Privacy Policy

Visitors to our website

• Your language choice, kept in a cookie for one year, and your light or dark theme choice, kept in your browser.
• If you arrive through a link that carries a referral code (?ref=…), the code is kept in your browser for 30 days and added to our sign-up links, so we can credit whoever referred you. We count the visit as an anonymous total for that code; we do not record who you are.
• Technical logs (IP address, browser type, pages requested, time) kept by our hosting provider to run and secure the website.

We do not use advertising cookies, analytics trackers or social media pixels on our website.

Merchants and team members

• Account details: your name, email address and password (kept only as a hash by our sign-in provider), a profile picture if you add one, and passkeys if you set them up (we keep only their public part).
• Store details: store name and address, logo, country, currency, language, products, pages, images and settings.
• Team: the names, email addresses and roles of the people you invite.
• Subscription and payment records: plan, amount, method (card through our payment provider, or cash declared to us), coupon used, dates and status. You enter card details on the payment provider’s page; we do not see or store them.
• Integrations you connect: delivery-company keys, advertising pixel IDs and access tokens, messaging-notification credentials, webhook addresses, and your own AI API key (kept encrypted).
• Your messages to our support team, by phone or WhatsApp.

Shoppers

• What you type into the order form: name, phone number, address, wilaya and commune, notes, and the products, options and quantity you order.
• Technical details of the order request, used to stop fake orders: IP address, browser (user agent), country derived from the request, how long the form took to fill, and whether a hidden field was filled.
• Product page views are counted as an hourly total per product, not linked to any person.

Do not send us sensitive data (health, religion, political opinions, and the like) in order notes or messages; we do not need it.

When you order from a store built on Shopispace, the merchant is responsible for your data. They decide to collect your name, phone number and address to deliver your order, and they are your first contact for any question about it. We host the store and process the data for them.

What happens to your order details:

• The merchant sees them in their dashboard. Team members see only what their role allows, and details such as phone numbers are masked for roles that do not need them.
• When the merchant sends your order for delivery, we pass your name, phone numbers, address, commune, wilaya, the amount to collect and a description of the parcel to the delivery company they chose. That company handles the data for its delivery operations.
• If the merchant turned on messaging notifications or a webhook, the new order is also sent to their messaging chat or to the address they set.
• If the merchant connected advertising pixels, the advertising platforms receive events about your visit and purchase. From our servers we send a purchase event containing your name, phone number, town and wilaya in hashed form, plus your IP address, browser and advertising identifiers. The platform’s own privacy policy then applies.

Fake-order protection. To protect merchants from bots and fake orders, we check each order for signs such as a hidden form field being filled, an impossible fill time, a made-up phone number, or repeated attempts (including earlier orders from the same phone number at the same store). When an attempt is blocked or flagged, we log its IP address, browser, country, phone number, name and the reasons for 90 days, so the merchant can recognise repeat offenders. Orders that raise no concern leave no such log. We also use your IP address to limit how many orders one device can submit within a few minutes. Some blocks are automatic; if your order was refused by mistake, contact the store.

To use your rights over order data, contact the store first. If you cannot, contact us and we will pass your request on to the merchant or help them deal with it.

We use personal data to:

• create and run your account and store, and provide the features you use (orders, delivery, notifications, AI tools, advertising pixels);
• take payment for plans and credit, and keep the records the law requires;
• protect the platform, merchants and shoppers against fraud, bots, abuse and attacks;
• support you, answer your messages, and tell you about important changes to the service;
• count referrals, so we can credit the partners and merchants who bring new stores;
• comply with the law.

Where the law of your country requires a legal basis, ours are: performing our contract with you, our legitimate interest in running and securing the service, compliance with legal obligations, and your consent where we ask for it. We send promotional messages only if you agreed, and each one lets you opt out.

We do not sell personal data. We do not use shoppers’ data for our own marketing, and we do not build advertising profiles.

We do not sell personal data. We share it only as follows:

• Merchants receive the data of their own shoppers, and their team members see what their roles allow.
• Our service providers, who process data for us under agreements: hosting of the website and apps; the database, sign-in and file storage; card payments; the sending of account emails; and AI processing when a merchant uses AI features.
• Delivery companies, advertising platforms, messaging services and webhook receivers that a merchant chooses and connects, as described under “Shoppers on merchants’ stores”. Their own privacy policies apply to what they receive.
• Authorities and advisers, when the law requires it or to protect rights, security and property; and a buyer of our business, if we are ever acquired, in which case the same protection would continue and we would tell you.

AI features. When a merchant uses the AI description, landing-page or image tools, the text, product details and images they supply are sent to an AI service, using the merchant’s own key or, if they have none, ours. These tools are not meant for shoppers’ personal data, and we ask merchants not to include any.

Our providers run servers in several countries, so your data may be processed outside the country where you live. We choose providers carefully, send them only what is needed, and require them to protect it. Where your local law requires specific safeguards for such transfers, we apply them.

• Account and store data: for as long as your account exists. When you ask us to close it, we delete or anonymise the store data within a reasonable time, except what we must keep by law.
• Orders and customer records: they belong to the merchant’s store and stay until the merchant deletes them or the store is closed.
• Fake-order protection log: 90 days, then deleted.
• Payment and invoicing records: for as long as Algerian accounting and tax law requires, even after an account is closed.
• Free-trial record: a minimal record (an internal account identifier and the plan) that stays after an account is deleted, so that a free trial cannot be taken twice.
• Referral counts: kept as totals per code and day, not per person.
• Backups: deleted data can remain in provider backups for a limited time until they rotate out.

On our website we use only what is needed to make it work. We do not use advertising or analytics cookies.

When you sign in to the dashboard, a session cookie from our sign-in provider keeps you signed in, and the dashboard remembers its language in a cookie (admin_lang, 1 year).

Stores built on Shopispace may include their merchant’s advertising pixels, which set their own cookies. The merchant is responsible for them. You can block or delete cookies in your browser settings; the website keeps working, but choices such as your language will not be remembered.

• Connections to our website and dashboard are encrypted (HTTPS).
• Passwords are kept as hashes by our sign-in provider, so we cannot read them. Passkeys are supported.
• Your AI API key is stored encrypted, and team invitation links are stored only as hashes.
• The database is reached through our servers; tables holding sensitive records are closed to direct access from a browser.
• Access to a store’s data is limited by role, and customer details are masked for roles that do not need them.
• Webhooks are signed so receivers can verify them, and public forms are rate-limited.

No online service is completely secure. Keep your password and devices safe, use a passkey if you can, and tell us at once if you suspect unauthorised access. If a breach affects your data, we will act quickly and notify you and the authorities where the law requires it.

Depending on where you live, you may have the right to know what we hold about you and get a copy, to have it corrected or deleted, to restrict or object to some uses, to withdraw your consent, and to complain to a data protection authority.

To use any of these rights, contact us (see “Contact”). We may ask you to prove who you are before we share or change data. There is no self-service account deletion yet: write to us to close your account.

If you are a shopper, contact the store first, as it controls your order data. If you cannot, contact us and we will pass your request on or help the merchant deal with it.

Shopispace is a business tool for adults. We do not knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.

We may update this policy. The new version is posted on this page with its date. When a change is significant, for example a new purpose or a new kind of recipient, we tell merchants through the dashboard or by email before it applies, where the law requires it. Earlier versions are available on request.

Questions or requests about your data? Contact us:

• Shopispace
• Phone:+213 6 52 28 25 73
• WhatsApp
• Website:shopi.space