Privacy policy

1. Who is responsible for your data

• For shop owners, their team members and visitors of mahallat.io, Mahallat decides how the data is used and is responsible for it.
• For the customers of a shop (people who order from a store built on Mahallat), the shop is responsible for their data. Mahallat processes it on the shop's behalf and only to run the store and the services the shop asked for. If you are a customer of a shop, contact the shop first; we will help it answer you.

2. The data we collect

From shop owners and their team:

• Account data: name, phone number, email address, password (stored only as a secure hash) and login codes.
• Business data: shop name, address, logo, products, prices, stock, settings, team members and their roles.
• Billing data: your plan, invoices, payments and the payment proofs you send us (for example a Whish receipt or a transfer reference). We never store card numbers.
• Support conversations on WhatsApp or email, and the information you send us so that we can build your store (for example your Instagram account and photos).
• Technical data: device and browser type, IP address, login times, and, if you allow notifications, a push subscription for your device.

From customers of shops, on behalf of the shop:

• Name, phone number, email address if given, delivery address with the landmark and the map pin you choose, and order notes.
• What you ordered, prices, discounts, the payment method, payment proofs you upload (for example a Whish screenshot), delivery status and your order history with that shop.
• Your choice about marketing emails, which a shop may send only if you opt in.
• Reviews you write, and your account with that shop if you create one.

From visitors of mahallat.io and of stores:

• Analytics events: the page viewed, the referring site, campaign tags (utm), the language and the buttons tapped. On mahallat.io these are counted without cookies and without identifying you. On stores they feed the shop's own analytics (visits, products viewed, carts and checkouts).
• What you send through the contact form of mahallat.io: name, phone, business, Instagram account and message.

3. Cookies and pixels

• Essential cookies keep you logged in, keep your cart and protect the checkout. They are needed for the service to work.
• mahallat.io uses the Meta Pixel to measure the results of our ads on Facebook and Instagram (for example a visit or a tap on a WhatsApp button). Meta receives technical data about your visit under its own privacy policy.
• A shop can turn on advertising pixels on its store (Meta, Google, TikTok). They are set by those companies and under the responsibility of the shop. A shop must tell its customers about them and ask for consent where the law requires it.

4. How we use the data

• To provide the service: show stores, take and manage orders, record in-store sales, keep stock, show analytics, send order emails to customers and send alerts to shop owners.
• To bill subscriptions and to keep accounting records.
• To help you: support, setting up your store, and answering requests.
• To keep the service safe: preventing fraud, spam and abuse, rate limiting, and investigating errors.
• To improve Mahallat, using statistics that do not identify customers.
• To tell shop owners about Mahallat news and offers. You can ask us to stop at any time.

We do not sell personal data, and we never use a shop's customer list for our own marketing or give it to another shop.

We use data because it is necessary for the contract with you, because we have a legitimate interest (security, improving the service), because the law requires it, or because you consented (marketing messages, optional pixels). You can withdraw consent at any time.

5. Email, notifications and WhatsApp

Order updates (confirmation, payment, shipping, delivery and a review request) are sent by email to the address given at checkout. Shop owners and their team receive push notifications and emails about new orders and events they must act on.

Mahallat does not send WhatsApp messages. When a shop messages you on WhatsApp, for example to confirm your order, the shop sends it from its own WhatsApp account; Mahallat only prepares the text for the shop. WhatsApp's own terms and privacy policy apply to that conversation.

Marketing emails from a shop are sent only to customers who opted in, and every marketing email has an unsubscribe link. You can also ask the shop, or us, to stop them. Mahallat does not send messages to people who never contacted us or a shop.

6. Who we share data with

• The shop you order from, which sees your order and contact details.
• Service providers that run parts of the service for us and may only use the data for that: cloud hosting and database providers, an email delivery provider, the push notification services of browsers and phones (for alerts to shop owners), and map services for addresses.
• Authorities, when the law requires it and only what it requires.
• A buyer of our business, if Mahallat is sold or merged, under the same commitments as this policy.

Some of these providers are outside Lebanon. When data leaves Lebanon we use providers that protect it at least as this policy does.

7. How long we keep data

• Account and store data: while the account is open, then 30 days to let you export it, then deleted.
• Order data of a shop's customers: as long as the shop keeps its store, or until the shop deletes it or the customer's deletion is requested.
• Billing records: as long as accounting and tax law requires.
• Contact form submissions: up to 24 months.
• Analytics events: up to 25 months, then only totals remain.
• Security logs: up to 12 months.

8. Security

Data travels encrypted (HTTPS). Each store's data is separated by access rules in the database, passwords are hashed, payment proofs are stored privately, and our team accesses data only to support you or to keep the service running. No system is perfectly secure; if a breach affects your data, we tell you and the authorities as the law requires.

9. Your rights

You can ask to see the data we hold about you, to correct it, to receive a copy, to delete it, or to object to a use of it. Shop owners can do most of this themselves in the dashboard. Customers of a shop should write to the shop; if the shop does not answer, write to us. We answer within 30 days.

10. How to delete your data

Send a message to WhatsApp +961 76 305 783 or email hello@mahallat.io with the words "Delete my data", the phone number or email you used, and, if you are a customer, the name of the shop. We confirm your identity, delete your data within 30 days (or ask the shop to, when it is responsible for it) and confirm when it is done. Shop owners can also close their account from the dashboard.

This also covers data received through Facebook, Instagram or WhatsApp: deleting it removes it from Mahallat.

11. Children

Mahallat accounts are for adults running a business. We do not knowingly collect data from children under 13. If you believe a child sent us data, contact us and we will delete it.

12. Changes to this policy

We update this policy when our practices change. The date at the top shows the latest version, and we tell shop owners about important changes before they apply.

13. Contact

Mahallat, Lebanon. For any question about your data: WhatsApp +961 76 305 783 or email hello@mahallat.io.