Privacy Policy

This policy covers everyone who uses the Service:

• Sellers who run a store, and the team members they invite. For their account data we decide how it is used.
• Shoppers who buy from a store. Each store is run by an independent seller, who decides how their shoppers' data is used and is responsible for it. We process that data on the seller's behalf, to run their store.
• Visitors to our website and to storefronts.

We do not sell personal data, and we do not use advertising trackers.

• Account: your name and email address, from Google when you sign in. We do not see or store your Google password.
• Store and business details: store name and address, Instagram handle, contact email, phone and WhatsApp number, business address, tax number, and the legal name, registration number and TIN shown in your store policies.
• Bank and gateway details: the bank account details you choose to show shoppers for transfers, and the credentials for your own BML Connect or Swipe merchant account, which are encrypted and never shown back in full.
• Team: the email address and role of each person you invite.
• Store content: products, photos, texts and settings you add.
• Subscription: your plan, invoices and payment history. We do not keep card details.
• Telegram: if you connect Telegram for alerts, the ID of the private chat or group you link, your Telegram username, and which alerts you turned on.
• Activity and technical data: a record of important actions, such as publishing a store, team changes and payment settings, with the IP address they came from; and request logs, error reports and IP addresses used to keep the Service secure.

When you order from a store, the store receives and keeps:

• Your name, phone number and, if you give it, your email address
• For delivery, your island, area and address
• What you ordered, the price, how you chose to pay, any note you add, and the order’s progress
• A photo of your transfer slip, if you pay by bank transfer and upload one
• Any private notes the seller adds to your customer record

If you sign in to a store with Google, the store also keeps your Google account ID, name and email address, so you can see your orders. Shopper accounts are separate for each store and are optional.

When you visit a storefront, we count visits, product views and checkout steps for the seller's statistics. Instead of your IP address we store a one-way code made from your IP address, browser and the store, with a value that changes every day, so a visitor cannot be identified or followed from one day to the next. Your raw IP address is not stored with these statistics.

Your cart is kept only in your own browser until you check out.

• If you use our contact form, we keep your name, email address, phone number, the number of stores you mention and your message.
• If you report a store, we keep the reason, the details you give and, if you give it, your email address.
• Some forms, such as checkout, order tracking, contact and reports, use Cloudflare Turnstile to check that you are not an automated program. Cloudflare processes your IP address and browser signals for this check.

• To provide the Service: sign-in, running stores, taking and managing orders, and showing each store its own statistics
• To confirm that a seller controls the Instagram account linked to their store
• To send the emails and alerts described in Section 7
• To process subscription payments and confirm store payments with the payment gateway
• To keep the Service secure, prevent fraud and abuse, enforce our Acceptable Use Policy and review reports
• To answer support requests
• To meet legal, tax and accounting obligations

We use shoppers' data only to run the store for the seller, never for our own marketing. We do not send marketing email to sellers unless they have agreed to it, and they can opt out at any time.

When a seller asks us to import their Instagram profile, we read only what is public on that profile, without signing in: the name, bio, profile details, recent posts, their captions and images. We do not access private profiles or messages.

To draft store texts, we send the seller's public profile text, post captions, small copies of post images and any notes the seller gives to the Claude API, provided by Anthropic. It returns suggested texts, such as a store description, product descriptions and FAQs, and a suggested look for the store. Nothing it suggests is published until the seller reviews and saves it. We do not send shoppers' data to the AI.

We send emails through Resend. Sellers and team members receive account, security, team invitation, verification and billing emails, which cannot be turned off. Shoppers who give an email address receive order confirmations and status updates on the seller's behalf, unless the seller switches shopper emails off.

Each team member gets only the alerts their role allows; for example, the stock role never receives payment alerts. A seller can send alerts to a Telegram group, and then everyone in that group can read them. The seller decides who is in the group and is responsible for it.

Card payments, both shoppers paying a store and sellers paying their subscription, are made on the payment page of Bank of Maldives (BML Connect) or on Swipe. Card details go directly to the bank. We never receive or store a full card number, security code or PIN.

A shopper's card payment goes to the seller's own merchant account. We only ask the gateway whether the payment went through and for how much. Sellers pay every subscription invoice, renewals included, through a payment link. We do not keep their card details or a card token.

