1. Data controller

MOUBARAK SHOP, the operator of the website and mobile app, is the controller when it decides why and how data is processed.

Médina, Rue 22 angle 27, near MKA station, Dakar, Senegal · serviceclient@moubarak.shop · +221 78 860 44 44

2. Scope

This policy covers website visitors, app users, customers, gift recipients, messaging participants, people invited from an address book, corporate-program beneficiaries and anyone contacting support. Third-party services you open separately, such as Wave, Orange Money or WhatsApp, also apply their own policies.

3. Data we may process

• Account and identity: name, phone, email, profile photo, customer ID, membership date, language, shopping universe, preferences and account status.
• Authentication and security: one-time codes, verification status, sessions, IP address, login logs, device and push identifiers, passkey public keys and metadata. Private passkey keys and biometric data remain with iOS, Android or your credential manager; we receive only the authentication result.
• Commerce and delivery: products, sizes, cart, orders, invoices, delivery address/instructions, recipient contact details, payment method, amount, status, transaction reference, refunds and delivery evidence. Payment credentials are handled by Shopify or the selected payment provider, not stored by the app.
• Personalization and loyalty: favorites, recent activity, searches, stock alerts, style preferences, voluntarily entered size, measurements, height or weight, fit profile, status, points, discounts, vouchers and gift cards.
• Gifts and corporate services: recipient details and message; company, role, work contact details, workforce, quotation request, approvers and Corporate Dress Plan information.
• Communications and content: private/group messages, support requests, reviews, ratings, reactions, reports, photobook text and moderation information.
• Media: profile photos, images or videos selected for visual search, reviews, photobook, chat or support, and voice recordings you choose to send.
• Contacts: with permission, the app reads your address book to find existing users or invite someone. Names are used locally for display; only normalized phone numbers needed for matching are sent to the contact-matching service.
• Device, use and diagnostics: device model, OS, app version, language, time zone, IP, installation identifier, viewed pages/products, clicks, searches, performance, crashes and notification interactions.
• Website and cookies: browser, device, IP, pages, referrals, cart and purchase activity, and necessary, analytics or advertising cookies according to your choices.

4. Sources and permissions

Data comes directly from you, automatically from the service, from commerce/payment/delivery/authentication partners, or from your device after the appropriate permission. You can withdraw camera, photos, microphone, contacts or notification permissions in iOS or Android settings. Refusing a permission affects only the feature that needs it.

5. Purposes and legal grounds

• create, authenticate and secure accounts, including OTP and passkeys — requested service, security and consent where required;
• process purchases, payments, delivery, returns, warranties and customer support — contract and legal duties;
• provide personalization, loyalty, recommendations, messages and community features — requested service, legitimate interests or consent depending on the feature;
• send transactional notifications and, with the required choice, promotional messages — requested service or consent;
• measure audience, improve performance and diagnose crashes — legitimate interests and consent where required;
• prevent fraud, enforce rules, respond to claims and comply with law — security, legitimate interests and legal duties.

You may withdraw consent at any time without affecting prior lawful processing. Required fields are identified; without them, we may be unable to create an account, deliver an order or provide the requested feature.

6. Artificial-intelligence features

Optional shopping assistant: the text of your messages, the photos you choose to attach and necessary product context may be sent to the OpenAI API to generate a response. Optional visual search: an image you take or select and necessary instructions may be sent to Google Cloud Vertex AI to identify product-search characteristics.

Your voice messages do not go through artificial intelligence. A voice recording sent in the assistant is neither transcribed nor sent to OpenAI: it is delivered to an advisor on our team, who listens and replies to you.

Before the first transfer of personal data to an AI provider, the app gives clear information about the provider, data and purpose and requests explicit permission. Refusal does not prevent use of other features. Only content you enter or select and strictly necessary context is sent — not your entire phone, photo library or address book. Do not include passwords, payment credentials, identity documents, health data or other highly sensitive information.

Under their business/API commitments, OpenAI does not train its models on API data by default, and Google Cloud does not use Vertex AI data to train models without permission. Limited logs may be processed for security and abuse prevention, depending on the configuration. See OpenAI Business Data and Vertex AI data retention.

AI assists search and support; it does not make decisions that alone produce legal or similarly significant effects. Generated answers can be wrong, so verify prices, availability, sizing and sales terms.

