Privacy Policy

1. Introduction

Ecomenia ("we," "us," or "our") operates a B2B e-commerce SaaS platform for multi-tenant store management, product catalogs, order processing, team collaboration, and integrations with delivery and commerce services. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform.

2. Information We Collect

2.1 Personal and Account Information

• Account: First name, last name, display name, email address and verification status, optional phone number and verification status, and profile photo
• Location and timezone: Country, city/region, and timezone. We may fill these automatically from your IP address when the account is created; you can update them later
• Sign-in and security: Email one-time codes (OTP) as the primary sign-in method, passkeys if you enable them, Google sign-in if you choose it, and device sessions (including IP address, browser or device type, and approximate network location)
• Connected accounts: If you sign in or link Google, we receive the name, email, and photo Google provides under the permissions you grant

2.2 Billing and Payment Information

• Store-level billing: Subscriptions, credits, and payment orders are tied to the store you pay for, not only to your personal account
• Plans and credit packs: The plan or pack you select, quantity (for packs), the amount shown in DZD, and purchase type (prepaid subscription or credit pack)
• Credit balances: Welcome credits, subscription credits for the current period, and add-on (pack) credits, plus consumption and transaction history
• Offline payment orders: A payment reference we generate for you, the payment method chosen or agreed (for example Baridi Mob, bank transfer, or cash), the name and email linked to the order, and optional notes you add when requesting payment
• WhatsApp activation: Payment is currently arranged mainly via WhatsApp. You may send transfer proofs or screenshots in that chat — those messages are also subject to Meta’s terms, and we do not store card numbers on our platform

2.3 Technical Information

• Session and device: IP address, browser or device type, and approximate network location around sign-in or during a session
• Cookies and preferences: Sign-in session, interface language, timezone, and display preferences (for example table layout)
• Product analytics: Product and usage analytics (in environments where we enable them) to understand feature usage and improve the platform
• Error monitoring: Error monitoring to help diagnose crashes and reliability issues
• Operational logs: Operational and security logs as needed to run and protect the Service
• Browser caching: Your browser may cache some files to improve performance or offline use

2.4 Business and Merchant Operational Data

• Store data: Name, subdomain, optional custom domain, logo and branding, store email/phone/address, currency, locale, timezone, and shipping, inventory, and delivery settings
• Catalog and inventory: Products, variants, categories, prices, stock levels, and stock movements
• Orders and operations: Orders you manage (confirmation, delivery, tracking, amounts, notes, assignment), including cash-on-delivery (COD) orders
• Team and permissions: Invited members, roles and permissions, teams, and in-store activity logs
• Integrations: Data synced from platforms and services you connect (for example Shopify, WooCommerce, YouCan, Google Sheets, and Algerian delivery carriers), including credentials needed for those connections
• Files: Images and documents you upload to the platform (object storage)

2.5 End-Customer Data (Merchant Customers)

When you manage COD or other orders on Ecomenia, you may enter or sync your customers’ personal data, such as:

• Name and phone number (and often a second phone or email if provided)
• Delivery address, wilaya, and commune
• Order and tracking data when a parcel is submitted to a delivery company
• In-platform performance indicators linked to the customer (for example return rates or risk level) to help you operate

We process that data on your instructions to provide the Service. You remain responsible for lawful collection and for informing your customers. We act as a service provider / processor for that data unless applicable law says otherwise for a specific purpose. When you connect a delivery company, the shipping data needed for that shipment may be shared with that partner under the integration you enable.

