1. Overview & Commitment

Vendoshift Technologies Ltd. ("Vendoshift", "we", "our") is dedicated to protecting the privacy, confidentiality, and integrity of personal and commercial data handled through our platform. This Privacy Policy details how we collect, process, store, and safeguard information when merchants and their personnel use the Vendoshift commerce suite.

2. Categories of Information Collected

We process only the minimum information necessary to execute retail operations:

• Merchant Account Information: Name, administrative business email, contact telephone numbers, business registered name, and password hashes (stored via cryptographic argon2id/bcrypt).
• Payment & Billing Data: Transaction metadata, plan tiers, and payment status. Sensitive cardholder numbers and CVVs are handled exclusively by licensed, PCI-DSS Level 1 payment processors and are never received or stored on Vendoshift servers.
• Shopify Store & Catalog Data: Products, variants, inventory counts, barcoding records, and order line items synced via authorized Shopify OAuth access tokens (which are encrypted using AES-256).
• POS Operational Logs: Cashier IDs, branch locations, terminal shifts, and stock movement logs.

3. Purpose of Data Processing

Data gathered by Vendoshift is strictly utilized for operational execution:

• Fulfilling orders and maintaining real-time stock balances across warehouses and physical stores.
• Transmitting official digital invoices and e-receipts to the Egyptian Tax Authority (ETA) per merchant instructions.
• Processing recurring subscription invoices and issuing receipts.
• Detecting fraudulent terminal activities and upholding Zero-Trust tenant boundaries.

4. No Commercial Sale of Data

We do not sell, rent, monetize, or trade your data or your customers' data to any advertisers, data brokers, or external entities under any circumstances.

5. Architectural Security & Encryption

Our engineering adheres to the highest industry benchmarks:

• Data at Rest: Sensitive database fields (including third-party API tokens) are encrypted with AES-256-CBC.
• Data in Transit: All HTTP communications and WebSocket streams are fortified with modern TLS 1.3 / SSL encryption.
• Database Isolation: Multi-tenant isolation is enforced programmatically using Global Scopes, ensuring absolute data partitioning.

6. Shopify Partner & GDPR Compliance

Vendoshift strictly complies with the Shopify API License and Terms of Use. We support and promptly process automated GDPR webhooks including customer data retrieval requests (customers/data_request), customer erasure requests (customers/redact), and merchant store removal requests (shop/redact).

7. Merchant Rights & Data Erasure

You retain complete control over your business data. At any time, account administrators may request an export of their stored catalog data, or request permanent purge of their tenant account and records upon closing their subscription, subject to statutory tax record retention requirements.