Privacy policy

• Merchant accounts and this website: Devya decides how this data is used and is responsible for it.

• Customers of a store: the store’s merchant is responsible for its customers’ data. Devya processes it on the merchant’s behalf and on their instructions, to run their store. If you shop in a store, read that store’s privacy policy and contact the store first about your data.

We handle personal data in line with the data protection laws that apply, including Egypt’s Personal Data Protection Law (Law No. 151 of 2020) where it applies.

• Account: name, email address, phone number if you add it, language and display preferences. Your password is stored only as a one-way hash.

• Store: store name and address, country, currency, logo, contact details, tax registration numbers, and the bank details you enter for customers who pay by transfer. The keys you give us for payment providers and couriers are stored encrypted.

• Billing: your plan, invoices and payment references.

• Security and use: sign-in times, IP address, browser and device type, active sessions, and a record of important actions taken in the back office.

• Messages you send us.

When someone shops in a store, Moving Stores processes for that store:

• name, phone number, email address and delivery addresses;

• orders: what was bought, prices, delivery, status and history;

• how an order was paid and whether it was paid. Card details are entered on the payment provider’s own page or form; Moving Stores does not receive or store full card numbers;

• the customer account, if one is created: a password stored as a one-way hash, or one-time codes sent by email;

• marketing choices, reviews, contact messages and return requests;

• IP address and browser type, used for security and to limit abuse.

• To provide the service: create accounts and stores, show storefronts, take and process orders on the merchant’s instructions.

• To send service emails, such as email confirmation, password resets, staff invitations, order updates and invoices.

• To bill paid plans.

• To keep the service secure: detect abuse and fraud, limit repeated attempts, and investigate incidents.

• To give support and to improve the service, using aggregated information where we can.

• To meet our legal obligations.

We use data because we need it to provide the service you signed up for, because we have a legitimate interest in keeping it secure and working, because the law requires it, or, where needed, because you agreed. We do not sell personal data, and we do not use a store’s customers’ data for Devya’s own marketing.

This website uses only the cookies it needs to work: one that keeps you signed in and one that remembers your language. Stores use similar cookies for a customer’s session, cart and language, and one that remembers the customer’s cookie choice. If a merchant adds analytics or advertising tags, such as Google Analytics or the Meta Pixel, to their store, they load only after the customer agrees in the store’s cookie banner.

We share personal data only with providers who help us run Moving Stores, only as much as each one needs:

• Hosting: Contabo GmbH runs the servers in Germany that hold the platform, its database, files and backups.

• Email: Resend (Resend, Inc., United States) delivers the emails the platform and the stores send. It receives the recipient’s address and the message.

• Payment provider (Paymob) receives what it needs to take a payment, when a merchant turns it on.

• Couriers (Bosta) receive the name, phone number, address and parcel details of a delivery, when a merchant uses them.

• Drinki POS, Devya’s point-of-sale product, receives a store’s orders when the merchant connects it.

• Maps: when you place a branch on a map in the back office, the map images load from OpenStreetMap and CARTO, which see your IP address.

We may also disclose data when the law or a competent authority requires it, or to protect the rights and safety of our users and the public. If Devya’s business is ever transferred, the data would pass to the new owner under this policy, and we would tell you.

Our servers are in Germany, and some providers, such as our email provider, work in other countries, including the United States. When data leaves your country, we use providers that protect it and take the steps the law requires for such transfers.

Every connection uses encryption (HTTPS). Passwords are stored as one-way hashes, provider keys are encrypted, each store can reach only its own data, staff access follows the roles the merchant sets, important actions are logged, and backups are copied to a separate server. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

• We keep account and store data while the account or store is open.

• When a store or an account is closed, we delete or anonymise its personal data once we no longer need it for the purposes above, unless the law requires us to keep it longer, for example invoices and accounting records.

• A merchant can export a customer’s data or anonymise a customer at any time from the back office.

• Sign-in sessions end after a period without activity, and when you sign out.

• Backups are kept for a limited time and then deleted in rotation.

Depending on the law that applies to you, you can ask to see the personal data we hold about you, to correct it, to delete it, to receive a copy, to object to or restrict its use, and to withdraw a consent you gave. Merchants can change most of their account details themselves in the back office.

Write to hello@devya.dev. We may need to confirm who you are first, and we answer within the time the law sets. If you are a store’s customer, contact the store first; we help merchants answer such requests. You may also complain to the data protection authority in your country; in Egypt, that is the Personal Data Protection Center.

Moving Stores is a service for businesses and is not meant for children. Merchant accounts are for adults only.

We may update this policy. The new version is published on this page with a new date at the top, and if a change is significant we tell merchants by email or in the back office before it applies.

Questions or requests about privacy: hello@devya.dev.