keeps working.

This website

When you send the contact or request form, or subscribe to release notes, we keep what you entered in our own Odoo and use it only to answer you and manage your subscription. The website uses the cookies it needs to work (session, language, forms); it uses no analytics or advertising cookies.

How long we keep data

  • License and activation records: for as long as the subscription runs, and invoices as long as the law requires.
  • Trial records: kept so that a database or company gets one free trial only.
  • Verification codes expire after a short time. Crash reports are deleted by Firebase after 90 days.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct it or to delete it: write to info@xssolu.com. See Delete your data for how deletion works. Data on your organization's Odoo server is handled by your organization.

Children

XproERP is a business app for organizations that use Odoo. It is not meant for children.

Changes

We update this page when the app or our services change, and change the date at the top.