Privacy Policy

1. Who we are

WhatCart is software that helps merchants manage orders, stock, shipping and customer conversations on WhatsApp. WhatCart is operated by Bit Techs, 18 Health Street, Ain Shams, Cairo 11728, Egypt (“WhatCart”, “we”, “us”).

For privacy and data requests: privacy@whatcart.net, or by post to the address above. For support, billing and general questions: support@whatcart.net.

2. Our role

• Merchant account data and data about visitors to our website: we are the controller. We decide why and how it is processed.
• Buyer data (the merchant’s customers, gift recipients and anyone who messages the merchant’s WhatsApp number): the merchant is the controller. We process this data as the merchant’s processor (service provider), only on the merchant’s instructions and to provide the service. For WhatsApp we act as the merchant’s technology provider on Meta’s WhatsApp Business Platform.

If you are a buyer, the store you deal with decides how your data is used and must give you its own privacy notice. A merchant can add the link to its privacy notice in Settings → Privacy and limits, and the store’s WhatsApp assistant sends it in its first greeting to a new buyer. Our Data Processing Agreement sets out how we process buyer data for merchants: https://whatcart.net/dpa

3. Data we collect

Merchant account data (from you, when you sign up and use the app):

• Name, email and password (stored only as a hash, never in plain text), and passkey public keys if you use passkeys.
• Business phone number and store settings (name, logo, country, currency and similar), and the date and version of the terms you accepted.
• Team members the merchant invites, their roles and permissions.
• Device sessions: device type (web, Android or iOS), sign-in and refresh dates, and the push notification token of the mobile app. IP addresses are used briefly, in memory, to limit abuse and block password guessing, and can appear in server logs; we do not store them in the account database.
• Order pack purchases: from Gumroad, our merchant of record for order packs, we receive the Gumroad sale ID and order number, the pack, amount, currency, any offer code, country, payment, refund and dispute status and dates, and the store owner’s email. We never receive full card details.
• Sign-up source: the campaign parameters (such as utm_source or a referral code) and the landing page that brought you to sign up, if any.
• Support requests and other messages you send us.

Store operations data the merchant enters or receives through the service (buyer data):

• Products, prices, stock and product images.
• Orders, buyer names, phone numbers and delivery addresses, including a GPS location or maps link if the buyer chooses to send one, and a gift recipient’s name and phone if the buyer marks an order as a gift.
• Order history, payment records (such as transfers, transfer proofs and cash on delivery), refunds, returns, and shipment details: the carrier or rider, the tracking number and the parcel’s status.
• Each buyer’s marketing consent or opt-out, with the date, the source and the exact wording they agreed to.

WhatsApp data through the WhatsApp Business Platform (Cloud API), after the merchant connects their number with Meta Embedded Signup:

• WhatsApp Business Account (WABA) ID, phone number ID and number details (display name, quality rating and messaging limit).
• The business integration token issued by Meta, stored encrypted.
• Content and media of messages exchanged between the merchant and their buyers: text, images, voice notes, documents, locations and contacts, with the buyer’s WhatsApp profile name and number.
• Message status (sent, delivered, read, failed), Meta’s pricing category for each message, and message templates.
• Catalog and product data synced with Meta.
• Account events Meta sends us, such as the merchant removing WhatCart from their WhatsApp Business Account.

Payment providers the merchant connects with its own account (Paymob, or Stripe when it is switched on): transaction references, status and amount. WhatCart never receives or stores full card numbers; card details are entered with the payment provider directly.

Carriers the merchant connects with its own account: the parcel’s tracking number and status updates, and the cash-on-delivery payout records the merchant reads from the carrier. The account keys the merchant enters are stored encrypted.

Mobile app: the camera (to scan barcodes and take product or proof photos), photos you pick and your device location are used only when you tap the feature that needs them, such as “Use my current location”.

Technical data: server logs, copies of the event notifications that Meta, Gumroad, payment providers and carriers send us, and an audit log of sensitive actions in the store (who did what and when).

