Privacy Policy
Last updated: 13 November 2026
This policy explains what data Tafra Stores ("Tafra") collects and how we use and protect it, under Egypt's Personal Data Protection Law No. 151 of 2020.
Who is responsible for the data
Merchants' data (store owners): Tafra is responsible for it.
Store customers' data: each store collects it from its own customers. The merchant is responsible for how it is used, and Tafra processes it on the merchant's behalf to run the store, fulfil orders and prevent fraud.
What we collect
- Merchants: name, email, mobile number, store details and content, sign-in history, and wallet movements.
- Store customers: name, mobile number (and an optional second number), email (optional), delivery address, order details and notes.
- Technical: the IP address turned into a one-way code (to prevent abuse), and a device identifier to send mobile notifications to merchants who turn them on.
Why we use it
- To run accounts and stores and fulfil orders.
- To send account emails (email confirmation, password reset) and order notifications.
- To calculate order fees and manage wallets.
- To prevent fraud and fake orders and protect the platform.
- To answer support requests.
We don't sell data, don't use it for advertising, and don't send marketing messages to store customers.
Protection against fake orders
When a merchant blocks a mobile number, other Tafra merchants see only how many stores blocked it, never anything about those stores or their customers. A number reported by several merchants may be blocked from ordering on the whole platform after review by the Tafra team.
Who sees the data
- A merchant sees only their own store's customers, never another store's data.
- The Tafra team, when needed for support, billing and fraud prevention.
- Service providers who run the platform for us: Supabase (database and sign-in), Render (servers), Vercel (websites), Cloudflare (domain, image storage, bot protection), Brevo (email), Google Firebase (mobile notifications).
Some of these providers store data on servers outside Egypt, with appropriate safeguards.
Cookies and on-device storage
- Dashboard: only the cookies needed to stay signed in.
- Stores: the shopping cart and language choice are kept on the customer's own device.
- Tafra home page: a tafra_ref cookie for 30 days, to know which store referred you.
- We use no advertising cookies and no third-party trackers.
How long we keep data
We keep data while the account is active. Order and billing records are kept after a store is deleted, for accounting, fraud prevention and legal requirements. A deleted store's photos are removed after 30 days.
Your rights
You can ask to see, correct or delete your data, or object to its processing, by writing to support@bytafra.com. If you are a store's customer, contact the store first; we will help it act on your request.
Keeping data safe
All connections are encrypted (HTTPS), passwords are stored hashed by the sign-in provider and never seen by us, and database permissions keep each store's data separate.
Changes to this policy
We will notify merchants of any material change before it applies, and the date at the top of this page will change.
Contact
Privacy questions: support@bytafra.com.