Privacy Policy

Who we are

Vondera is a commerce operating system that lets merchants build online stores and run their orders, shipping, payments, marketing and operations from one dashboard. The platform is operated by Alplatform Vondera LLC, an Egyptian limited liability company established under Investment Law No. 72 of 2017, Commercial Register No. 301373 – Cairo Investment Office, with its registered office at 1 Asia Street off Andrea, Corniche El Nil, Dar El Salam, Maadi, Cairo, Egypt.

This policy is issued under Personal Data Protection Law No. 151 of 2020 and its Executive Regulations (Ministerial Decree No. 816 of 2025).

Our two roles

Controller: for the personal data of merchants, their staff, applicants, partners, media buyers, affiliates and visitors to vondera.app, Vondera decides why and how the data is processed, and this policy applies in full.

Processor: for shoppers and other customers of stores built on Vondera, the merchant is the controller and Vondera processes the data only on the merchant’s documented instructions, under the Data Processing Terms in our Terms of Service. Shoppers should read the merchant’s own privacy policy and contact the merchant first.

Data we collect

Data you give us:

• Account data: name, email, mobile number, password (stored hashed), language and role.
• Business data: store and brand name, business address, commercial register and tax details, and identity details of the account owner where needed to verify the account or enable certain features.
• Billing data: plan, invoices, payment status and transaction references. Full payment card numbers are handled by our payment providers.
• Store content: products, images, prices, pages, domains, policies and settings.
• Communications with our sales, onboarding and support teams, feedback, surveys and community posts.
• CVs and application details, and the contact and payout details of partners, affiliates and media buyers.

Data we collect automatically: IP address, device and browser data, pages and features used, referral source, approximate location from IP, login history, API calls, error and security logs, and cookies (see below).

Data from third parties: integrations you connect (shipping companies, payment providers, advertising platforms such as Meta, TikTok and Google, messaging providers and apps), referral partners, and public business sources.

Shopper data processed for merchants: name, phone, email, delivery address, orders, delivery and payment status, order confirmation responses, storefront browsing data and anything the shopper submits to the merchant.

We do not intentionally collect sensitive personal data (such as health, biometric, religious or political data, or children’s data). Merchants must not use the platform to collect it without the licences and explicit consents the law requires.

How we use data and why

We process personal data only where the law allows it: with consent, to perform a contract, to comply with a legal obligation, or for legitimate interests that do not override your rights.

• Providing the platform, your account and your store (contract).
• Billing, invoicing and collections (contract; legal obligation).
• Customer support and onboarding (contract; legitimate interests).
• Security, fraud and abuse prevention (legitimate interests; legal obligation).
• Improving the platform, using aggregated or de-identified data wherever possible (legitimate interests).
• Marketing to merchants and prospects (consent, which you can withdraw at any time).
• Legal compliance and enforcing our terms (legal obligation; legitimate interests).

Automated features and risk signals

Some features run automatically on the merchant’s instructions, such as WhatsApp order confirmations, abandoned-cart reminders and risk signals that help merchants reduce failed cash-on-delivery orders. These signals support the merchant’s own decision and do not by themselves produce legal effects for a shopper.

Where we offer AI-assisted features, the content you submit is processed to provide the feature and may be handled by carefully selected AI providers acting as our sub-processors.

Who we share data with

• Service providers (sub-processors) that help us run the platform: cloud hosting, databases, email, SMS and WhatsApp delivery, analytics, support and security tools.
• Integrations you choose to enable, under their own terms and privacy policies.
• The merchant whose store a shopper uses, for shopper data.
• Professional advisers, auditors and insurers, under confidentiality duties.
• Public authorities, where required by Egyptian law or a valid order.
• A buyer or investor in a merger, acquisition, financing or sale of assets, subject to confidentiality and this policy.

We do not sell personal data, and we do not let third parties use it for their own marketing without your consent.

International transfers

Our infrastructure and some of our service providers are located outside Egypt, so personal data may be transferred to and stored in other countries. We do this only in accordance with Articles 14 to 16 of the Data Protection Law: under the licence or permit issued by the Personal Data Protection Center, to destinations with a level of protection not lower than Egyptian law, with contractual and technical safeguards, and with your consent where the law requires it.

Retention

• Account, store and business data: while your account is active, then up to 90 days for export, after which it is deleted or anonymised unless the law requires longer.
• Shopper data: as instructed by the merchant and for the life of the merchant’s account.
• Invoices, billing and tax records: for the period required by Egyptian tax and commercial laws.
• Security and access logs: up to 12 months, or longer for an investigation or where required by law.
• Marketing preferences: until you withdraw consent; we keep a record of the withdrawal.
• Job applications: up to 12 months after the recruitment decision, unless you agree to longer.

Security and breach notification

We use technical and organisational measures appropriate to the risk, including encryption in transit, role-based access, multi-factor authentication for internal systems, logging, monitoring, backups, staff confidentiality agreements and training.

If a personal data breach occurs, we will notify the Personal Data Protection Center within 72 hours of becoming aware of it and inform affected individuals within the period set by the Executive Regulations. Where we act as processor, we will notify the affected merchant without undue delay.

Your rights

Under the Data Protection Law you have the right to:

• know what personal data we hold about you, access it and obtain a copy;
• withdraw your consent at any time;
• have inaccurate or incomplete data corrected or updated;
• have your data deleted, or its processing limited to a specific scope;
• object to processing, including for direct marketing;
• be notified of any breach affecting your data; and
• complain to the Personal Data Protection Center.

Email privacy@vondera.app from the address linked to your account. We will respond within the period set by the law. Shoppers should contact the merchant first; we will forward and support requests we receive about merchant data.

Marketing communications

We send electronic marketing (email, SMS, WhatsApp or notifications) only with your prior consent, identify Vondera as the sender, and include an easy way to opt out in every message. Opting out does not stop service messages about your account, billing or security.

Cookies and similar technologies

We use cookies, local storage, pixels and SDKs to keep you signed in, remember preferences, secure the platform and, with your consent, measure usage and marketing.

• Strictly necessary (sign-in, security, cart and checkout): no consent needed.
• Preferences (language, currency, settings): no consent needed.
• Analytics (improving the platform): consent needed.
• Marketing (campaign measurement and ads, e.g. Meta, TikTok and Google pixels): consent needed.

Merchants who add their own pixels or tracking tools to their stores are responsible for obtaining shoppers’ consent for them.

Children

The platform is intended for businesses and adults; merchant accounts may only be opened by persons of full legal capacity. We do not knowingly collect children’s data through our own websites. Children’s data is sensitive data under the law; merchants who sell to minors must obtain the guardian consent and licences required.

Merchant responsibilities

As the controller of your customers’ data, you must publish your own privacy policy, have a lawful basis for processing (including consent for marketing and tracking), obtain any licence you need from the Personal Data Protection Center, and respond to your customers’ requests. Our Terms of Service, including the Data Processing Terms, set out how we process this data for you.

Changes to this policy

We may update this policy to reflect changes in the law, our services or our practices. We will post the new version here with a new date and, for material changes, notify merchants by email or in the dashboard at least 15 days before it takes effect.

Contact us

• Privacy requests and Data Protection Officer: privacy@vondera.app
• Legal notices: legal@vondera.app
• Post: Alplatform Vondera LLC, 1 Asia Street off Andrea, Corniche El Nil, Dar El Salam, Maadi, Cairo, Egypt
• Regulator: Personal Data Protection Center, Ministry of Communications and Information Technology, Egypt

If this policy is published in Arabic and English, the Arabic version prevails in case of any conflict.