Privacy Policy

1. Who we are

Mahali is an Egyptian shopping discovery service operated by Mahali, an Egyptian company with an address at 83A Wadi El Nakheel, Giza, Egypt. In this policy, "Mahali," "we," "us," and "our" refer to that operator.

Mahali helps shoppers discover and compare products from selected Egyptian local brands. Mahali is not the seller, merchant of record, payment processor, delivery provider, or returns operator. When you proceed to checkout, you leave Mahali and transact directly with the relevant merchant.

For questions or requests about this policy or your personal data, contact team@mahali.app.

2. Google Sign-In and Google user data

This section specifically explains how Mahali accesses, uses, stores, shares, and deletes data received through Google Sign-In. Mahali uses Google Sign-In only to authenticate you and support your Mahali account. Signing in is optional for general browsing and product search, but is required for account features such as cloud-synced saved products, cart data, profile management, and member features.

Google data Mahali accesses

Mahali requests only the standard Google Sign-In openid, email, and profile permissions. When you authorize Google Sign-In, Google may provide Mahali with:

• your unique Google account identifier;
• your email address and whether Google has verified it;
• your display name, given name, and family name; and
• your Google profile picture, if your account provides one.

Mahali does not request or access your Gmail messages, Google Drive files, contacts, calendar, Google Photos library, payment data, passwords, or other Google account content. Mahali does not post, modify, or delete content in your Google account or take actions on your behalf within Google services.

How Mahali uses Google data

Mahali uses this Google user data only to:

• verify your identity and sign you in securely;
• create and maintain your Mahali account and display your account identity;
• associate your saved products, cart, profile, and Mahali usage with the correct account;
• prefill your email, first name, and last name in a supported merchant checkout only after you choose to continue to that merchant; and
• provide support, prevent account abuse, and protect the security of Mahali.

How Google data is stored

Mahali stores your Google account identifier, email address, first name, and last name in its Azure Cosmos DB account system. Your authenticated session is stored in an encrypted, secure cookie with a maximum lifetime of one year. Session information may include your account identifier, name, email address, and profile picture. Mahali does not intentionally store Google OAuth access tokens or refresh tokens and does not use them to access Google services after the sign-in transaction.

How Google data is shared

Mahali does not sell Google user data. We disclose it only in these limited circumstances:

• Microsoft Azure: our contracted cloud provider processes and stores account data to host and secure Mahali.
• A merchant you select: when you actively choose to continue to checkout, Mahali may place your email, first name, and last name in the checkout link sent to that merchant so its checkout can be prefilled. Mahali does not send your Google account identifier or Google profile picture to merchants.
• Legal and security disclosures: we may disclose the minimum data necessary to comply with applicable law or a binding legal request, or to investigate fraud, abuse, or a security incident.
• Business transfer: data may transfer as part of a merger, acquisition, financing, reorganization, or sale of Mahali, subject to prior notice, legally required consent, and continued protection under this policy.

Mahali does not transfer or disclose Google user data to advertising platforms, data brokers, information resellers, or lenders. Mahali does not use Google user data for targeted, personalized, interest-based, or retargeted advertising; to determine creditworthiness; for lending; or to train generalized or non-personalized artificial intelligence or machine-learning models. A future monetization model will not change these restrictions without an updated disclosure, any consent required by law and Google policy, and compliance with the Google API Services User Data Policy.

Google data retention, deletion, and revocation

Mahali retains the Google-derived account fields described above while your Mahali account is active. You may request deletion of your Mahali account and Google-derived data at any time by emailing team@mahali.app from the email address associated with your account. After verification, we delete or anonymize the account data from active systems, subject to legal obligations, security needs, and backup cycles that ordinarily complete within 90 days.

You may also revoke Mahali's Google access from your Google Account connections. Revoking Google access prevents future Google sign-in authorization but does not automatically delete data already stored by Mahali; send us a deletion request to remove that data. Signing out removes the active Mahali session but does not delete your account.

Mahali's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

3. Other personal data we collect

Data you provide

• Profile edits: you may edit the first and last name and optional phone number saved in your Mahali profile after signing in.
• Saved and cart data: products you save, products and variants placed in your Mahali cart, quantities, and related synchronization records.
• Search inputs: words, filters, categories, brands, sizes, colors, price ranges, and other preferences used in search.
• Image-search inputs: an image you choose to upload for visual product search. Mahali processes the image to perform the requested search and sends it to Shopify's catalog search service. Mahali does not intend to retain the uploaded image after the search request is completed.
• Communications: information you send when you contact us, including the contents of your message and contact details.

Data collected through use of Mahali

• Activity and inferred interests: searches, filters, product and store views, clicks, saves, cart activity, checkout handoffs, and interests inferred from this activity.
• Device and log data: IP address, browser and device type, operating system, language, timestamps, referring pages, requested pages, approximate location derived from IP, and security or diagnostic events.
• Analytics data: interaction information collected through Microsoft Clarity, which may include page activity, clicks, scrolling, heatmaps, performance information, and session recordings. We configure analytics to understand aggregate use and improve Mahali, not to collect payment details on merchant sites.
• Browser storage: authentication cookies and local or session storage used to keep you signed in, preserve your cart and saved products, synchronize signed-in activity, remember navigation state, and maintain service security.
• Notification permission: the Android app asks for system notification permission and stores your local on/off preference. Mahali does not currently register a push token, schedule notifications, or send notifications.