7. Recipients and service providers

Authorized MOUBARAK SHOP staff and the following necessary providers may receive relevant data:

• Shopify for storefront, catalog, cart, checkout and orders;
• Google Firebase for authentication, notifications, analytics and crash diagnostics;
• OpenAI for the optional assistant and Google Cloud Vertex AI for optional visual search;
• Twilio and telecom operators, when used, to deliver and protect login codes;
• Wave, Orange Money, Shopify Payments or the selected provider for payments and refunds;
• Meta for WhatsApp if you choose that channel and, subject to tracking/consent choices, advertising measurement and app events;
• couriers, logistics, repair, hosting, anti-abuse and technical support providers;
• professional advisers, auditors, authorities and courts where law, fraud, disputes or personal safety require it.

8. International transfers

Providers may process data outside Senegal, including in the European Union, the United States and other infrastructure locations. We use processing contracts, security measures and legally required transfer safeguards. Where Senegalese law requires it, we provide notice, obtain the required permission and complete any declaration, authorization request or other formality required by the competent authorities.

9. Retention

• Account/profile/preferences/loyalty: for the account's lifetime, then erased or disconnected after deletion, subject to legal exceptions.
• Orders, invoices and accounting evidence: for the commercial relationship and up to ten years where applicable accounting rules, including OHADA requirements, require it.
• Authentication and push data: while needed for the account/device; protected provider backups may take up to 180 days to disappear after a deletion instruction.
• Crash diagnostics: only as needed for reliability and security; Firebase Crashlytics generally indicates a 90-day retention period before deletion processing.
• Audience and use events: for the configured analysis period, targeting no more than 14 months for identifier-linked data, then aggregation or deletion.
• Messages, reviews and media: while content/conversations remain active, then deletion or disconnection on request unless moderation, safety, evidence or third-party rights require retention.
• Contact discovery: matching numbers are used only as needed to identify matches; pending invitations expire, are cancelled or are removed no later than 90 days unless required as security evidence.
• AI: MOUBARAK SHOP keeps only history needed for the selected function; providers may keep temporary security logs under their configured terms. API data is not used for model training by default.
• Fraud, claims and legal disputes: for the investigation and applicable limitation period.
• Local app data: until sign-out, app-storage clearing, account deletion or uninstall, depending on the category.

10. Security

We use risk-based safeguards including encrypted communications, access controls, secret protection, environment separation, security logs, data minimization, protected backups, session revocation, updates and incident monitoring. Passkeys use operating-system protections; MOUBARAK SHOP does not receive your fingerprint, face data or private key. No system is entirely invulnerable, so contact us immediately if you suspect unauthorized access.

11. Notifications, marketing, tracking and cookies

Order/security/requested-message notifications are separate from promotions. You can change app preferences, system notification permissions and marketing choices at any time. On iOS, App Tracking Transparency permission is requested before cross-company app/site tracking. Refusal means the advertising identifier must not be accessed for that purpose. Android, website and browser privacy controls also apply.

The website uses cookies required for sessions, cart, security, language and payment. With consent where required, analytics or advertising cookies may measure audiences and campaigns. Manage choices through the consent banner and browser. Non-essential cookie refusal does not prevent general access, although some personalization may be reduced.

12. Children

Account-based purchasing services are not directed to children who cannot legally contract on their own. Minors should use the service with a parent or legal guardian's permission and supervision. A parent or guardian may contact us to request deletion or appropriate correction where data was supplied without valid permission.

13. Your rights

Subject to Senegalese Data Protection Law No. 2008-12 and other applicable rules, you may request information, access, correction, deletion, objection, withdrawal of consent, restriction, information about sources/recipients/transfers and human review of a significant automated decision if one is ever introduced.

Email serviceclient@moubarak.shop and identify the right requested and the phone/email linked to the account. We may request minimal verification if reasonably necessary. Do not send an identity document unless requested through a secure channel. We aim to respond within 30 days. To the extent permitted by law, a request may be delayed, restricted or declined when identity cannot reasonably be verified, it exposes or compromises another person's data or rights, security, fraud prevention or trade secrets, it is manifestly abusive or repetitive, or a legal duty requires retention. We will explain the applicable reason.

To delete an account, use the in-app function or visit Account and data deletion.

14. Contact and policy updates

For any question, request or difficulty concerning your personal data or this policy, contact MOUBARAK SHOP directly at serviceclient@moubarak.shop. Our team will review the situation and reply as promptly as possible.

We may update this policy for service, provider or legal changes. The date above identifies the current version. Material changes will be announced visibly and renewed consent requested where required.