4. Why we use data and our legal bases

For merchant account data, we use data for these purposes and on these legal bases:

• To provide and run the service: your account, products, orders, stock, shipments, payments and WhatsApp messaging. Basis: performing our contract with you.
• To sell you order packs: add the orders you buy to your balance, handle refunds and payment disputes with Gumroad, and keep financial records. Basis: our contract, and legal obligations such as tax and accounting rules.
• To protect accounts, prevent fraud and abuse, and stop the same business phone number from starting repeated free trials. Basis: our legitimate interests in a secure and fair service.
• To give support when you ask. Basis: our contract.
• To improve the service: we record product-usage milestones for each store, such as its sign-up source, the setup steps it has completed and its order counts. These records contain no buyer data. Basis: our legitimate interest in understanding how the product is used.
• To send service emails and app notifications, such as email verification, password reset, team invitations, billing notices and alerts. Basis: our contract.
• To comply with the law and respond to binding requests from authorities. Basis: legal obligation.
• Where a law requires your consent for something (for example your explicit consent under Türkiye’s KVKK for a transfer abroad that has no other basis), we ask for it separately, and you can withdraw it at any time.

For buyer data, we use data only to provide the service to the merchant, on the merchant’s instructions: taking and fulfilling orders, sending order and delivery messages on WhatsApp on the merchant’s behalf, receiving the buyer’s replies, recording payments and returns, and sending marketing messages only to buyers who agreed to receive them. The merchant is responsible for having a legal basis for this processing.

What we do not do:

• We do not sell or rent personal data.
• We do not use data for advertising or share it with ad networks.
• We do not use WhatsApp data to train AI models, or to profile people beyond what is needed to provide the service.
• We make no decisions about people based solely on automated processing that have legal or similarly significant effects on them.

5. Meta and WhatsApp

To deliver WhatsApp messages and catalogs, we exchange data with Meta Platforms through the WhatsApp Business Platform. Meta’s processing is subject to its own terms and policies, including the WhatsApp Business Policy https://www.whatsapp.com/legal/business-policy and the Meta Privacy Policy https://www.facebook.com/privacy/policy

The data we receive from the Meta Platform is listed in section 3 (WhatsApp data). We use it only to provide the service to the merchant who connected it: to send and receive that merchant’s messages, show its conversations, sync its catalog, and show its messaging usage and costs. We keep each merchant’s data separate, and we do not sell it, use it for any other purpose or pass it to other merchants.

Marketing messages: a store’s WhatsApp assistant asks each new buyer, in the store’s name, whether they want to receive offers, and records the answer. A buyer can stop marketing messages at any time by replying STOP (or إيقاف, or DUR in Turkish). Merchants must follow the WhatsApp Business Messaging Policy, including its opt-in rules.

A merchant can disconnect WhatsApp at any time in Settings → Channels. Disconnecting revokes our access to their account and wipes the stored integration token. If the merchant removes WhatCart in their Meta settings, we disconnect automatically when Meta notifies us. How to ask for your data to be deleted is explained on our Data Deletion Instructions page: https://whatcart.net/data-deletion

6. Sharing and service providers

We share data only with the service providers we need to run WhatCart, and only as much as they need. They process it for us under written data processing terms:

• Hostinger (Hostinger International Ltd): hosting. Our servers and database are in Paris, France (European Union).
• Cloudflare, Inc. (R2 object storage): WhatsApp media, product images and attachments. Cloudflare chooses the data centre location.
• Meta Platforms (WhatsApp Business Platform): message and catalog delivery.
• Resend (United States): service emails to merchants and their team members.
• Google (Firebase Cloud Messaging): push notifications to the WhatCart app on team members’ phones. It receives a device token and the notification text, which can include a buyer’s name or phone number (for example “New order from …”).
• Google (Firebase Crashlytics): crash diagnostics from the WhatCart mobile app when it fails: device model, operating system version, app version and the technical error details, linked only to a random installation identifier and your store’s internal ID. Crash reports never include buyer data, names, email addresses or phone numbers.

Other recipients:

• Gumroad (Gumroad, Inc., United States): our reseller and merchant of record for order packs. Gumroad receives the store owner’s email and country and the pack bought and its amount, and processes the payment details in its own checkout. For the payment transaction Gumroad acts as an independent controller under its own privacy policy https://gumroad.com/privacy. Gumroad never receives buyer data.
• Payment providers the merchant connects (Paymob, Stripe): the merchant has its own agreement with them, and they act for the merchant or under their own terms. When the merchant turns on online payment, we send them, on the merchant’s instructions, the amount and the buyer details needed for the payment.
• Carriers the merchant connects (such as Bosta, Aramex, SMSA Express, iMile, Yurtiçi Kargo or Wakilni): the merchant has its own account and agreement with each carrier. When the merchant books a parcel, we send that carrier, on the merchant’s instructions, the buyer’s name, phone number and delivery address and the parcel details (such as its contents, weight and the amount to collect on delivery), and we receive its tracking number and status updates. Orders delivered by the merchant’s own riders or picked up at the store are not sent to any carrier.
• Google Maps: when a buyer sends a Google Maps short link, our server opens the link at Google to read the location in it.
• Authorities, courts and advisers, when the law or a court order requires it, or when needed to establish, exercise or defend legal claims or protect our rights and users’ safety.
• A successor, if the WhatCart business is transferred to another person or business, or is reorganised, merged or sold; this policy continues to apply to the data.

