DATA USAGE POLICY

1. TYPES OF DATA COLLECTED

When using ShopMahelso, we may collect the following categories of data:

1.1. Account data

• Name (optional)
• Email address
• Password (hashed, never stored in plain text)
• Unique user identifier

1.2. Application usage data

• Products, stock levels, sales and shops created by the user
• Configuration and application settings
• Information about employees added to the application
• Reports generated (sales, inventory, stock movements, performance)

1.3. Technical data

• Device model
• Operating system version
• Error or crash logs
• Application version

1.4. Subscription data

Depending on the payment method used:

Google Play Billing

• Product identifier
• Purchase token
• Subscription status
• Start and expiry dates

FedaPay (Mobile Money / local card)

• Transaction identifier
• Payment status
• Amount and currency
• Minimum information required to validate the payment

No full banking details (e.g. complete card number) are collected or stored by ShopMahelso.

1.5. Approximate geolocation data

Collected only in order to:

• determine the user’s country to suggest the appropriate payment method.

This data is never used to track the user’s real-time location.

1.6. Communication data

• Emails sent (support, alerts, confirmations)
• Push notifications (subscription, stock, sales)
• Technical logs related to message delivery

2. PURPOSES OF DATA USE

Data is used for the following purposes:

2.1. Application operation

• Create and manage the user account
• Display and synchronize products, stock and sales
• Manage shops and employees
• Verify and maintain the Premium subscription status
• Generate reports (sales, inventory, history, performance)

2.2. Security

• Secure authentication
• Detection of fraudulent or abnormal behaviour
• Protection of user data
• Prevention of abuse and attacks

2.3. Payments

• Verification of Google Play subscriptions
• Validation of FedaPay transactions
• Activation, renewal or suspension of subscriptions

2.4. Support & communication

• Replying to support requests
• Sending notifications related to subscriptions (reminders, expiry, important information)
• Critical alerts (stock outages, system errors)

2.5. Service improvement

• Technical analysis of app usage
• Detection and correction of bugs
• Optimisation of performance and user experience

3. LEGAL BASIS (GDPR)

Data processing carried out via ShopMahelso is based on:

• Performance of a contract: use of the application, subscription management, access to features.
• Consent: certain notifications, collection of optional technical data.
• Legitimate interest: security, continuous improvement, prevention of abuse.
• Legal obligations: compliance with Google Play requirements, accounting and tax obligations.

4. DATA RETENTION

Data is retained:

• for as long as the user account is active,
• or until the user manually deletes their account,
• some subscription-related data may be retained for legal reasons (billing, proof of payment).

In case of prolonged inactivity, the account and associated data may be anonymised or deleted, in accordance with GDPR and applicable legal requirements.

5. DATA SHARING

We only share the minimum data strictly necessary with:

5.1. Technical service providers

• Supabase: secure data storage, authentication, execution of Edge Functions.
• Firebase / FCM: sending push notifications.
• Google Play Billing: management of Android subscriptions.
• FedaPay: validation of Mobile Money / local card payments.

5.2. Legal authorities

Data may be disclosed to competent authorities only when required by law or in the context of legal proceedings.

We never sell your personal data to third parties.

6. DATA SECURITY

We apply strict measures to protect your data:

• Encrypted communications (HTTPS / TLS)
• Supabase RLS policies (access limited to data linked to the account)
• Hashed passwords (never readable in plain text)
• Server-side validation of subscriptions and payments
• Secure logging of sensitive operations

The user remains responsible for the security of their device, access to their account and the confidentiality of their password.

7. USER RIGHTS (GDPR)

The user may:

• access their data,
• request the rectification of inaccurate data,
• request deletion of their account,
• request portability of certain data,
• withdraw their consent (for processing based on consent),
• object to certain processing on legitimate grounds.

To exercise these rights:
📧 support@shopmahelso.com

8. ACCOUNT DELETION

The user may request permanent deletion of their account at any time.

This deletion will result in the erasure (except where legally required to retain):

• shops,
• products,
• sales and related history,
• statistics and reports,
• associated employees.

Some payment data may be retained for legal reasons (accounting, fraud prevention).

9. CHILDREN & MINORS

ShopMahelso is not intended for users under the age of 16. We do not knowingly collect data relating to minors.

10. DATA LOCATION

Data is hosted by Supabase on servers located:

• in the European Union (EU),
• and/or in regions compliant with GDPR / UK GDPR and cloud security standards.

11. CHANGES TO THIS POLICY

We may amend this Data Usage Policy in order to:

• add new features,
• comply with developments in legislation,
• enhance security and data protection.

In case of significant changes, a notice may be displayed in the application or sent by email where appropriate.

12. CONTACT

For any questions regarding data usage in ShopMahelso:

MAHUGNON SERVICES LTD
📍 20 Wenlock Road, London, N1 7GU, United Kingdom
📧 support@shopmahelso.com