Privacy Policy

Effective date: 14 October 2026

This policy explains what personal data ArabShop collects, why, who we share it with, and the choices you have. "ArabShop", "we" and "us" mean Arabshop LLC, Olaya Towers, Olaya Street, Riyadh 12213, Kingdom of Saudi Arabia.

1. Who this policy covers

Merchants: people who create an ArabShop account and run a store.

Shoppers: people who buy from a store built on ArabShop.

Visitors of arabshop.app and our other sites.

For merchant accounts, ArabShop decides how the data is used. For shoppers, the store owner (the merchant) decides; ArabShop processes shoppers' data on the merchant's behalf to run the store. If you have a question about how a store uses your data, contact that store first.

2. Data we collect

From merchants: account data (name, email, phone number, a password stored only as a secure hash, country); store data (store name, contact details, addresses, products, settings, uploaded images); and payment settings (payment gateway keys, stored encrypted, and bank account details).

From shoppers, on behalf of the merchant: contact and delivery data (name, phone number, email, city, address, delivery notes, and a tax number if the store asks for it); order data (products, amounts, payment method, order status and history); what a shopper types at checkout, saved even if the order is not finished so the store can follow up on an abandoned cart; bank-transfer receipts (the uploaded image, the bank chosen and the transaction number); and the IP address and browser type used for the order.

From everyone: technical data (IP address, browser and device information, the pages requested and the time), which our servers record in logs, and the language and display choices kept in your browser (see section 6).

We do not receive or store payment card numbers. Card details are entered on the payment provider's own page or form.

3. Why we use it

To provide the service: create accounts and stores, take and manage orders, process payments and deliver orders.

To keep accounts secure: sign-in, one-time verification codes, password reset, bot protection at sign-up, fraud and abuse prevention, and rate limits.

To send service messages: verification codes, password resets, and order and account notices.

To meet legal duties, such as tax and accounting records.

To improve the service and fix problems.

We do not sell personal data.

4. Who we share it with

We share data only with providers that help us run the service, and only what each one needs.

Payment providers chosen by the merchant: Tap, HyperPay, Tabby, Tamara, Paymob, Stripe and Kashier. When a shopper pays, the provider receives the amount and, depending on the provider, the shopper's name, email, phone, billing or shipping address and the items. Each provider handles card data under its own privacy policy.

Cloudflare: our sites pass through Cloudflare for speed and security, so it processes requests, including IP addresses.

Hosting: our servers and databases are hosted by OVH in France.

Text messages: Advansy sends verification codes by SMS.

WhatsApp: Twilio sends verification or password-reset codes when WhatsApp is used.

Email: account and service emails are sent from our own mail server, operated by ArabShop.

Merchant dashboard tools: maps and address search (OpenStreetMap, Photon by Komoot and CARTO) receive the address or location a merchant types and their IP address. The optional AI writing assistant sends the merchant's request and the form's text to OpenRouter and the AI model provider it uses; AI product images come from Pollinations.

Advertising platforms a merchant connects: if a merchant connects Meta (Facebook and Instagram), TikTok or Snapchat to measure sales, each completed order sends that platform the order value, the shopper's IP address and browser type, and the shopper's email, phone, name and city in hashed (scrambled) form. The merchant decides whether to turn this on.

Authorities, when the law requires it.

Our own websites (arabshop.app, the merchant dashboard and the checkout page) do not use advertising or analytics trackers.

5. How long we keep data

Accounts, stores, orders and customers: while the account is active, and deleted within 90 days after the account is closed. Tax and accounting records are kept as long as Saudi law requires.

Abandoned-cart details: kept as the merchant chooses. The merchant can delete them at any time, and they are deleted with the store under the account-closure rule above.

Payment records: 5 years.

Bank-transfer receipt images: 1 year after the transfer is approved or rejected.

Server logs: application error logs 14 days; payment logs 30 days; web server logs of the checkout page 21 days. Detailed request logs are switched off; if we turn them on to investigate a problem, they hide passwords, codes and keys and are kept 14 days. Log files can be read only by our service account.

Expired sign-in tokens: deleted after 7 days.

Backups: we make regular backups and keep them for a limited period.

6. Cookies and browser storage

We only use what our sites need to work. Nothing is used for advertising or tracking.

arabshop.app: a "Lang" cookie for your language (1 year), your light or dark choice in local storage, and a flag for the current tab that skips the intro animation.

Merchant dashboard: sign-in cookies (session, account and store details; 7 days, removed when you log out), your language (1 year), layout preferences, and your recent dashboard searches, which stay in your browser.

Checkout page: a "Lang" cookie (1 year), your language and light or dark choice in local storage, and a value for the current tab used by the HyperPay card form.

You can delete these in your browser settings; you may then need to sign in again.

7. Security

Connections are encrypted (HTTPS). Passwords are stored as hashes, and payment gateway keys are stored encrypted. Bank-transfer receipts are kept outside any public folder and shown only to the store that received them. Access to data is limited to what each part of the service needs. No system is perfectly secure; if a breach happens, we will notify affected users and the authorities as the law requires.

8. Where data is stored

Our servers are in France. Some providers (Cloudflare, payment providers, Twilio, OpenRouter and the map services) may process data in other countries.

9. Your rights

You can ask to access, correct or delete your personal data, or object to some uses, as the law that applies to you allows. Merchants can edit most of their data in the dashboard. Shoppers should contact the store first, and we will help the store answer. To make a request, email [email protected]. We answer within 30 days.

10. Children

ArabShop is a service for businesses and is not meant for children. Merchants must be at least 18 years old. We do not knowingly collect children's data.

11. Data protection laws

We aim to comply with the Personal Data Protection Law of the Kingdom of Saudi Arabia, and, where it applies, Egypt's Personal Data Protection Law (Law No. 151 of 2020) and other laws that apply to our users.

12. Changes to this policy

We may update this policy. We will post the new version here with a new effective date, and tell merchants about important changes by email or in the dashboard.

13. Governing law

This policy is governed by the laws of the Kingdom of Saudi Arabia, and the courts of Riyadh have jurisdiction.

14. Contact

Email: [email protected]

Phone: +966 50 166 9807 (Saudi Arabia), +20 111 577 2257 (Egypt)

Arabshop LLC, Olaya Towers, Olaya Street, Riyadh 12213, Kingdom of Saudi Arabia