Privacy Policy

Last updated: 28 June 2026

This Privacy Policy explains how Sibhalna (“Sibhalna”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal data. Sibhalna is an assistant that helps small merchants in Egypt manage their social-commerce back office: replying to customer messages, recording orders, and reconciling cash-on-delivery (COD). We are committed to protecting personal data in accordance with the Egyptian Personal Data Protection Law No. 151 of 2020 (the “PDPL”) and its executive regulations.

1. Who we are (Data Controller)

Sibhalna is operated as an individual undertaking based in the Arab Republic of Egypt. For matters relating to this policy and to your personal data, you can reach us at info@sibhalna.com.

2. Our two roles

Sibhalna acts in two distinct capacities under the PDPL:

• As a Controller — for the personal data of the merchants who create a Sibhalna account (our direct users). We decide why and how that data is processed.
• As a Processor — for the personal data of a merchant’s own end-customers that flows through connected messaging channels. We process that data on behalf of, and under the instructions of, the merchant, who is the controller of their customers’ data. If you are an end-customer, please also refer to the privacy notice of the shop you contacted.

3. Personal data we collect

a. Merchant account data. When you register and use Sibhalna we collect your name, email address, phone number, shop/business name and profile, your chosen plan, and a securely hashed password. We never store your password in readable form.

b. End-customer data (processed for merchants). When a merchant connects a channel, we process the data needed to operate their store: customer name or handle, phone number, the content of messages exchanged with the shop, order and product details, delivery address and governorate, and COD amounts owed and collected.

c. Data from Meta Platforms. When a merchant connects an Instagram, Facebook Messenger, or WhatsApp Business account through Meta, we receive data from Meta’s APIs strictly to deliver the service, including: the connected account / page / phone-number identifiers, incoming and outgoing messages and their metadata (sender identifier, timestamps, message IDs), basic public profile information of the person messaging the shop (such as name or username and profile picture), and advertising referral data when a person reaches the shop by tapping a Click-to-Message ad.

d. Technical data. A signed session cookie to keep merchants logged in, plus server logs (such as IP address, timestamps, and error diagnostics) used for security and to operate the service.

4. How and why we use personal data

We process personal data for the following purposes:

• To create and secure merchant accounts and authenticate logins.
• To receive customer messages, generate replies, and record conversations.
• To capture and store orders and to calculate delivery fees.
• To meter conversations for accurate, transparent billing of your plan.
• To arrange shipping and reconcile cash-on-delivery with delivery partners.
• To provide customer support, prevent fraud and abuse, and keep the service secure.
• To comply with legal obligations under the PDPL and other applicable laws.

Legal bases (PDPL). We rely on: your consent (which you may withdraw at any time); the necessity of processing to perform our contract with you; our legitimate interests in operating and securing the service; and compliance with legal obligations.

5. Use of Meta Platform data

Our use of information received from Meta APIs (Instagram, Messenger, and WhatsApp Business) follows the Meta Platform Terms and Developer Policies. Specifically:

• We use Meta data only to provide and improve the features you connected it for.
• We do not sell Meta data, and we do not use it for advertising or to build profiles for advertising.
• We share it only with the sub-processors listed below that are necessary to run the service, and only as described in this policy.
• You can disconnect a Meta channel at any time from your Sibhalna settings, which stops further processing of that channel’s data. You may also request deletion as described in the Data Deletion section.

6. Sharing and sub-processors

We do not sell personal data. We share it only with service providers that help us run Sibhalna, each bound to protect it and to use it only for our instructions:

• Supabase — managed PostgreSQL database hosting (data stored in the European Union, Frankfurt region).
• Vercel — application hosting and content delivery.
• Resend — transactional and account email delivery and receipt.
• Meta Platforms — to send and receive messages on the channels you connect.
• Delivery partners (e.g. Bosta) — to fulfil shipping and reconcile COD; we share the recipient name, phone number, delivery address, and COD amount needed to deliver an order.

We may also disclose data where required by law, court order, or a lawful request from a competent Egyptian authority, and to protect our rights, users, or the public.

7. International data transfers

Some of our service providers store or process data outside Egypt (for example, Supabase in the European Union, and Vercel and Resend, which operate internationally). Where personal data is transferred across borders, we do so only in line with the cross-border transfer conditions of the PDPL — relying on your consent and/or contractual safeguards that require a level of protection no less than that provided under Egyptian law.

8. Data retention

We keep personal data only for as long as needed for the purposes above: for the life of your account and as required to provide the service, and thereafter for any period required to meet legal, accounting, or dispute-resolution obligations. When data is no longer needed, we delete or irreversibly anonymise it. A merchant may request deletion of their account and the end-customer data they control at any time.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, hashing of passwords, strict tenant isolation so each shop’s data is separated, access controls, and storage of channel credentials in a dedicated secret store rather than in our database. No method of transmission or storage is perfectly secure, but we work to protect personal data and to respond promptly to incidents.

Breach notification. In the event of a personal-data breach that meets the legal threshold, we will notify the Personal Data Protection Center and affected individuals in accordance with the timelines required by the PDPL.

10. Your rights under the PDPL

Subject to the conditions in the law, you have the right to:

• Be informed about, and access, the personal data we hold about you.
• Correct, update, or complete inaccurate or incomplete data.
• Request erasure of your personal data.
• Withdraw consent previously given, without affecting prior lawful processing.
• Object to or restrict certain processing.
• Know whether your data has been disclosed, and to whom.

To exercise any of these rights, email info@sibhalna.com. We will respond within the period required by law. You also have the right to lodge a complaint with the Egyptian Personal Data Protection Center.

11. Data deletion

End-customers: if you messaged a shop that uses Sibhalna and want your data deleted, you can contact that shop directly, or email us at info@sibhalna.com with the channel and account you used, and we will delete the personal data we hold about you (acting on the relevant merchant’s behalf) unless we are required to retain it by law.

Merchants: you can disconnect any Meta channel from your settings at any time, and you can request deletion of your account and associated data by emailing us at the address above.

To request deletion of data obtained via Meta Platforms, send a request to info@sibhalna.com with the subject “Data Deletion Request”. We will confirm and complete the deletion within the period required by applicable law.

12. Children

Sibhalna is a business tool intended for use by adults (18 years or older). We do not knowingly collect personal data from children. If you believe a child’s data has reached us, please contact us so we can delete it.

13. Cookies and sessions

We use a single, essential signed session cookie to keep merchants securely logged in. We do not use advertising or third-party tracking cookies.

14. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, where changes are material, take reasonable steps to notify account holders. The current version is always available at https://sibhalna.vercel.app/privacy.

15. Governing law and supervisory authority

This policy and our processing of personal data are governed by the laws of the Arab Republic of Egypt, in particular the Personal Data Protection Law No. 151 of 2020. The competent supervisory authority is the Personal Data Protection Center, affiliated with the Ministry of Communications and Information Technology.

16. Contact us

For any question, request, or complaint about this policy or your personal data, contact us at info@sibhalna.com.