Privacy Policy

Operator and scope

The store is operated by [Owner entity name] in [Country]. Proposed effective date: [Effective date]. This draft describes current store features and needs owner and legal review before publication.

Information we process

Depending on how you use the store, we may process:

• Account details: name, email, phone number, sign-in details, language, and the account’s primary currency.
• Purchases: orders, products, quantities, delivery details you provide, and payment and fulfillment status.
• Wallet data: balance and the transaction ledger for top-ups, charges, and refunds.
• Bank transfers: uploaded transfer receipts, transfer or reference number, amount, currency, and the bank account associated with the receipt.
• Support and alerts: support tickets and messages, and phone numbers submitted for back-in-stock alerts.
• Cookies: HttpOnly `access_token` and `refresh_token` authentication cookies, and the `preferred_currency` cookie. Language is selected through routes such as `/ar` and `/en`; this policy does not describe a locale cookie.
• Browser push: if push notifications are launched in a later phase, we may process the device/push token needed to deliver them. This feature is not available in the current release.

How we use information

We use information to create accounts and sign users in, verify a phone when needed, price and process orders and deliver digital products, record wallet transactions, payments and refunds, respond to support requests, send service messages or requested availability alerts, protect accounts and detect misuse, and maintain operational and audit records.

Services and other parties

We share only what is needed with services used to perform a feature you request:

• Google Sign-In verifies a sign-in you choose; the browser sends Google credential data to the store for verification.
• PayPal processes a payment or wallet top-up when selected and may receive transaction data such as amount, currency, and an order or top-up reference.
• WhatsLay sends WhatsApp verification codes and service notifications when those channels are enabled; this may require your phone number and the necessary message content.
• Enabled digital fulfillment suppliers, including CaoShop, Item4Gamer, and Mega-Center, receive the product, quantity, and delivery fields required by that supplier to complete an order. We do not send a complete account profile merely to fulfill an order.
• Firebase may process push tokens and notification data if browser push is launched in a future phase; it is not enabled in the current release.

Analytics and advertising tools

The store owner can enable analytics and advertising tools in the store settings: Meta Pixel, Google Analytics and TikTok Pixel. When one is enabled it loads on the store pages and may collect usage, device and browser data (such as pages visited, interactions, advertising identifiers and that service’s own cookies) and send it to the company that operates the tool under its own policies.

[Owner to specify: which tools are actually enabled, their purposes, and the consent or opt-out method required in the country of operation.]

Retention and deletion

The current system does not define one general retention period. We retain information while needed to operate accounts, orders, support, financial records, and audits, subject to requirements the owner and law in [Country] establish.

You can request account deletion from your profile. The current deletion flow anonymizes identifying details on the customer record and removes social sign-in links and sessions. Order, transaction, wallet, and audit records may remain for records and reconciliation; account deletion does not mean every financial or operational record is erased.

Your choices and rights

You can review and update information made available in your profile and request account deletion there. You can also contact us to request a copy or correction of information or ask how it is processed. We may need to verify your identity, and may retain records needed for operations, reconciliation, or legal requirements.

Security

We use safeguards such as access controls, session checks, HTTPS and HttpOnly authentication cookies in production, and hashed password storage. No method of transmission or storage is completely secure. Contact us if you suspect unauthorized access to your account.

Children

The current code does not define a minimum age or parental-consent process. The owner and legal reviewer must set these rules for [Country] before approving this policy.

Changes and contact

We may update this policy when the service or requirements change. The effective date will be shown here: [Effective date]. For privacy questions or requests, contact [Owner entity name] at [Contact email] or [Contact phone].