7. International transfers

We are based in Egypt, our servers are in France, and some of our service providers (such as Meta, Cloudflare, Resend and Google) process data in the United States and other countries. Your data is therefore transferred outside your country. Gumroad processes order pack purchases in the United States.

We protect these transfers with the safeguards the applicable law recognises: adequacy decisions where they exist; standard contractual clauses in our agreements with service providers (for example the EU standard contractual clauses in their data processing terms, and the standard contracts published by Saudi Arabia’s SDAIA and Türkiye’s Personal Data Protection Authority); licences, permits or notifications to the regulator where the law requires them (such as the cross-border transfer licence of Egypt’s Personal Data Protection Center); and, where no other basis is available, your explicit consent after telling you the risks. Section 12 gives the details for each country.

You can ask privacy@whatcart.net for more information about the safeguards for a particular transfer.

8. Cookies, local storage and third-party content

• whatcart.net: no cookies, no analytics and no tracking or advertising tools; fonts are served from our own server. Sign-up buttons carry campaign parameters (such as utm_source) to the app, which records them with the new store as its sign-up source.
• app.whatcart.net: one strictly necessary, httpOnly cookie (whatcart_refresh) keeps you signed in; it lasts up to 30 days and is limited to the sign-in address. The app also uses your browser’s local storage for your session, basic profile and preferences such as language and theme, and session storage for the sign-up source and unsaved order drafts.
• The app’s fonts are served from our own server. The Facebook SDK loads only on the WhatsApp connection screen. Buying a pack takes you to Gumroad’s checkout; external services process the data they receive under their own policies.
• Mobile apps: sign-in tokens are kept in the device’s secure storage. The apps contain no analytics or advertising SDKs.

9. Retention

• Merchant account: while it is open. When you delete your account in the app, it is closed at once: sessions, passkeys and pending links are deleted, and your name and email are replaced with “Deleted user” on the records the store keeps.
• Store data (products, orders, customers, conversations, settings): while the store uses WhatCart. When a store is deleted, its data and files are deleted at once, apart from the items below that say otherwise.
• A store with no activity for 12 months (no sign-in or use of the app, no order and no unused paid credits) is deleted with all its data. We notify the owner 30, 7 and 1 day before, and any activity cancels the deletion.
• Buyer message text: kept while the store uses WhatCart, unless the merchant sets an automatic removal period (7 days to 10 years) in Settings → Privacy and limits. The merchant can also delete a buyer’s personal data at any time from the buyer’s customer page (Privacy requests).
• WhatsApp media (images, voice notes, documents): deleted automatically after the period the merchant sets, 12 months by default (1 to 120 months). This does not apply to product images or files the merchant keeps as transfer proof.
• Owner test orders: deleted automatically after 7 days. Delivery proof photos: deleted after 90 days.
• Audit log: 12 months, including after a store is deleted.
• Server logs and copies of event notifications from Meta, Gumroad and payment providers: up to 12 months, for operations, security and to investigate problems.
• Backups: backup copies are kept for no longer than 12 months, and deleted data leaves them as they expire.
• Business phone numbers: when a store signs up with, saves or connects a business phone number, we record a one-way hash (SHA-256) of that number for the store. After the store is deleted we keep only this hash, not the number, with the date and the store reference, so the same number cannot start repeated free trials. Because phone numbers can be guessed and hashed one by one, we treat the hash as personal data and protect it accordingly; support can release a number after checking who owns it.
• A short deletion record (the store reference, the dates and the historical payment-provider references) is kept after a store is deleted, for as long as billing, tax or legal claims about it can arise.
• Order pack purchases (the Gumroad sale ID and order number, amount, currency, country, payment status, and the buyer’s email): kept for as long as tax and accounting law requires, including after the store is deleted, then deleted.
• Product-usage milestones: kept with the store’s data and deleted with it.
• Records the law requires us to keep, such as financial records, are kept for the period the law sets.

