1. Who this covers
Bunyawi makes three products, and it matters which kind of person you are.
- Merchants — businesses that use Bunyawi Apps (a Shopify app that builds their mobile apps) or Tarteeb (our order-operations panel at ops.bunyawi.com). We are the data controller for what we hold about you as our customer: your account, your settings and our security records.
- Merchants' staff — people a merchant adds to Tarteeb as team members, or as dispatch accounts for the Tasleem app. The merchant decides who has an account; we hold those accounts to provide the service to the merchant and to keep it secure.
- Shoppers — people who download a merchant's Bunyawi app and buy from it. For that data the merchant is the controller and we are their processor.
- A merchant's customers whose orders Tarteeb handles — again the merchant is the controller and we are their processor. We only ever handle that data on the merchant's instructions, and if they leave us it goes with them.
2. Bunyawi Apps: what we collect from merchants
- Your Shopify store domain, store name, plan, country, currency and timezone — read from Shopify when you install.
- Your contact email and, if you give it, a WhatsApp number for support.
- The app you design: colours, logo, home sections, tabs, strings, push campaigns.
- Credentials you upload so we can publish on your behalf: your App Store Connect API key, your Google Play service-account key, your Apple push key. These are encrypted at rest with AES-256-GCM, are never shown back to you or to anyone else, are never written to a log, and are deleted when you uninstall or when you revoke them — whichever comes first.
- An audit trail of changes made in the dashboard: who changed what, and when.
3. Bunyawi Apps: what the merchant's app collects from shoppers
On the merchant's behalf, and only to make their store work:
- An anonymous account identifier created on first launch, so a cart survives closing the app.
- Name, phone, email and delivery address — only when the shopper types them into an order.
- Order history and delivery status, so the shopper can track a parcel.
- A push notification token, so order updates can be delivered. It is deleted when the app is uninstalled or the token stops working.
- Crash reports (Google Firebase Crashlytics) and usage statistics (Google Analytics for Firebase), so a broken screen is noticed before customers report it: screens opened, products viewed, cart and checkout steps, searches, the number and value of an order, the payment method, the answer to the notification prompt, the sign-in method and the app language, with a random app-instance identifier, the device model and system, and an approximate location (city or country) that Google works out from the IP address.
- A security record of every time order or account data is read through the app: the account identifier (or "guest"), the IP address, the order number asked for and the time. The merchant can see this record in their dashboard. It is kept 365 days and is there to detect misuse.
We do not collect precise location, contacts, photos, microphone or advertising identifiers, and we do not sell, rent or share any of it with advertisers or data brokers. Payment card details are handled by the payment provider and never reach our servers.
4. Tarteeb and Tasleem: what we process
- Merchant accounts. Business name; usernames, names, email addresses and phone numbers of the people with accounts; password hashes (Argon2id — we never see or store a password itself); sign-in history with IP address and browser or device; and an audit log of sign-ins, settings changes, team changes and similar actions.
- The merchant's customers' orders, read from Shopify — through the Tarteeb app for Shopify, or through a connection the merchant sets up. Customer name, phone numbers, e-mail address and delivery address; the items, including options and any custom names or notes on them; totals, payment method and order notes. Abandoned checkouts are read for the one WhatsApp reminder a customer who left a checkout may get, once the merchant's WhatsApp is connected; the merchant can switch it off.
- WhatsApp conversations. What a customer writes to the merchant's WhatsApp Business number, and the replies, shown in the Messages inbox; media are fetched from Meta only when someone opens them.
- WhatsApp. The messages Tarteeb sends to customers from the merchant's own WhatsApp Business number, their delivery status and the customer's reply to the confirmation buttons; and the messages it posts to the courier's WhatsApp group from the spare number the merchant links.
- Couriers. Tracking numbers, statuses, labels, pickups and claims with Fincart or Bosta, when the merchant connects them.
- Bosta complaints by email, only if the merchant ships with Bosta directly and switches this on: Tarteeb works in the merchant's own Gmail account, only for the complaint emails exchanged with Bosta.
