Privacy for the store app

Last updated: 21 October 2026

This notice covers the Maqadi app for online stores on Salla (Salla App Store), and later on Zid (Zid App Market), called “the platform” below. The app lets a store's customers subscribe to products, creates repeat orders on schedule and gives customers a portal to manage their subscription. The general privacy notice covers the rest of maqadi.dev.

The short version

To run subscriptions, Maqadi has to remember who subscribed to what, how often and when the next order is due. It keeps that, and only that, on our server in Jeddah, Saudi Arabia. It never sees or stores card numbers, and money never passes through it. When you remove the app, its access to your store ends at once and the data it kept is deleted.

Who is responsible

For your customers' details and their subscriptions, you, the merchant, are the controller, and Maqadi processes them on your behalf, only to run the subscriptions in your store. The data processing agreement sets out the terms. For your own store account with the app (settings, plan, usage), the responsible party is Yimello LLC, Sharjah Media City (Shams), Al Messaned, Al Bataeh, Sharjah, United Arab Emirates, Trade License 2430802.01. Contact: support@maqadi.dev.

What the app can access

• Products: names, prices, options and images of the products you make available for subscription;
• Customers: the subscriber's name, phone number and email address;
• Orders: the first order of a subscription and every repeat order the app creates, with items, prices, the delivery address chosen in your store and the order status; the app can create orders, but does not change or delete other orders;
• Subscriptions and recurring payments: the reference of each subscription on the platform and whether a charge succeeded or failed;
• Store details: store name, logo and contact details, to show them to your customers in reminders and in the portal.

Card details are entered only in your platform's checkout. The app receives no card number and no other card data.

What is stored, and for how long

Kept while the app is installed

• your store's ID on the platform and its name;
• the access keys the platform gives the app, encrypted with a key that exists only on our server;
• your settings: which products can be subscribed to, frequencies, subscriber discount, reminder and retry rules, message texts;
• for each subscription: the customer's name, phone number and email, a reference to the delivery address in your store, the products and quantities, the frequency, the next order date, the status (active, paused, cancelled), the subscription's reference on the platform, and the list of orders it created;
• a log of the reminders and payment links sent (date, channel, delivered or not), kept for 90 days;
• your plan and the number of active subscribers, to apply the plan's limit.

A cancelled subscription stays in your dashboard as history while the app is installed. You can delete a customer's subscriptions at any time from the dashboard, for example when the customer asks.

When you remove the app

The platform tells us at once. Automatic charges are stopped, and the access keys, settings, subscriptions, customer details and message log are deleted. We keep only your store's ID, the dates of installation and removal, and the monthly counts of active subscribers, because they are the record of what was billed. The encrypted backups that still contain the deleted data expire within 35 days.

Technical logs

For each request the server records the method, the path without any parameters, the status code, the time taken and, for platform events, the event's name. For an unexpected error, only its type is recorded. Customer details, order details, access keys and IP addresses are not recorded. The log has a fixed maximum size and overwrites its oldest entries.

Messages to your customers

Reminders before an order, payment links and the link to the customer portal are sent by email, through our email provider, Rackhost, in Hungary (European Union); the customer's email address and the text of the message pass through it. WhatsApp messages will be offered only through a provider that is named in this notice and in the data residency statement before the feature is enabled for your store. Until then, Maqadi sends no WhatsApp messages.

Where it is processed

The app runs on Oracle Cloud in the Jeddah region of Saudi Arabia. The database and its encrypted backups are kept in the same region. The app page in your dashboard and the customer portal load their files only from our server. Apart from the emails described above, your customers' details do not leave Saudi Arabia. Details of every location are in the data residency statement.

Who else receives it

Oracle Cloud Infrastructure hosts the server in Jeddah. Emails pass through Rackhost. Plans for the app are billed by the platform, and Maqadi never sees your payment details. Your customers' details are never sent to AI services, never sold and never used for advertising.

Security

All traffic uses HTTPS. Events from the platform are accepted only with a valid signature. The app page works only inside the platform's dashboard, after the platform confirms which store is signed in, and one store can never see another store's subscriptions. The customer portal opens with a personal link that works only for that customer's subscriptions and can be replaced at any time. The access keys are stored encrypted.

Your rights, and your customers' rights

You can ask what is held about your store, and ask for it to be corrected or deleted, by writing to support@maqadi.dev; you will have an answer within 30 days. A customer who wants to see, correct or delete their subscription data can do most of it in the customer portal; other requests go to your store as the controller, and we help you answer them within 14 days. Depending on where you are, you and your customers may also have rights under local law, such as the Personal Data Protection Law in Saudi Arabia.

Changes

If this notice changes, the date at the top changes with it. If a change affects what the app can access, keep or send, we will tell you in the app before it takes effect.