Privacy Policy

You are reading the edition written for people in Algeria. It says what the international edition says, adapted to Algerian law: mainly Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, as amended and supplemented (“Law 18-07”), and the National Authority for the Protection of Personal Data (ANPDP) it created.

In practice, this edition:

• relies on your express consent, or on another ground that Law 18-07 allows, for each use of your data (see “How we use data and on what basis”);
• lists the rights Law 18-07 gives you and how to use them, including how to complain to the ANPDP (see “Your rights under Law 18-07”);
• is available in Arabic, French and English, from the language menu.

Visitors to our website

• Your language choice, kept in a cookie for one year, and your light or dark theme choice, kept in your browser.
• If you arrive through a link that carries a referral code (?ref=…), the code is kept in your browser for 30 days and added to our sign-up links, so we can credit whoever referred you. We count the visit as an anonymous total for that code; we do not record who you are.
• Technical logs (IP address, browser type, pages requested, time) kept by our hosting provider to run and secure the website.

We do not use advertising cookies, analytics trackers or social media pixels on our website.

Merchants and team members

• Account details: your name, email address and password (kept only as a hash by our sign-in provider), a profile picture if you add one, and passkeys if you set them up (we keep only their public part).
• Store details: store name and address, logo, country, currency, language, products, pages, images and settings.
• Team: the names, email addresses and roles of the people you invite.
• Subscription and payment records: plan, amount, method (card through our payment provider, or cash declared to us), coupon used, dates and status. You enter card details on the payment provider’s page; we do not see or store them.
• Integrations you connect: delivery-company keys, advertising pixel IDs and access tokens, messaging-notification credentials, webhook addresses, and your own AI API key (kept encrypted).
• Your messages to our support team, by phone or WhatsApp.

Shoppers

• What you type into the order form: name, phone number, address, wilaya and commune, notes, and the products, options and quantity you order.
• Technical details of the order request, used to stop fake orders: IP address, browser (user agent), country derived from the request, how long the form took to fill, and whether a hidden field was filled.
• Product page views are counted as an hourly total per product, not linked to any person.

Do not send us sensitive data (health, religion, political opinions, and the like) in order notes or messages; we do not need it.

When you order from a store built on Shopispace, the merchant is responsible for your data. They decide to collect your name, phone number and address to deliver your order, and they are your first contact for any question about it. We host the store and process the data for them.

What happens to your order details:

• The merchant sees them in their dashboard. Team members see only what their role allows, and details such as phone numbers are masked for roles that do not need them.
• When the merchant sends your order for delivery, we pass your name, phone numbers, address, commune, wilaya, the amount to collect and a description of the parcel to the delivery company they chose. That company handles the data for its delivery operations.
• If the merchant turned on messaging notifications or a webhook, the new order is also sent to their messaging chat or to the address they set.
• If the merchant connected advertising pixels, the advertising platforms receive events about your visit and purchase. From our servers we send a purchase event containing your name, phone number, town and wilaya in hashed form, plus your IP address, browser and advertising identifiers. The platform’s own privacy policy then applies.

Fake-order protection. To protect merchants from bots and fake orders, we check each order for signs such as a hidden form field being filled, an impossible fill time, a made-up phone number, or repeated attempts (including earlier orders from the same phone number at the same store). When an attempt is blocked or flagged, we log its IP address, browser, country, phone number, name and the reasons for 90 days, so the merchant can recognise repeat offenders. Orders that raise no concern leave no such log. We also use your IP address to limit how many orders one device can submit within a few minutes. Some blocks are automatic; if your order was refused by mistake, contact the store.

To use your rights over order data, contact the store first. If you cannot, contact us and we will pass your request on to the merchant or help them deal with it.

We use personal data to:

• create and run your account and store, and provide the features you use (orders, delivery, notifications, AI tools, advertising pixels);
• take payment for plans and credit, and keep the records the law requires;
• protect the platform, merchants and shoppers against fraud, bots, abuse and attacks;
• support you, answer your messages, and tell you about important changes to the service;
• count referrals, so we can credit the partners and merchants who bring new stores;
• comply with the law.

Under Law 18-07, processing is based on your express consent, which you give when you create an account, place an order or tick a box where we ask, and which you can withdraw at any time. Where the law allows processing without consent, we rely on one of its other grounds: performing a contract with you or taking steps you asked for before one, complying with a legal obligation, or our legitimate interests, as long as they do not override your rights and freedoms.

We send promotional messages only with your prior consent, and each one lets you opt out. We do not sell personal data. We do not use shoppers’ data for our own marketing, and we do not build advertising profiles.

