01 Scope & roles
This policy explains how Kayroo processes personal data in accordance with Algerian Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data.
For platform-user data (merchants and their staff) Kayroo is the data controller. For end-customer data that merchants collect through their stores, the merchant is the controller and Kayroo acts as a processor hosting that data on the merchant's behalf (see our Data Processing Addendum).
02 Data we collect
Account data: name, email, phone, password (hashed) and business identifiers.
Billing data: plan, invoices, payment status and proof; we do not store payment card numbers.
Usage & technical data: pages visited, actions taken, device and browser data, and hashed IP addresses kept for security and abuse prevention. We never store raw IP addresses.
Communications: messages you send us and support requests.
03 Purposes & legal basis
We process data to provide and secure the Services, authenticate you, bill subscriptions and metered usage, prevent fraud and abuse, provide support, comply with legal obligations, and improve the platform.
Processing is based on the performance of our contract with you, our legitimate interest in operating a secure service, your consent where required (e.g. marketing), and our legal obligations.
04 Sharing & sub-processors
We share data only as needed with vetted sub-processors that help us run the Services (e.g. hosting, email delivery, payment processing, delivery carriers and AI providers), all bound by confidentiality and data-protection obligations.
We do not sell your personal data. We may disclose data where required by law or to protect our rights, users or the public.
05 International transfers
Where data is hosted or processed outside Algeria, we apply safeguards consistent with Law 18-07. Some processing (e.g. cloud hosting or AI features) may occur abroad.
06 Security
We use technical and organisational measures — encryption in transit, hashed credentials and IPs, access controls and logging — to protect personal data. No system is perfectly secure; we cannot guarantee absolute security.
If a personal-data breach likely to create a risk occurs, we will act in line with our legal obligations under Law 18-07.
07 Retention
We keep account and billing data for the life of the account and for the period required by Algerian commercial and tax law, then delete or anonymise it. End-customer data is retained according to the merchant's instructions and applicable law.
08 Your rights
Under Law 18-07 you may access, rectify, or request deletion of your personal data, and object to or restrict certain processing. To exercise these rights, contact [email protected]. Where end-customer data is concerned, contact the relevant merchant (the controller).
Where required, processing is declared to the national data-protection authority (ANPDP).
09 Children
The Services are not directed to children under 18 and we do not knowingly collect their data.
10 Changes & contact
We may update this policy and will post the new version here with its date. For privacy questions, contact [email protected].