- Tasleem. For each phone: device name, system, app version, an install identifier and IP address; the scans made with it and the photos taken of returns.
- The Tarteeb Print Helper. The shop computer's name, system and helper version, the names of its printers, and the label and packing-slip files it prints. The files are deleted from the computer after printing.
- Credentials the merchant gives us — Shopify, Fincart, Bosta and WhatsApp keys and tokens. They are encrypted at rest with AES-256-GCM, never shown back in full (at most the last four characters), and never written to a log.
5. Why we process it
- To provide the service the merchant set up: syncing orders, fixing addresses, sending the WhatsApp messages the merchant switched on, booking and tracking parcels, printing, dispatch and returns.
- In particular, the Shopify customer data Tarteeb reads — name, address, phone and e-mail — is used for two things only: delivering the order through the merchant's courier (the courier needs the name, address and phone on the booking and the label) and confirming the order with the customer and telling them how its delivery goes (WhatsApp messages to that phone from the merchant's own WhatsApp Business number, once the merchant connects it; each kind of message can be switched off). The e-mail is kept on the order so the merchant can find it, and so a Shopify privacy request reaches every order of that customer.
- To keep accounts and data secure and to prevent abuse: sign-in codes, rate limits, device approval and audit logs.
- To answer the merchant when they ask us for help.
- To meet legal obligations.
We do not sell any of it, rent it or use it for advertising, and we do not use a merchant's customers' data for any purpose of our own.
6. Where it is stored
Merchant, shopper and order records live in PostgreSQL databases on our own server in Frankfurt, Germany (European Union). Tarteeb has its own database, separate from Bunyawi Apps'. The databases are reachable only from that server, never from the internet, and each merchant's rows are isolated with row-level security. Push delivery goes through Google Firebase Cloud Messaging for Android and, for iOS, directly to Apple Push Notification service once the merchant has uploaded their Apple push key (through Firebase Cloud Messaging until then). Product and order data also lives in the merchant's own Shopify store, under Shopify's terms. Build artefacts live with our CI provider and are deleted on a rolling 30-day schedule.
Tasleem keeps its sign-in in the phone's secure storage (the Keychain on iPhone, the Keystore on Android). The Print Helper keeps its pairing token on the shop computer, readable only by the computer user who paired it.
7. How long we keep it
Bunyawi Apps
- Orders: for as long as the app is installed — they are the merchant's tax and commercial records.
- A shopper's name, email and phone: erased from their orders when Shopify sends
customers/redact, or when the shopper deletes their account in the app. - Raw webhook payloads: 90 days.
- Abandoned app carts: 30 days.
- Checkout requests: 90 days.
- Audit and access logs: 365 days.
- Encrypted database backups: 14 days.
- After you uninstall: everything for your store is deleted 30 days after uninstall — or immediately when Shopify sends
shop/redact. Your uploaded credentials are deleted immediately on uninstall, not after 30 days. - On a deletion request: within 30 days, as Shopify's privacy requirements oblige us.
Tarteeb and Tasleem
- Sign-in and verification codes: 1 day.
- Expired sessions and device tokens: 30 days.
- Raw webhook payloads from Shopify, the couriers and Meta: 90 days.
- Label and packing-slip files, and return photos: 30 days.
- Audit log: 1 year.
- Orders and everything attached to them: for as long as the business account exists; deleted within 30 days after the business is deleted.
- WhatsApp conversations in the Messages inbox: 90 days; media opened there are kept 30 days.
- A customer's personal data after Shopify sends
customers/redact: erased at once — name, phones, e-mail and street address are removed from their orders, courier copies, WhatsApp records, labels and packing slips; the order number, amounts and delivery status stay for the merchant's accounts. - After the Tarteeb app is uninstalled: its Shopify access is deleted at once and billing stops. When Shopify sends
shop/redact(48 hours later) the store's orders and Shopify data are erased, except orders whose parcel is still with a courier, which are erased as soon as that parcel is delivered or returned (the merchant still needs to collect it and its cash on delivery). A merchant who went back to their own Shopify connection keeps their orders. - A deleted person's account (a team member or a Tasleem user): sign-in disabled at once; name, username and phone deleted within 30 days. The record of which parcels they handed over stays with the business's orders.