Full data deletion instructions: https://whatcart.net/data-deletion

10. Security

• Encryption in transit (HTTPS/TLS) for all connections.
• Meta tokens and other secrets encrypted at rest; passwords, refresh tokens and emailed links stored only as hashes.
• Each store’s data isolated from other stores.
• Role-based permissions for team members, and step-up verification before sensitive actions such as connecting WhatsApp, exporting store data or deleting an account.
• Our own support staff can open a store only for a recorded reason, and every such access is logged.
• Audit logging of sensitive actions.

No system is perfectly secure, but we work continuously to protect data. If a personal data breach happens, we notify the merchants concerned without undue delay and within 48 hours, and we notify the authorities and the people affected within the deadlines the applicable law sets (for example 72 hours to the regulator in several of the countries in section 12).

11. Your rights

Depending on the law that applies to you (section 12), you have the right to:

• Be informed about how your data is used, and access your data and get a copy.
• Correct inaccurate or incomplete data.
• Have your data deleted or destroyed.
• Object to or restrict processing, including direct marketing.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting processing done before.

Merchants can do much of this themselves: correct account and store details in the app, download the store’s data in Settings → Export store data, and delete their account in Settings → Your account. For anything else, email privacy@whatcart.net or write to the address in section 1. We reply free of charge within 6 working days and complete requests within 30 days at the latest, or sooner where your local law sets a shorter period (section 12). We may ask you to confirm your identity first, and we tell you the reason if we cannot meet a request in full.

If you are a buyer, contact the merchant you bought from first: they are responsible for your data, and we help them carry out your request. If you email us, we forward your request to the merchant and tell you that we have done so.

If you are not satisfied with our answer, you can complain to the data protection authority of your country (section 12).

12. Country-specific information

This section adds what each country’s law requires. Where a law gives you more protection than the rest of this policy, that law applies.

Egypt: the Personal Data Protection Law No. 151 of 2020 and its Executive Regulations (Minister of Communications and Information Technology Decree No. 816 of 2025) apply to all our processing, because WhatCart is operated from Egypt. Our data protection officer can be reached at privacy@whatcart.net. You have the rights to know about, access, correct, delete and restrict your data, to withdraw consent, to object, and to be told of a breach affecting you; we reply to requests within 6 working days. Transfers abroad (section 7) need a licence from the Personal Data Protection Center, and we make them only as that licence allows. You can complain to the Personal Data Protection Center (PDPC): https://www.pdpc.gov.eg

Saudi Arabia: the Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, amended by Royal Decree M/148 of 5/9/1444H), its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom apply to the data of people living in the Kingdom. You have the rights to be informed, to access and get a copy of your data, to correct it and to have it destroyed; we answer within 30 days, which can be extended once by up to 30 days if we tell you why. Transfers outside the Kingdom use the standard contractual clauses published by SDAIA, with the transfer risk assessment the regulation requires. You can complain to the Saudi Data & AI Authority (SDAIA) within 90 days: https://sdaia.gov.sa

United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies to the data of people living or working in the UAE, outside the free zones that have their own data protection laws (such as the DIFC and ADGM); its executive regulations have not yet been issued. You have the rights to information, access, correction, erasure, restriction, portability and objection, including to direct marketing. Transfers rely on the adequate protection of the receiving country’s law or on contractual safeguards. You can complain to the UAE Data Office.

Qatar: Law No. 13 of 2016 on the Protection of Personal Data Privacy applies to the data of people in Qatar. You have the rights to access, correct and erase your data, to object and to withdraw consent; we answer within 30 days. Electronic direct marketing needs your prior consent. You can complain to the National Cyber Security Agency (NCSA), which supervises the law: https://ncsa.gov.qa

Kuwait: Kuwait has no general data protection law. The Data Privacy Protection Regulation of the Communication and Information Technology Regulatory Authority (CITRA Decision No. 26 of 2024) applies to CITRA-licensed providers, and the Electronic Transactions Law No. 20 of 2014 protects personal data held electronically. We apply this policy and its rights to people in Kuwait. CITRA: https://www.citra.gov.kw

