Privacy Policy

Version of 24 September 2026 · [Company Legal Name] FZE

This Privacy Policy explains how [Company Legal Name] FZE handles personal data in connection with Store Radar: what we collect, why, who we share it with, how long we keep it, and the rights people have. Last updated: 24 September 2026.

Who we are

Store Radar is provided by [Company Legal Name] FZE, trade licence [License No.], Sharjah Publishing City, Sharjah, UAE. Website: https://yourdomain.com.

For any question about privacy, or to use your rights, email privacy@yourdomain.com.

We follow the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

Our role: controller and processor

We handle two kinds of personal data, and our role is different for each:

• Data about store owners and their workers (the people who use Store Radar). We decide how this data is used, so we are the controller.
• Data about a store's customers and visitors. The store owner decides why this data is collected and used, so the store owner is the controller. We process it only on the store owner's behalf and on their instructions, as a processor.

Each store owner must have a lawful basis for their customers' data and their own privacy notice. We give store owners suggested text for this in the app.

If you are a customer of a store that uses Store Radar, please contact that store first.

What data we handle

About store owners and workers:

• account details: name, email, phone number, business name and sign-in details;
• usage records: sign-ins, and which pages and buttons you use in the app;
• questions typed into the "Ask me" box;
• billing records and messages you send us.

From the store, read-only, on the store owner's behalf:

• orders, order lines, order notes, discount codes, refunds and refund notes;
• products, variants, stock levels, and product costs if recorded;
• customers: name, email and phone number;
• shipping addresses of recent orders that are not yet delivered;
• unfinished checkouts (Shopify only);
• the marketing source of each order: first and last visit source, and campaign tags;
• blog article titles and dates.

From connected services, only if the store owner gives access: data from Google Analytics 4 (Viewer access), Google Search Console (Restricted access), Google Ads (read-only, through our manager account) and Meta Ads (read-only, as a partner).

From the journey tracker, only if the store owner adds it: anonymous steps of visits (page path, step name, device type) and a salted hash of the IP address that changes every day. It collects no names, emails or phone numbers and uses no cookies.

Public and third-party data: public catalogue pages of competitors the store owner lists, and search data from DataForSEO based on search keywords and the store's public website address.

Why we use data

• To provide the service: reports, advice cards, alerts, daily and weekly emails, WhatsApp links for the owner, and worker task links.
• To answer "Ask me" questions.
• To respect "do not contact" choices that the store owner records.
• To support our clients and to improve the service, using usage records.
• To produce anonymous, aggregated market insights.
• To bill for the service and keep business records.
• To keep the service secure and prevent abuse.
• To meet our legal obligations.

Legal bases

For data about store owners and workers, we rely on:

• the contract with the store owner, to provide and support the service;
• our legal obligations, for example for billing records;
• consent, where the law requires it, for example for the optional connections a store owner chooses to turn on;
• where the law allows, our interest in improving and securing the service.

For customer and visitor data, the store owner is responsible for the legal basis. We process that data only to provide the service to the store owner, under our agreement with them.

Artificial intelligence

All numbers are calculated on our own server. We use an AI provider, Anthropic (maker of Claude), only to write wording and to answer "Ask me" questions.

Before any text leaves our server, we remove customer names, emails and phone numbers. The AI never receives customer names. Store owners can turn the AI off. The app then uses built-in text.

Market insights

We combine anonymous, aggregated numbers from all stores that take part to show trends. They never include names, customers, products or store names. A figure is shown only when at least 10 stores of the same type contribute, and no single store can dominate it. A store can opt out in Settings. Stores that opt out do not receive market insights.

Who we share data with

We do not sell personal data. We share data only with these service providers (sub-processors), and only what each one needs:

• Hostinger: hosts our servers, where data is stored and processed.
• Anthropic: writes wording and answers "Ask me" questions. It receives text with customer names, emails and phone numbers removed.
• Google: when a store owner connects Google Analytics 4, Search Console or Google Ads, we read that data from Google.
• Meta: when a store owner connects Meta Ads, we read ad data as a partner.
• DataForSEO: receives search keywords and the store's public website address. Never customer data.
• Our email provider: sends emails to store owners and workers through SMTP.

We may also share data if the law or a competent authority requires it, to protect our legal rights, or as part of a sale or merger of our business, with the same protections in place.

International transfers

Some of our providers, such as Anthropic, Google and Meta, may process data outside the UAE. When data leaves the UAE, we take the steps the PDPL requires, such as using providers with suitable data protection terms. We also keep what we send to a minimum. For example, customer names, emails and phone numbers are removed before any text goes to our AI provider.

How long we keep data

• Delivery addresses: deleted a few days after the order.
• Journey tracker data: 45 days.
• Other store data (orders, products, customers and similar): while the account is active, and deleted when the store owner asks us to delete it or the service ends.
• Data from connected services: while the connection and account are active.
• Account details, usage records and "Ask me" questions: while the account is active.
• Billing records: as long as UAE law requires.
• Anonymous, aggregated market figures: these cannot identify anyone, so they may be kept.

Security

• Our access to stores and connected services is read-only.
• Customer names, emails, phone numbers and addresses are encrypted at rest.
• Numbers are processed on our own server. Personal details are removed before any text goes to our AI provider.
• Only staff who need it can access data, and our support access to an account is logged.
• The journey tracker is rate limited to prevent abuse.

No system is perfectly secure. If a breach affects personal data, we will act quickly, inform the store owners affected, and inform the authorities where the law requires.

Your rights

Under the PDPL, you can ask to:

• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete your data;
• object to, or ask us to stop, certain uses of your data, and withdraw consent you gave.

To use these rights, email privacy@yourdomain.com. We may ask you to confirm who you are. We will reply without undue delay.

Store owners can also delete all their data from Store Radar with the delete button in the app.

If you are a customer of a store, please contact the store. You can also ask the store not to contact you, and the store can mark you "do not contact" in Store Radar.

If you are not happy with our answer, you can complain to the UAE Data Office.

Cookies

The app uses one session cookie only, to keep you signed in. We do not use advertising or tracking cookies in the app. The journey tracker does not use cookies.

Children

Store Radar is a service for businesses. It is not meant for children, and we do not knowingly collect data from children as users of the app.

Changes to this policy

We may update this policy. The date at the top shows the current version. If a change is important, we will tell store owners by email or in the app.

Contact

[Company Legal Name] FZE, Sharjah Publishing City, Sharjah, UAE.

Email: privacy@yourdomain.com

Website: https://yourdomain.com

What changed

• 24 Sep 2026: First version of these pages.