1. Who this covers
This policy explains how Ebda (a product of Whisky 11) handles personal data under Egypt's Personal Data Protection Law No. 151 of 2020. It covers: merchants and their staff who use Ebda; visitors to ebda.app; and shoppers who buy from a merchant's store. Contact: ahlan@ebda.app.
2. Our two roles
Controller: for merchant account, billing, support, security and website-visitor data, Ebda decides why and how the data is used.
Processor: for the personal data of a merchant's own customers and visitors (orders, addresses, phone numbers, emails, messages), the merchant is the controller and Ebda only processes it on the merchant's behalf to run the store. If you are a shopper, the merchant you bought from is responsible for how your data is used; send requests about it to that merchant.
3. Data we process
Merchant data: name, email, phone, password (stored only in hashed form), store details, billing and InstaPay payment references, VAT registration details where you provide them, plan and usage, support messages.
Store data processed for merchants: products, orders, customer names, contact details, delivery addresses and order history, and anything else the merchant or its customers enter.
Technical data: IP address, device and browser details, security and audit logs, error reports, and, in the merchant dashboard where analytics are enabled, usage events.
We do not process card numbers: Ebda does not take payments for merchants.
4. Why we use it, and on what basis
To provide the Service and perform our contract with you; to bill and prevent fraud; to secure the Service and fix errors; to send service notices (we send marketing only with consent); to comply with law; to improve the Service where analytics are enabled (with consent where required); and to respond to requests. Where the law requires consent we ask for it and you can withdraw it at any time.
5. Service providers (sub-processors)
We use these providers to run the Service. Each processes data only on our instructions and under its own security and data terms: Cloudflare (website and API hosting, delivery, key-value storage, queues and file/image storage); Neon (database hosting, EU region); Resend (transactional and campaign email); Sentry (error and performance monitoring, EU region); Inngest (background job processing); Google Gemini (Google; AI features: only the text you submit to an AI feature is sent); PostHog (EU cloud; product analytics in the merchant dashboard); and OneSignal (United States; push notifications to the merchant dashboard installed as a home-screen app).
We may add or replace providers; the current list is maintained on this page. We do not sell personal data.
6. Transfers abroad
Some providers process data outside Egypt, including in the EU and the United States. Where the law requires, we rely on appropriate contractual and technical safeguards, and we choose EU regions for the database and monitoring services above.
7. Retention
We keep data for as long as the account is active and as needed for the purposes above. We keep a store and its data, including while it is suspended, until the merchant asks us to delete it or the account is closed; we then delete or anonymise them within 90 days, except records we must or reasonably need to keep (for example billing and tax records, audit and security logs, and material needed to prevent fraud or defend claims), which are kept only as long as necessary. Backups age out on their normal cycle.
8. Your rights
Under Law No. 151 of 2020 you may ask to access, correct, update or delete your data, to restrict or object to processing, and to withdraw consent. Write to ahlan@ebda.app; we may need to verify your identity, and will reply within a reasonable time. Requests about a shopper's data in a merchant's store are passed to that merchant. You may also complain to the Personal Data Protection Centre in Egypt.
9. Security
We use measures such as encrypted connections, access controls, hashed passwords and monitoring. No system is perfectly secure and we cannot guarantee absolute security. If a breach affects your data we will notify you and the competent authority as the law requires.
10. Cookies
This marketing website does not use advertising or tracking cookies. The merchant dashboard and stores use cookies and similar storage that are necessary to sign in and operate, and optional analytics only where enabled and, where required, with your consent.
11. Children
The Service is not directed to people under 18 and we do not knowingly collect their data. Contact us if you think a child has given us data.
12. Changes and contact
We may update this policy and will post the new version here with its date; we will notify merchants of material changes. Questions: ahlan@ebda.app.