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Delivery and Operations

• Running the store workspace (multi-store, settings, branding)
• Managing cash-on-delivery (COD) orders: confirmation, assignment, delivery status, tracking, and notes
• Managing catalog and inventory (including stock deduction and restock according to your settings)
• Team collaboration through roles, permissions, invitations, and activity logs
• Operating the integrations and APIs you enable (syncing orders/products and submitting shipments to delivery companies)
• Processing your end customers’ data only as needed to run these workflows for you

3.2 Billing and Credits

• Managing store subscriptions, credit packs, and offline payments (usually via WhatsApp)
• Operating credit balances (welcome, subscription, add-on) and pausing credit-consuming processing when the balance reaches zero
• Confirming payment and activating the plan or pack, and applying plan changes at renewal under our billing policies
• Keeping payment-order, accounting, and dispute records

3.3 Analytics, Reliability, and Improvement

• Showing in-product analytics to you (for example sales, confirmation, delivery, and inventory)
• Improving platform performance, usability, and reliability
• Product analytics and error monitoring through service providers (see §4)

3.4 Communications and Support

• Authentication messages such as email one-time codes (OTP)
• Account, billing, low-credit, and service notices (email and/or in-app notifications)
• Support, onboarding, and account management, including WhatsApp when you contact us that way
• Important notices about policies, security, or critical service issues
• We do not use your end customers’ phone numbers for our own marketing

3.5 Security and Account Integrity

• Securing sessions, rate-limiting requests, and bot checks on sensitive authentication endpoints
• Detecting and preventing abuse or unauthorized access
• Administrative actions such as suspension or ban when needed to protect the platform and users

4. Information Sharing and Disclosure

We do not sell your personal data. We share it only as described below.

4.1 Integrations You Connect

We share data with services you choose to connect, as needed to operate them:

• Commerce platforms: Shopify, WooCommerce, YouCan for product and order synchronization
• Spreadsheets: Google Sheets when you enable that connection
• Delivery companies: Such as Yalidine, Guepex, ZR Express, Maystro, Ecotrack, Colivraison, and others you enable for shipping and tracking
• Shared data may include product and order details, shipping fields needed to create a parcel, and credentials or tokens for the connection
• Data may flow both ways under the permissions you grant, and you control which integrations are enabled

4.2 Payments and Messaging Channels

• Offline payments: Staff may receive the payment reference, method, amount, and store/contact details via WhatsApp and/or email to complete activation
• WhatsApp messages are also subject to Meta’s terms and privacy practices
• Custom volume quotes usually start on WhatsApp
• Do not send OTP codes, secrets, or full card numbers in chat messages

4.3 Service Providers and Platform Tools

We use service providers to operate the Service. Depending on the feature, this may include providers for:

• Cloud hosting and file / object storage
• Transactional email (including verification codes)
• In-app and related product notifications
• Product and web analytics
• Error and reliability monitoring
• Authentication and security helpers — for example Google when you sign in with Google, connect Google Sheets, or when we use Google bot checks on sensitive authentication endpoints
• Caching, rate limiting, and CDN / edge security

Specific vendors may change over time. For an up-to-date list of current providers, contact privacy@ecomenia.com. These providers process data under our instructions and only for the purposes described.

4.4 Legal Requirements

We may disclose information when required by:

• Court orders, investigations, or requests from competent authorities
• Applicable regulatory compliance (including Algerian law where it applies)
• Protecting user safety and preventing fraud or abuse
• Business transfers (merger, acquisition, or sale), with appropriate protections continuing where required

4.5 Your Team Members

If you invite team members to your store, they can access store and order data according to the roles and permissions you grant. You are responsible for whom you invite and for their permissions.

5. Data Security

We apply technical and organizational measures appropriate to our Service. No method of transmission or storage is perfectly secure.

5.1 Technical Safeguards

• In transit: Access to the Service is over HTTPS where the platform is served publicly
• Secrets at rest: Integration credentials and similar secrets (for example connection tokens and carrier/commerce API secrets) are encrypted before storage
• API keys: Store API keys are not stored in reusable plaintext
• Authentication: Passwordless email OTP by default, with optional passkeys and Google sign-in, plus secure session cookies when served over HTTPS
• Sessions: Sensitive session actions may require a recently authenticated session
• Reliability monitoring: We use error monitoring to help diagnose crashes and reliability issues