Data received from others

We receive account data from Google when you choose Google sign-in, product and catalog information from Shopify and participating merchants, and service or diagnostic information from providers that operate Mahali on our behalf.

4. How and why we use personal data

We use personal data to:

• provide search, visual search, filters, saves, and cart features;
• create, authenticate, maintain, and support your account;
• prefill your optional phone number, name, and email when you choose to open a supported merchant checkout;
• personalize discovery and develop recommendations based on your searches, interests, saved products, and usage;
• prepare a merchant checkout link with your email and name when a signed-in shopper chooses to continue to checkout;
• measure usage, improve relevance and usability, test features, and understand product trends;
• secure Mahali, prevent abuse, troubleshoot errors, and enforce our Terms of Use;
• respond to requests, complaints, and legal obligations; and
• evaluate and introduce future business models, such as merchant services, sponsored placement, advertising, subscriptions, or referral arrangements, subject to appropriate notice and consent where required.

Depending on the activity and applicable Egyptian law, we process data with your consent, to provide a service you requested or take steps at your request, to comply with legal obligations, or for legitimate interests such as improving, measuring, and securing Mahali where those interests do not override your rights. Where consent is required, you may withdraw it for future processing.

5. When we share other personal data

We may share personal data with:

• Google: to provide Google sign-in, subject to Google's own terms and privacy policy.
• Shopify: to search the Shopify Global Catalog, resolve products and variants, perform image similarity search, and create links to merchant storefronts.
• Microsoft: for Azure hosting, Azure Cosmos DB account and commerce storage, and Microsoft Clarity analytics.
• Merchants: when you open a merchant page or checkout. The merchant receives information sent in the checkout link, including your email and first and last name if you are signed in, and then processes your order under its own privacy policy.
• Professional advisers and authorities: where reasonably necessary for legal advice, audits, claims, regulatory duties, lawful requests, or protection of rights and safety.
• A successor: in connection with a merger, financing, reorganization, sale, or transfer of all or part of Mahali, subject to applicable legal safeguards.

We do not currently sell personal data. If a future monetization model involves targeted advertising, paid data sharing, or another materially different use, we will update this policy and obtain any consent required by law before that use begins.

6. International storage and transfers

Mahali is based in Egypt, but service providers may process data in other countries. In particular, Mahali's Azure Cosmos DB data is currently hosted in France Central, and Google, Microsoft, Shopify, their affiliates, and their subprocessors may process data in additional locations.

We will use the approvals, contracts, consent mechanisms, security measures, and other safeguards required for cross-border transfers under Egypt's Personal Data Protection Law No. 151 of 2020 and its implementing requirements.

7. How long we keep data

• Account, profile, saved-product, and cart data is kept while your account remains active and is deleted or anonymized after a valid deletion request, subject to legal needs and backup cycles that ordinarily complete within 90 days.
• Search, activity, and inferred-interest records are ordinarily kept for up to 24 months, then deleted or aggregated so they are no longer linked to an identifiable user.
• Security and diagnostic logs are ordinarily kept for up to 12 months, or longer when needed to investigate an incident or comply with law.
• Uploaded search images are processed for the requested search and are not intentionally retained by Mahali after the request.
• Data in your browser remains until it expires, you clear it, or the application removes it.

We may retain limited records for longer where reasonably necessary to establish legal claims, resolve disputes, prevent fraud, or meet a legal obligation.

8. Your choices and rights

Subject to Egyptian law and applicable exceptions, you may ask to be informed about processing; access or obtain a copy of your data; correct inaccurate data; delete data; restrict or object to processing; withdraw consent; obtain portable data where applicable; or object to a decision based solely on automated processing that produces legal or similarly significant effects.

You can edit your name in your Mahali profile, sign out, clear browser storage through your browser, and use browser controls to limit cookies or analytics. Blocking essential storage may prevent account, save, or cart features from working correctly.

To exercise a right or request account deletion, email team@mahali.app. We may need to verify your identity before acting. You may also have the right to complain to Egypt's Personal Data Protection Center or another competent authority.

9. Automated personalization

Mahali may use your searches, views, filters, saves, cart activity, and inferred interests to rank or recommend products and stores. This personalization is intended to improve discovery and does not make decisions that produce legal or similarly significant effects. Product ranking may also reflect availability, relevance, curation, quality signals, or, if introduced in the future and clearly labelled, commercial placement.

10. Security

We use reasonable technical and organizational safeguards designed to protect personal data, including access controls, encrypted connections, restricted application interfaces, and service-provider security controls. No internet service or storage system is completely secure, so we cannot guarantee absolute security.

11. Children

Mahali may be browsed by people of all ages. Users aged 15 or older may create and use a Mahali account directly. If a child is under 15, a parent or legal guardian must authorize and supervise the child's account and use of account features.

We do not knowingly collect personal data from a child under 15 without the authorization required by Egyptian law. If you believe a child under 15 has provided personal data without appropriate authorization, contact us so we can investigate, obtain appropriate authorization where lawful, or delete the data.

12. Third-party sites

Mahali links to merchant storefronts and other third-party services. Their privacy practices apply once you interact with them. We encourage you to review each merchant's privacy, delivery, returns, and payment information before placing an order.

13. Changes to this policy

We may update this policy as Mahali, its providers, or applicable law changes. We will publish the revised policy with a new effective date and provide additional notice or request consent when legally required for a material change.