Privacy policy

Who we are

Mraya is an e-commerce platform operated by Ahmed Yasser, 5th Othman Ibn Affan Street, Sidi Bishr, Alexandria, Egypt. Merchants use Mraya to run online stores; shoppers buy from those stores. This policy explains what we do with personal data in both cases.

Two different relationships

Data about merchants and their team

When you create a Mraya account to run a store, we decide how your account data is used, and this policy governs it.

Data about a store’s shoppers

When someone buys from a store built on Mraya, that data belongs to the merchant. We hold and process it on the merchant’s instructions so their store works — we do not sell it, and we do not use it to market anything of our own. The merchant’s own privacy policy governs how they use it.

What we collect

From merchants and their team

• Name, email address and phone number
• A password, stored only as a hash — we never see or store the password itself
• Store details you enter: store name, description, contact details, branding
• Sign-in and activity history within the dashboard
• Billing records: plan, subscription state, invoices and payment references

From shoppers, on behalf of the merchant

• Email address, name and phone number
• Delivery addresses and order history
• Shoppers sign in with a one-time code sent by email — no shopper password exists or is stored

Usage analytics

• A randomly generated session and visitor identifier
• Pages viewed, products viewed, searches, and add-to-cart and checkout events
• Referring URL, landing page, and campaign parameters if present in the link
• Device type (mobile, tablet or desktop)

We do not store visitors’ IP addresses or browser user-agent strings in analytics records. Analytics are per store and are shown only to that store’s merchant.

Cookies

We set cookies only to keep you signed in and to route you correctly: auth_access_token, auth_user_type, auth_user_role and auth_user_sections. They are set with SameSite=Lax and are cleared when you sign out. We do not set advertising or cross-site tracking cookies of our own.

Advertising pixels

A merchant can connect their own Meta (Facebook/Instagram) or TikTok advertising pixel to their store. This is off unless the merchant turns it on, and the data goes to that advertising platform under the merchant’s own account and their agreement with that platform, not ours.

Who else sees data

We use a small number of service providers to run the platform. They receive only what they need for their function:

• Cloudflare R2 — storage for uploaded images and files
• Bosta — shipping, when a merchant connects their own courier account: delivery name, address and phone are sent to book a shipment
• Kashier or XPay — payment processing, when a merchant enables online card payments through their own gateway account
• Our email provider — to send sign-in codes, order emails and account notices
• Self-hosted error monitoring — technical error reports, which may incidentally include a URL or user identifier

We do not sell personal data, and we do not share it for anyone else’s advertising.

How long we keep it

• Account data: until the account is deleted
• A deleted store: closed immediately, then permanently erased 30 days later
• Orders, invoices and tax records: the period required by applicable tax and accounting law, after which they are deleted
• Analytics: aggregated into daily totals; individual events are not kept indefinitely

Your choices

You can view and correct your account details in the dashboard at any time. You can delete your account yourself — the page below explains exactly what happens.

If you shopped at a store built on Mraya and want your data removed, contact that store directly — they control it. If you cannot reach them, write to us and we will pass the request on.

Security

Each store’s data is held in its own isolated database schema. Passwords are hashed, third-party credentials are encrypted at rest, and traffic is served over HTTPS. No system is perfectly secure, but these are the measures we take.

Contact us

Questions about this policy, or about your data: support@mraya.co. This policy is governed by the laws of the Arab Republic of Egypt.

Changes

If we change this policy we will update the effective date above, and we will tell account holders directly if the change is significant.