We do not sell personal data. We share it only as follows:

• Merchants receive the data of their own shoppers, and their team members see what their roles allow.
• Our service providers, who process data for us under agreements: hosting of the website and apps; the database, sign-in and file storage; card payments; the sending of account emails; and AI processing when a merchant uses AI features.
• Delivery companies, advertising platforms, messaging services and webhook receivers that a merchant chooses and connects, as described under “Shoppers on merchants’ stores”. Their own privacy policies apply to what they receive.
• Authorities and advisers, when the law requires it or to protect rights, security and property; and a buyer of our business, if we are ever acquired, in which case the same protection would continue and we would tell you.

AI features. When a merchant uses the AI description, landing-page or image tools, the text, product details and images they supply are sent to an AI service, using the merchant’s own key or, if they have none, ours. These tools are not meant for shoppers’ personal data, and we ask merchants not to include any.

Some of the providers we rely on operate outside Algeria, so the personal data of people in Algeria can be processed abroad.

Law 18-07 restricts transfers of personal data to a foreign country. We limit transfers to what the service needs.

You can object or withdraw your consent as explained under “Your rights under Law 18-07”, but some features cannot work without these providers.

• Account and store data: for as long as your account exists. When you ask us to close it, we delete or anonymise the store data within a reasonable time, except what we must keep by law.
• Orders and customer records: they belong to the merchant’s store and stay until the merchant deletes them or the store is closed.
• Fake-order protection log: 90 days, then deleted.
• Payment and invoicing records: for as long as Algerian accounting and tax law requires, even after an account is closed.
• Free-trial record: a minimal record (an internal account identifier and the plan) that stays after an account is deleted, so that a free trial cannot be taken twice.
• Referral counts: kept as totals per code and day, not per person.
• Backups: deleted data can remain in provider backups for a limited time until they rotate out.

On our website we use only what is needed to make it work. We do not use advertising or analytics cookies.

When you sign in to the dashboard, a session cookie from our sign-in provider keeps you signed in, and the dashboard remembers its language in a cookie (admin_lang, 1 year).

Stores built on Shopispace may include their merchant’s advertising pixels, which set their own cookies. The merchant is responsible for them. You can block or delete cookies in your browser settings; the website keeps working, but choices such as your language will not be remembered.

• Connections to our website and dashboard are encrypted (HTTPS).
• Passwords are kept as hashes by our sign-in provider, so we cannot read them. Passkeys are supported.
• Your AI API key is stored encrypted, and team invitation links are stored only as hashes.
• The database is reached through our servers; tables holding sensitive records are closed to direct access from a browser.
• Access to a store’s data is limited by role, and customer details are masked for roles that do not need them.
• Webhooks are signed so receivers can verify them, and public forms are rate-limited.

No online service is completely secure. Keep your password and devices safe, use a passkey if you can, and tell us at once if you suspect unauthorised access. If a breach affects your data, we will act quickly and notify you and the authorities where the law requires it.

If you are in Algeria, Law 18-07 gives you these rights over your personal data:

• To be informed of who processes your data, why, who receives it and how long it is kept. This policy is that information.
• Access: to obtain confirmation that we process your data and a copy of it, with the purposes, the recipients and any transfer abroad.
• Rectification: to have inaccurate or incomplete data corrected or updated and, where the law provides, to have data erased or blocked when its processing does not comply with the law.
• Objection: to object, for legitimate reasons, to the processing of your data, and to object without giving a reason to its use for commercial prospecting.
• Withdrawal of consent, at any time, without affecting what was done before.

How to use them. Write to us (see “Contact”), or ask the store if you are a shopper. We answer within the time limits of Law 18-07, and as quickly as we can. We may ask you to prove who you are before we share or change data. There is no self-service account deletion yet: write to us to close your account.

If you are not satisfied, you can lodge a complaint with the National Authority for the Protection of Personal Data (ANPDP) or bring the matter before the Algerian courts.

If you are a shopper, the store controls your order data, so contact it first. If you cannot, contact us and we will pass your request on or help the merchant deal with it.

Shopispace is a business tool for people who can enter into contracts: under Algerian law, people aged 19 or over. We do not offer accounts to minors and we do not knowingly collect their personal data. If you think a minor has given us data, tell us and we will delete it.

We may update this policy. The new version is posted on this page with its date. When a change is significant, for example a new purpose or a new kind of recipient, we tell merchants through the dashboard or by email before it applies, where the law requires it. Earlier versions are available on request.

Questions or requests about your data? Contact us:

• Shopispace
• Phone:+213 6 52 28 25 73
• WhatsApp
• Website:shopi.space

In Algeria, you can also contact the National Authority for the Protection of Personal Data (ANPDP) about how your data is handled.