Privacy Policy

This Privacy Policy explains how Insta Checkout LLC ("Insta Checkout", "we", "us") collects, uses, shares, and protects personal information when you use our service as a seller or as a customer paying through a payment link, or when you visit our website. We take privacy seriously. We collect only the data we need to run the service, we keep it as long as it remains useful or as required by Egyptian law, and we never sell it. This policy is written to be aligned with Egypt's Personal Data Protection Law (Law No. 151 of 2020) and with international privacy norms.

We collect different categories of data depending on how you interact with the service. Seller data — when you create a seller account we collect your business name, business category, full name, email address, WhatsApp number, the InstaPay handle you publish on your payment links, and any branding assets you upload (logo, cover image). Customer data — when a customer pays through one of your payment links we collect the customer's name, phone number, email address (if provided), the payment screenshot they upload, the transaction amount, the product purchased, and basic device metadata necessary for fraud prevention. Website visitors — when you simply browse our marketing pages we collect standard server logs (IP address, user agent, page viewed, timestamp) and basic analytics events. We do not collect or store full card numbers, CVV codes, banking credentials, or any data that would let us initiate a payment on a customer's behalf.

We use the data we collect to: (a) provide the service — create accounts, render payment links, deliver email notifications, generate invoices and receipts; (b) prevent fraud and abuse — rate-limit submissions, detect duplicate or suspicious activity, comply with payment-partner rules; (c) communicate — send transactional emails about your account, your payment links, and your subscriptions, and occasionally product updates that we believe will be useful to you; (d) improve the service — analyse anonymised usage patterns to find pain points and ship better features; (e) comply with law — respond to lawful requests from Egyptian authorities and meet our own legal and tax obligations.

We share data with the following categories of third parties only as necessary to operate the service: • Google / Firebase Authentication — sign-in and identity management. • Firebase Storage — hosting for branding assets and payment screenshots. • MongoDB Atlas — primary database hosting. • Vercel — hosting for our web applications. • Railway — hosting for our backend services. • Resend — transactional email delivery. We pass each provider only the data they need to perform their function, under contracts that require them to keep the data confidential and secure. We also share data when we are legally required to (a court order or a binding request from an Egyptian regulator), when needed to protect rights or safety, or in connection with a business transaction such as a merger or acquisition (in which case we will give you advance notice and respect the choices in this policy).

We keep seller account data for as long as the account is active, and for a reasonable period after closure to handle returns, disputes, and any legal or tax obligations — typically up to seven years for financial records, in line with Egyptian commercial law. Customer data (name, phone, screenshot, transaction details) is kept for as long as the relevant seller's account is active so that the seller can serve and audit their own orders. When a seller closes their account, associated customer data is deleted or fully anonymised within 90 days unless we are required to keep it longer. Server logs and analytics data are kept for up to 12 months in identifiable form.

We use industry-standard technical and organisational measures to protect personal data, including encryption in transit (HTTPS / TLS), encrypted storage at our hosting providers, scoped access controls, audit logging, and regular review of who can access what. No system is perfectly secure. If we discover a personal-data breach that is likely to put your rights or interests at significant risk, we will notify you and, where required, the competent Egyptian authority within the timeframes set by Law No. 151 of 2020.

Subject to Egyptian law and reasonable verification of your identity, you have the right to: (a) ask what personal data we hold about you and receive a copy; (b) ask us to correct inaccurate data; (c) ask us to delete data that we no longer have a lawful basis to keep; (d) ask us to restrict or stop certain processing; (e) ask for your data in a portable, machine-readable format; (f) withdraw consent where processing is based on consent. To exercise any of these rights, contact us using the details in the Contact section below. We will respond within 30 days or sooner where required by law.

We use a small number of strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We also use privacy-respecting analytics (Vercel Analytics, Firebase Analytics) to understand how the service is being used and to fix issues; these analytics use cookies and similar identifiers and do not identify you personally. Your language preference is carried in the URL (the `?locale=` parameter), not in a cookie. We do not run advertising cookies or third-party advertising trackers on our site. You can clear or block cookies through your browser settings; doing so may break sign-in.

Insta Checkout is intended for users aged 18 and over and is not designed for or directed at children. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us and we will delete the data.

Some of the third-party providers we rely on (for example, our hosting and email-delivery providers) operate servers outside of Egypt. When personal data is transferred outside of Egypt for processing, we put contractual safeguards in place that require the provider to protect the data to a standard equivalent to Egyptian law. We will continue to review our processors to keep data residency within Egypt or its data-protection-equivalent jurisdictions where reasonably possible.

We may update this Privacy Policy to reflect changes to the service, to our third-party processors, or to applicable law. When we make a material change we will update the "Last updated" date at the top of this page and, for registered sellers, notify you by email at least 30 days before the change takes effect.

If you have a question about this Privacy Policy, want to exercise a privacy right, or wish to raise a complaint, please contact: Insta Checkout LLC Email: dev.instacheckouteg@gmail.com A dedicated privacy address (privacy@instacheckouteg.com) will replace this contact once provisioned.