- Encrypted database backups: 14 days.
How each of these is enforced, and everything else about where the data lives and who can reach it, is on the security and data protection page.
8. Shopify's mandatory privacy requests
Bunyawi Apps and the Tarteeb app for Shopify implement the three privacy webhooks every Shopify app must implement:
customers/data_request, customers/redact and shop/redact.
In practice: if a customer asks a merchant for their data, or asks to be erased, the request reaches
us automatically and we act on it within 30 days (an erasure in Tarteeb happens as soon as it arrives).
A merchant does not have to email us to make that happen. A merchant connected to Tarteeb in another way
forwards such a request to privacy@bunyawi.com and we answer within 30 days.
9. Deleting an account
A Tasleem user deletes their own account in the app, under Settings → Delete my account. Tarteeb owners and admins remove team members in Settings → Team, and a whole business is deleted on request from its owner. The steps, and exactly what is deleted and what is kept, are on the delete an account page.
10. Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to a particular use. Write to privacy@bunyawi.com (or support@bunyawi.com) and we will answer within 30 days. If you are in the EU or the UK you have these rights under the GDPR; we extend the same handling to everyone regardless of where they are. If you are a merchant's customer, we will pass your request to the merchant, who decides, and help them answer it.
11. Sub-processors and connected services
The third parties that necessarily see some of this data, and why:
Chosen by us
- DigitalOcean (Frankfurt) — the server that runs the APIs and the databases.
- Cloudflare — sits in front of our servers, terminates TLS, runs our DNS and forwards email sent to our addresses.
- Brevo — sends our sign-in codes and account emails.
- Google — Gmail's mail servers send those emails when Brevo cannot, and the mailbox our addresses forward to is hosted by Google.
- GitHub — code hosting and the build pipeline.
- Google Firebase — Bunyawi Apps: shopper sign-in, push delivery (Android, and iPhone until the merchant uploads an Apple push key), crash reporting and usage statistics.
- Apple — Bunyawi Apps: iOS push delivery, App Store distribution.
- Google Play — Bunyawi Apps: Android app distribution.
- Codemagic — Bunyawi Apps: builds the iOS app; sees your App Store Connect key for the duration of a build.
- Google (Gemini) — Tarteeb: when the word matcher cannot place a delivery address in a courier's area, only the address text (street lines, city, governorate) is sent to read it; and, for the "From WhatsApp" list, only the words of a customer's last few messages. Never a name, phone number, e-mail or order number.
- Telegram — Bunyawi Apps: the alert that tells our operator a store has asked to publish carries the store's name and Shopify domain. Nothing about shoppers.
Connected by the merchant — their own accounts
- Shopify — your store's products, orders and customers. You are already their customer.
- Meta Platforms — WhatsApp messages to your customers go through Meta's WhatsApp Cloud API on your own WhatsApp Business account; messages to the courier's group go through WhatsApp from the spare number you link.
- Fincart and Bosta — booking, labels, tracking, pickups and claims, only when you connect them.
- Google (Gmail) — your own Gmail account, only for Bosta complaint emails and only if you switch that on.
12. Security
Everything travels over TLS. Secrets are encrypted at rest with a key that is not stored beside them. Access to production is limited to the people who operate the platform. We will tell affected merchants within 72 hours of becoming aware of a breach that affects their data, and we will tell them what we know even when what we know is incomplete.
The full, current list of measures — hosting, encryption, accounts, access, backups, incident handling — is on the security and data protection page.
13. Changes
If this policy changes in a way that affects what we do with your data, we will email every merchant before the change takes effect rather than quietly updating the date at the top.