Privacy Policy

1. Who we are

Эхлэл Холдинг ХХК (registration no. 6442323, Монгол улс, Улаанбаатар хот, Сүхбаатар дүүрэг, 1-р хороо, Алтай бьюлдинг, 3/302 тоот) operates Unicore ERP, a business management system used by companies to run their internal operations — human resources, finance, sales, and customer communication.

This policy explains what personal data Unicore ERP processes, why, and what rights you have. It covers both the staff who use the system and the customers who contact a business through it.

2. Data we collect from system users

• Account details — name, email address, phone number, job title, profile photo.
• Employment records — entered by the employer for HR purposes.
• Activity logs — actions taken in the system, with timestamps, for audit and security.
• Technical data — IP address, browser type, and session identifiers.

The employer is the controller of this data; we process it on their instruction as their service provider.

3. Mobile app — camera, microphone, location, files

The Unicore ERP mobile app asks for the following device permissions. Each one is requested only when you first use the feature that needs it, and you can decline or revoke it later in your device settings — the rest of the app keeps working.

Calls. Audio and video are carried over an encrypted connection by our self-hosted media server (LiveKit). We do not record calls. We keep only call metadata — who called whom, when, and how long — so the call history works.

We never sell this data, and we do not use camera, microphone or location data for advertising or any purpose other than the ones listed above.

4. Facebook and Instagram messaging

Businesses using Unicore ERP may connect their own Facebook Page or Instagram professional account so their staff can answer customer messages from inside the system instead of switching to Meta's own apps. This connection is made by the business itself, using Facebook Login, and can be removed by them at any time.

When you message a business that uses Unicore ERP, we receive and store:

This information is used only to let the business answer you. We do not use it for advertising, we do not sell it, we do not build profiles from it, and we do not share it with any other business on the platform. Each business can see only its own conversations.

Attachments you send are downloaded to our servers because Meta's media links expire. They are stored with the rest of the conversation and deleted on the same schedule.

If you delete a message in Messenger, Meta notifies us and we remove our copy of its content too.

5. How long we keep it

Conversations and messages are kept for 24 months after the last message, so businesses can refer back to what was agreed. After that they are deleted.

System user records are kept while the person works for the business, and for as long as Mongolian accounting and employment law requires afterwards.

You can ask for earlier deletion at any time — see section 7.

6. Who else sees your data

• The business you contacted — its authorised staff only.
• Meta Platforms — messages travel through Messenger and Instagram, governed by Meta's Privacy Policy.
• Our hosting provider — servers located in Mongolia, under contract and bound to confidentiality.

We do not sell personal data. We do not transfer it to advertisers or data brokers. We disclose data to state authorities only where Mongolian law obliges us to.

7. Security

All traffic runs over HTTPS. Access tokens are stored encrypted. Webhook requests from Meta are verified by cryptographic signature and rejected if they do not match. Staff access is limited by role, and every company's data is separated so one company cannot read another's.

8. Your rights

You may ask us to:

• tell you what data we hold about you;
• correct it if it is wrong;
• delete it — see the Data Deletion page;
• stop processing it for a particular purpose.

Write to info@ehlel.com. We answer within 30 days. If your request concerns a conversation with a specific business, we may need to pass it to that business, since they decide what happens to their customer records.

9. Cookies

We use only the cookies needed to keep you signed in and to protect forms against cross-site request forgery. We do not use advertising or cross-site tracking cookies.

10. Changes and contact

If we change this policy we will update the date at the top of the page. Material changes will be announced inside the system.