Bahrain: the Personal Data Protection Law No. 30 of 2018 applies to the data of people in Bahrain. We answer access requests within 15 working days and objections to direct marketing within 10 working days. France, the United States and Egypt are on the Authority’s list of countries with adequate protection (Order No. 42 of 2022). You can complain to the Personal Data Protection Authority: https://www.pdp.gov.bh

Oman: the Personal Data Protection Law (Royal Decree No. 6 of 2022) and its Executive Regulation (Ministerial Decision No. 34 of 2024) apply to the data of people in Oman. You have the rights to withdraw consent, to correct or update your data, to get a copy of it, to transfer it and to have it erased; we answer within 30 days (the law allows 45). Marketing messages need your prior consent. Transfers are made only where the recipient protects data at least as well as Omani law requires. You can complain to the Ministry of Transport, Communications and Information Technology: https://www.mtcit.gov.om

Jordan: the Personal Data Protection Law No. 24 of 2023 applies to the data of people in Jordan. You have the rights to be informed, to access, correct and erase your data, to restrict processing, to object (including to profiling), to portability, to withdraw consent, and to be told of a breach. Transfers abroad are made only to recipients that protect data at least as well as Jordanian law, or with your consent after being told of any lower protection. You can complain to the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship: https://www.modee.gov.jo

Türkiye (KVKK): Law No. 6698 on the Protection of Personal Data applies to personal data of people in Türkiye. This part is our information notice under Article 10 of that law. Where we need your explicit consent, we ask for it in a separate text, not in this notice.

• Data controller: for merchant account data, Bit Techs, 18 Health Street, Ain Shams, Cairo 11728, Egypt. For buyer data the merchant is the data controller, and we process it on the merchant’s behalf as data processor. Contact: privacy@whatcart.net.
• Purposes and legal bases (Article 5): providing the service and concluding and performing our contract with the merchant (5/2-c), meeting our legal obligations (5/2-ç), establishing, exercising or defending a right (5/2-e), our legitimate interests in security, fraud prevention and improving the service (5/2-f), and explicit consent where the law requires it.
• Method of collection: electronically and by automated means, through the website, the merchant app, the mobile apps and the WhatsApp Business Platform.
• Recipients and transfers abroad (Articles 8 and 9): the service providers and other recipients in section 6. Our servers and several of our service providers are outside Türkiye. We transfer personal data abroad on the basis of the standard contracts published by the Personal Data Protection Authority, notified to the Authority within five business days of signing, or on another appropriate safeguard Article 9 allows; explicit consent is used only for occasional transfers.
• Your rights (Article 11): to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether it is used for that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to ask for incomplete or inaccurate data to be corrected; to ask for deletion or destruction under Article 7; to ask for those corrections and deletions to be notified to the third parties who received the data; to object to a result against you that arises solely from automated analysis; and to claim compensation for damage caused by unlawful processing.
• Applications: send your request in Turkish or English to privacy@whatcart.net from the email address registered with us, or in writing to the address above. We conclude it free of charge within 30 days at the latest. If we reject it, our answer is not satisfactory or we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of our answer, or within 60 days of your application: https://www.kvkk.gov.tr

Lebanon: Law No. 81 of 2018 on Electronic Transactions and Personal Data applies to personal data processed in Lebanon. You have the rights to access your data and get a copy, to have inaccurate data corrected or deleted, and to object, including to commercial promotion. We correct or delete data free of charge within 10 days of a valid request. Lebanon has no independent data protection authority: the Ministry of Economy and Trade handles declarations under the law, and you can also go to the courts.

European Union: our servers are in France, and our hosting provider is subject to the EU General Data Protection Regulation (GDPR) as our processor. We are not established in the EU and do not offer our service to people in the EU, so the GDPR does not generally apply to our own processing. If it does apply to you, you have the GDPR rights listed in section 11 and can complain to your EU data protection authority.

13. Children

WhatCart is for businesses and is not directed to anyone under 18; merchant accounts are for adults only. We do not knowingly collect children’s data for our own purposes. Merchants must not use WhatCart to send marketing to children and must follow their local rules on minors’ data.

14. Changes to this policy

We post any update on this page and change the “last updated” date. For material changes, we tell merchants by email or in the app before they take effect.

15. Contact

Privacy and data requests: privacy@whatcart.net. Support, billing and general questions: support@whatcart.net.

WhatCart is operated by Bit Techs, 18 Health Street, Ain Shams, Cairo 11728, Egypt.