Privacy Policy

Information we collect

• Phone number or email address: to sign you in with a verification code we send you.
• A Google or Apple account if you choose to sign in with it: we receive only the account identifier and email (which may be an Apple private-relay address).
• The display name on your account and your preferred language.
• Shipping addresses you add: name, phone, city, district, street, building number and postcode. A copy is kept with each order.
• Your activity in the store: cart, wishlist, orders, reviews, disputes and notification preferences.
• Device information: device type, operating system, app version and language, a device fingerprint used for security, and last-used time.
• A push notification token (Firebase Cloud Messaging) to send you updates about your orders.

Seller data (Tala Vendor app)

• Store details: name, description, logo, commercial registration number and VAT number.
• Documents requested for verification (commercial registration, national ID, IBAN certificate, national address and others), reviewed by our team before the account is activated.
• The bank account used for payouts: account holder name, bank and IBAN.
• Team members you add and their roles.

What we do not collect

The apps do not ask for camera, photo, microphone, location or contacts permission, and we do not track your location. The only permission used is notifications, which you can turn off at any time in your device settings.

We do not store card numbers or security codes. We keep only the transaction reference, its status and its amount.

How we use your data

• To create, secure and sign you in to your account.
• To fulfil your orders, ship them, and handle payment, returns and disputes.
• To connect you with the seller and settle their earnings.
• To notify you about your orders and send reminders such as an abandoned cart; you control these in notification settings.
• For security, fraud prevention and legal compliance.

Sharing

We do not sell your data. We share with the seller you buy from what the order needs (name, shipping address and phone number), with technical providers acting for us (hosting, Google Firebase for notifications, Google and Apple for sign-in, and the payment gateway and shipping carrier once enabled), and with authorities where the law requires.

Retention

We keep your data while your account exists and as long as needed to provide the service. Session tokens expire after 30 days, and inbox notifications, notification logs and inactive notification devices are removed automatically after set periods. Order, invoice and payment records are kept for as long as accounting and tax rules require, even after an account is deleted.

Your rights

• Delete your account: in the app (Account → Terms & privacy → Delete my account, or Account → Delete account in Tala Vendor), or by contacting us. Details are on the Delete account page.
• Access, correct or request a copy of your data: write to projectsathr@gmail.com and we will respond within a reasonable time.
• Turn off notifications at any time in your device or app settings.

Children

The platform is not directed at anyone under 18 and we do not knowingly collect their data. If you learn that a minor has created an account, contact us and we will delete it.

Security

Data is encrypted in transit (HTTPS), sign-in tokens are kept in secure storage on your device, and access to data is limited to the team members who need it for their work.

Changes to this policy

We may update this policy. The new version is published here with its date.