Privacy Policy

1. Who we are

Trioty is operated by its founding team, based in Cairo, Egypt. We are in the process of formally registering a company in Egypt to operate the Service; this policy will be updated with the registered company name and details once registration is complete.

For any privacy question or request, or to identify the individuals responsible for the Service, contact us at privacy@trioty.com.

2. The roles of sellers and Trioty

When a buyer places an order through a seller's store, that seller is responsible for their own relationship with the buyer (fulfilling the order, arranging delivery, handling payment, and answering questions). Trioty provides the technology that makes this possible and processes buyer data both on behalf of the seller (to deliver the store, checkout, and order-management features) and for our own platform purposes (operating, securing, and improving the Service, including platform-level trust and fraud prevention as described in Section 6).

Sellers are responsible for how they use buyer data they receive through the Service and for complying with applicable law in their own dealings with buyers.

3. Information we collect

3.1 Information sellers provide

• Account and contact details: name, phone number, and login credentials (passwords are stored only in hashed form).
• Store information: store name, description, logo, branding choices, categories, products, prices, and store policies.
• Payment-instruction details you choose to display to buyers (for example wallet numbers, InstaPay handles, or bank-transfer details).
• Operational credentials you connect, such as a shipping-carrier (Bosta) API key, stored to enable the integrations you enable.
• Billing and subscription information related to your plan.

3.2 Information buyers provide

• Contact and delivery details entered at checkout: name, phone number, and shipping address.
• Order contents and any notes you add to an order.
• Payment-proof screenshots you upload (for example a Vodafone Cash, InstaPay, or bank-transfer confirmation) when a store requires proof of payment or a deposit.
• Verification codes you enter to confirm your phone number, where a store enables verification.

3.3 Information we collect automatically

• Device and browser identifier: we place a randomly generated identifier ("browser ID") in a cookie so we can recognise a device across the platform (see Sections 5 and 6).
• Verification/session cookies: short-lived tokens that keep you signed in (sellers) or remember that a device has verified a phone number for a store (buyers).
• Log and usage data: IP address, approximate location derived from IP, browser and device type, pages viewed, and timestamps, collected for security, debugging, and analytics.

3.4 Information from third parties

• Where a store uses WhatsApp to send order updates, we receive delivery and interaction status for those messages from WhatsApp/Meta.
• Where a store uses a shipping carrier or payment processor we integrate with, we receive status updates (for example delivery or payment status) from that provider.

4. How we use information

We use personal data to:

• Create and operate seller accounts and stores.
• Display storefronts and let buyers place and track orders without needing to create an account.
• Process order confirmation, payment-proof review, and order status updates.
• Send transactional notifications (for example order confirmations and tracking links) by WhatsApp and/or SMS.
• Arrange shipping and cash-on-delivery collection through integrated carriers when a seller enables them.
• Process payments through an integrated payment provider when a seller enables online payment.
• Prevent fraud, abuse, and misuse, and keep the Service secure (see Section 6).
• Provide support, respond to issues, and communicate service-related information.
• Analyse and improve the Service.
• Comply with legal obligations.

Our legal bases include performance of the service you request, our legitimate interest in operating and securing the platform, your consent where required (for example for certain cookies or communications), and compliance with law.

5. Cookies and similar technologies

We use a small set of cookies and similar identifiers:

• Essential cookies that keep you signed in and keep sessions secure.
• Device-trust cookies that remember a device has verified a phone number for a store, so buyers are not asked to verify repeatedly (these expire after a limited period).
• A platform browser-ID cookie used to recognise a returning device across stores for trust and fraud-prevention purposes (Section 6).
• Analytics/log data used to understand and improve usage.

You can control cookies through your browser settings. Blocking essential cookies may prevent parts of the Service from working (for example staying signed in or completing an order).

6. Recognising returning buyers across stores

Trioty is a shared platform used by many independent stores. To reduce fraud, improve delivery reliability, and make checkout smoother for returning buyers, we maintain a platform-level record that links a buyer's verified phone number and browser ID to their order activity across the different stores on the platform.

What this means in practice:

• We can recognise that a device or phone number has ordered on the platform before, and use signals such as payment and delivery history to assess trust and detect fraud or abuse.
• Individual sellers do not receive other sellers' raw customer data. A seller sees only the orders placed in their own store. Cross-store signals are used by Trioty at the platform level and, where surfaced to a seller, only as high-level indicators (for example that a buyer is a returning platform customer) — never as another store's underlying data.