5.2 Access and Abuse Controls

• Merchant access: Store roles and granular permissions limit what team members can see and do
• Admin access: Platform administration is limited to authorized admin accounts for support and operations
• Account controls: We may ban, suspend, or revoke sessions when needed to protect the platform and users
• Abuse prevention: Rate limiting, bot checks on sensitive authentication endpoints, and webhook signature verification where integrations support it

5.3 Continuity

• Hosting and database providers may offer backup or recovery features as part of our infrastructure
• We aim for continuity appropriate to our scale, but we do not guarantee zero data loss
• You remain responsible for exports and copies of business data that you need for your own records

6. Your Rights and Choices

6.1 Access and Control

• Account profile: View and update profile fields in Account settings (for example name, phone, location, timezone, and avatar). Your sign-in email is generally not self-editable in the product
• Store data exports: Where the dashboard offers it, export business data you manage (for example orders, products, and team members)
• Account closure and personal-data deletion: Close your account from Account settings, or request closure / deletion of personal account data via privacy@ecomenia.com, subject to legal and operational retention described in §8

6.2 Privacy and Access Controls

• In-app notifications: Adjust product notification preferences where that control is available in the product
• Team permissions: Store owners and authorized admins can control member roles and granular permissions
• Analytics: We do not currently provide a self-serve analytics or cookie preference center. You may contact privacy@ecomenia.com to request exclusion from non-essential analytics where that is feasible

6.3 Requests Under Applicable Law

Under applicable privacy laws, you may request (typically via privacy@ecomenia.com):

• Access to personal data we hold about you as a user of the Service
• Correction of inaccurate or incomplete account information
• Erasure of personal data, subject to legal retention
• Objection or restriction of certain processing, where the law provides that right
• A copy of personal data in a usable format, where legally required and technically feasible

These rights are request-based unless the product already offers a self-serve control (for example profile edits or store exports above). Regional frameworks such as GDPR or CCPA apply only to the extent those laws actually apply to our processing of your data.

For end-customer data you store on the platform (including COD and order customer details), requests from those individuals should generally be directed to you as the merchant. We will assist where legally required and technically feasible (for example certain commerce-platform webhook workflows). We do not provide a general merchant DSAR console for all customer channels.

7. International Data Transfers

Some of our infrastructure and service providers may process data outside Algeria (see §4).

• Connected third-party services you enable (commerce platforms, carriers, spreadsheets, messaging tools) may process data in their own regions under their policies
• Enabling an integration constitutes your instruction to share the data needed for that integration
• Provider processing is also governed by those providers’ terms and privacy practices

8. Data Retention

8.1 Retention Periods

• Account data: Retained while your account is active
• Business and order data: Retained according to business needs and legal requirements
• Billing, credit ledger, and payment proofs: Retained for accounting, tax, and dispute periods as required or reasonably necessary
• Log data: Retained for a limited period for security and diagnostics
• Infrastructure copies: Where our hosting or database provider retains operational copies or backups, those may be kept for a limited recovery window

8.2 Deletion Policies

• Account closure: After account closure, we delete or de-identify personal account data within a commercially reasonable period, unless longer retention is required
• Legal hold: Extended retention when required by legal obligations
• Business records: Retention according to applicable business-record requirements (including billing and credit history where needed)

9. Children's Privacy

Ecomenia is a business platform for merchants and their teams. It is not directed at children or personal consumer use by minors. You must be old enough under applicable law to enter a binding business relationship (typically 18 or the age of majority). We do not knowingly collect personal information from children. If you believe a minor has created an account, contact privacy@ecomenia.com and we will take appropriate steps.

10. Changes to This Privacy Policy

• We may update this Privacy Policy from time to time
• The last updated date at the top of this page will change when we publish revisions
• For material changes, we will provide a reasonable notice (for example in-product or by email) where required or appropriate
• The revised policy applies from the effective or last-updated date shown, subject to applicable law

11. Contact Information

This Privacy Policy is part of our Terms of Service and should be read in conjunction with our complete terms and conditions.