The short version
- We collect as little as we can: from customers, a name, a mobile number and, for delivery, an address; from merchants, their account and store details.
- Order details go only to the shop you ordered from, so it can prepare and deliver your order.
- Addresses and location links are deleted 30 days after an order closes; names and numbers are masked after 90 days.
- We never sell your data or run third-party ads. Optional Google Analytics runs on Tajrova marketing pages only if you allow it; stores, orders and account pages are excluded.
- You can ask to see, correct or delete your data at any time at info@obelixagency.com.
1. Who we are
Tajrova is a platform that lets any seller run an online store with a product catalog. Customers order from it, each order is saved on the platform first, and then it is sent to the shop on WhatsApp. Tajrova is owned and operated by OBELIX Agency, 493 Abou Quer Street, Fleming, First Al Raml, Alexandria 21531, Egypt. In this policy, "we" means OBELIX Agency as the operator of Tajrova.
This policy explains how we handle personal data on the Tajrova website, on every merchant store hosted on it, and in the merchant dashboard, in line with Egypt's Personal Data Protection Law No. 151 of 2020.
2. Who is responsible for your data
- If you are a customer ordering from a store: the shop you order from has the relationship with you and decides how your order details are used (the "controller" in legal terms). We store and process that data on the shop's behalf under the rules in this policy (the "processor").
- If you are a merchant, or you visit the Tajrova website itself: we are directly responsible for your data (the "controller").
Either way, you can contact us directly about your data, and we will involve the shop where needed.
3. What we collect
From customers when they order
- Name and mobile number.
- For delivery: the delivery area, the detailed address, and a location link if you choose to share one (optional).
- Any notes you add to the order.
- Order details: items, quantities, prices, delivery fee, total, order status and times.
We don't ask you to create an account, and we never collect national ID numbers or card details. Payment happens directly between you and the shop, outside Tajrova.
From merchants
- Account details: name, the mobile number used to sign in, password (stored with one-way hashing, so it cannot be turned back into the original), dashboard language and last sign-in.
- Store details: name, link, area, the shop's WhatsApp number, description, colors, logo, cover image, products with their images and prices, and delivery areas.
- Subscription and payment details: plan, amounts, payment method, the transaction reference you enter when you pay, payment date and receipts.
- Notes the merchant writes about their customers or orders in the dashboard.
Technical data collected automatically
- Browser session: stored with your IP address and browser/device type, to run the cart, sign-in and security. Sessions are deleted automatically when they expire.
- Abuse-prevention counters (rate limiting): use your IP address or mobile number temporarily to stop fake orders and account attacks, and clear within minutes or hours.
- Usage statistics: simple store-level events (such as "the store was opened" or "an order was placed") recorded without any name, number, address, IP address or device type, so merchants can see how their store is doing and we can improve the service.
- Server logs: our hosting provider keeps standard technical logs (such as IP address and request time) for a limited period for operations and security.
Images uploaded by merchants are re-processed on the server, which strips hidden data such as the photo's location (EXIF). The original file is not kept.
4. How we use it, and why
- Fulfilling your order: saving it, showing it to the shop, opening WhatsApp with a ready message, and updating its status. Basis: performing the order you asked for, and your consent when you tap "Order".
- Running merchant accounts and stores: sign-in, managing products and orders, and showing the store to the public. Basis: performing our subscription contract with the merchant.
- Subscriptions and billing: reviewing and recording payments, issuing receipts, and keeping accounting records. Basis: the contract, and our legal and tax obligations.
- Security and abuse prevention: protecting accounts, blocking fake orders and spam, and an admin log of every sensitive action OBELIX takes. Basis: our and our users' legitimate interest in a safe service.
- Improving the service: aggregate store performance figures with no data that identifies a person.
- Contacting merchants: about their account, subscription, and important changes to the service.
We do not use customer data for our own marketing, and we do not message customers. Any message a customer receives comes from the shop itself, in a WhatsApp chat between the two of them.
6. How long we keep it
The clock starts when an order reaches a final state (completed, cancelled or expired). An order the shop doesn't confirm within 48 hours expires automatically.
| Data | Period | What happens next |
|---|---|---|
| Detailed address and location link | 30 days | Deleted; only the delivery area name is kept |
| Customer name, mobile number and notes | 90 days | Notes deleted; name reduced to its first letter, number to its last 3 digits |
| Order details (items, amounts, statuses) | As long as the store exists | Kept with no data that identifies a person, for the shop's accounts and statistics |
| Merchant account and store details | While the account is active | After a closure request we delete or mask personal data, except what the law requires us to keep |
| Payment records and receipts | As required by tax and accounting law | Deleted when the legal period ends |
| Encrypted database backups | The latest 30 daily backups | Older ones are deleted automatically, so deleted data leaves the backups within about 30 days |
Deletion runs automatically every day. You can ask for earlier deletion (see "Your rights"); we then carry it out and record it in the admin log.
8. Security
- All connections to the site are encrypted (HTTPS).
- Passwords are stored with one-way hashing, and failed sign-in attempts are limited.
- Each store is isolated from every other in every read and write, and this isolation is covered by automated tests.
- Backups are encrypted, and their key is not stored with them.
- Every sensitive action by the OBELIX team is written to a tamper-evident admin log.
No online system is 100% secure. If a breach affects your data, we will notify the Personal Data Protection Center within 72 hours of becoming aware of it, and notify you and the shop concerned within the time the law sets, together with the steps taken.
9. Where data is stored
Data is stored on servers run by our hosting provider, Hostinger. If those servers are outside Egypt, the transfer follows the conditions set by the Personal Data Protection Law, with a provider that maintains an adequate level of protection. We do not transfer data to any other party outside Egypt.
10. Your rights
Under the Personal Data Protection Law you have the right to:
- Know what data we hold about you, and get a copy.
- Correct or complete inaccurate data.
- Ask us to delete your data or restrict its use, or object to its processing.
- Withdraw your consent at any time (this doesn't affect what was done before, and may prevent an order in progress from being fulfilled).
- Be notified of a breach that affects your data.
- Complain to the Personal Data Protection Center if you believe your rights were not respected.
To use any of these rights, email info@obelixagency.com or WhatsApp +20 155 958 7700 with the store name and the mobile number you ordered with, or the order reference. We may ask you to confirm the number is yours before acting, so we never hand data to someone else. We reply within 30 days at most, free of charge.
11. Children
Tajrova is not aimed at children. A merchant account must belong to a person aged 21 or over, or to a business. If you are under 18, order with your parent's or guardian's permission. If we learn we hold a child's data without a guardian's consent, we delete it.
12. Changes to this policy
We may update this policy when the service or the law changes. The date of the last update is shown above. For significant changes we tell merchants in the dashboard or on WhatsApp at least 15 days before they take effect, and no change is applied retroactively in a way that weakens the protection of data already collected.
13. Contact us
OBELIX Agency, 493 Abou Quer Street, Fleming, First Al Raml, Alexandria 21531, Egypt.
Email: info@obelixagency.com · Mobile and WhatsApp: +20 155 958 7700.
See also our Terms and Conditions.