If you would prefer this activity not be associated with you, you may request deletion as described in Section 11.

7. Artificial intelligence processing

To reduce manual work, some features use automated and AI processing:

• Payment-proof reading: when you upload a payment screenshot, we may use a third-party AI service (Google's Gemini models) to read the payment amount from the image. This is presented to the seller as a suggestion that the seller reviews and confirms; it is not an automatic decision.
• Product content: sellers may use AI to help generate product descriptions, translations, and metadata from information they provide.
• Image processing: product images may be processed (for example background removal and format optimisation) to display them in stores.

These features process the specific content involved (for example the uploaded screenshot or product details) through the relevant provider under our instructions. We do not use payment proofs for advertising.

8. How we share information

We do not sell personal data. We share it only as follows:

• With the seller whose store you order from. When you place an order, the seller receives the order details needed to fulfil it (your name, phone, address, order contents, and any payment proof).
• Shipping carriers. When a seller arranges delivery (for example through Bosta), we share the name, phone, address, and cash-on-delivery amount needed to create the shipment and collect payment.
• Payment processors. When online payment is enabled, payment information is processed by our payment provider (for example Paymob) under their own terms and privacy policy.
• Messaging providers. We use WhatsApp/Meta and an SMS provider to deliver order notifications and verification messages.
• Infrastructure and processing providers. We host and process data using service providers including Google Cloud Platform (hosting and AI) and Cloudflare (content delivery, image processing, and object storage). These providers act on our behalf under contractual data-protection obligations.
• Legal and safety. We may disclose information where required by law, to enforce our terms, or to protect the rights, safety, and security of users, the public, or Trioty.
• Business transfers. If Trioty is involved in a merger, acquisition, or sale of assets, data may be transferred as part of that transaction, subject to this policy.

9. International data transfers

Our infrastructure providers (including Google Cloud and Cloudflare) may store or process data on servers located outside Egypt. Where personal data is transferred internationally, we take steps intended to ensure it remains protected consistent with this policy and applicable law.

10. Data retention

We keep personal data only as long as needed for the purposes described in this policy or as required by law.

• Seller account and store data is retained while the account is active and for a reasonable period afterward.
• Order and transaction records are retained as needed to operate the Service, resolve disputes, and meet legal and accounting obligations.
• Incomplete/draft orders that are never submitted are automatically expired and pruned after a short period.
• Payment-proof images are retained for the period needed to verify payment and resolve any related dispute.

When data is no longer needed, we delete or anonymise it. We may retain aggregated or de-identified information that does not identify you.

11. Your rights and choices

Subject to applicable law (including Egypt's Personal Data Protection Law), you may:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data (see the process below).
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Complain to the competent data-protection authority.

To exercise any of these rights, contact privacy@trioty.com. We may need to verify your identity before acting on a request.

If your data was provided to a specific store, some requests (for example correcting a delivery address on a past order) may also need to be directed to that seller, and we will help route your request where appropriate.

12. Data deletion requests

You can request deletion of your personal data at any time.

How to request deletion: send an email to privacy@trioty.com from the phone-linked email or including the phone number associated with your activity, with the subject line "Data Deletion Request." Tell us whether you are a buyer or a seller so we can locate your records.

What happens next: we will verify your request, delete the personal data we are not legally required to keep, and confirm completion. We aim to complete verified requests within [30] days. Some records may be retained where the law requires it (for example transaction records for tax or accounting purposes) or where needed to resolve a dispute or prevent fraud; we will tell you if this applies.

This section also serves as our data-deletion instructions for third-party platforms (such as Meta) that require a way for users to request deletion of data associated with our application.

13. Security

We use technical and organisational measures to protect personal data, including encrypted connections, hashed passwords, access controls, private storage for sensitive files such as payment proofs, and time-limited signed links for uploads and downloads. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Children

The Service is intended for business use by adults and is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

15. Third-party links and stores

Stores on the platform are operated by independent sellers, and messages, payment instructions, or links they provide may lead to third-party services with their own privacy practices. We are not responsible for the privacy practices of third parties. Please review their policies separately.

16. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect means you accept the updated policy.

17. Contact us

Questions, requests, or complaints about this policy or your personal data:

Trioty (company registration in Egypt in progress)
Email: privacy@trioty.com
Address: Cairo, Egypt

We will add our registered company name and full address here once registration is complete.