A shopper who pays by bank transfer can upload a photo of the slip. Slips are kept in private storage, never on a public address. They can be opened only through a link that expires shortly, by the store's team members whose role allows them to see payments, and by our staff when needed for support or to investigate abuse. Slips stay with the order as the store's payment record.

• Each store sees only its own orders, customers and statistics. Stores cannot see each other’s data.
• Inside a store, what a team member sees depends on the role the owner gave them. For example, only some roles see customers’ contact details or payments.
• Our staff access data only when needed to run, support or secure the Service, or to review a report.
• Our sub-processors, listed in Section 11, process data for us under our instructions.
• We disclose data to authorities only when the law requires it.
• If the Service is transferred to another company, the data goes with it and this policy keeps applying. We will tell sellers before that happens.

We use these providers to run Open Online:

• Railway: application and API hosting.
• Neon: database hosting.
• Cloudflare: DNS, file storage (R2) and bot checks (Turnstile).
• Resend: transactional email.
• Telegram: order alerts to sellers and their staff.
• Anthropic: AI writing (Claude API).
• Sentry: error tracking.
• Bank of Maldives: card payments (BML Connect, Swipe).
• Google: sign-in.

We choose providers that protect data adequately, and we remain responsible for data they process for us. We will update this list before we add a new provider.

The Service uses only the cookies and storage it needs to work:

• A sign-in cookie on the seller dashboard, and a cookie that remembers the last store you opened there, for up to a year
• A sign-in cookie on each store where a shopper signs in, which lasts up to 30 days, and short-lived cookies used only during sign-in
• A cookie that lets a seller preview their own store, which lasts 30 minutes
• Your cart, kept in your browser’s local storage on each store

Each cookie belongs to one address only and is not shared between stores or with the dashboard. We do not use advertising or third-party analytics cookies.

• All connections use HTTPS.
• Payment gateway credentials are encrypted with a key kept outside the database.
• Every store’s data is separated in the database, with checks on every request and in the database itself.
• Photos are re-encoded when uploaded, which removes hidden metadata such as camera location.
• Error reports leave out request contents, cookies and sign-in headers.
• Our staff’s access is limited and important actions are logged.

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities where the law requires.

Our database and application servers run in Singapore, on Neon and Railway. Uploaded files are stored in Cloudflare R2, in its Asia-Pacific region. Some providers, such as those for email, error tracking, AI, Telegram and Google sign-in, may process data in other countries. Data is therefore processed outside the Maldives. We use providers that protect data adequately wherever they process it.

• Account, store and order data: for as long as the account is open.
• After a seller deletes their account: their stores go offline at once, and signing in again within 30 days restores the account and those stores. After 30 days, we delete or anonymise the account and its stores' data, including products and shoppers' names, phone numbers, email and delivery addresses. We keep records we must keep by law, such as invoices, payment and tax records, order numbers and totals, and security logs.
• A deleted store goes offline at once and its address is freed straight away. Its records are kept with the account until the account is deleted.
• Download my data: the file is kept for 7 days, while its download link works, then deleted.
• Payment slips: with the order they belong to.
• Original uploaded files: deleted once processed, and in any case within 1 day.
• Sign-in and link codes: minutes to days, then they expire. A shopper sign-in code lasts 60 seconds, a Telegram link code 15 minutes, an Instagram bio code 24 hours and a team invitation 7 days.
• Records used to stop a request being processed twice: 24 hours.
• Unpaid subscriptions: when a trial ends without a plan or a renewal goes unpaid, the stores become read-only after 7 days. If the seller has still not paid 30 days after that, we close the account and delete or anonymise its data and its stores' data, keeping only the records we must keep by law, such as invoices, payment and tax records, and security logs. We email the seller a link to a copy of their store data at least 7 days before. Cancelling a plan never leads to deletion.

Sellers can delete their account and download a copy of their store data (products, orders, customers and invoices, as CSV files) from their account settings. The download link is emailed to the address they sign in with and works for 7 days. Emailing hello@crode.onlinestill works for both. The Terms explain the details. A shopper who wants their data deleted from a store should ask the seller, or ask us and we will pass the request on.

Subject to applicable law, you can ask us to:

• Tell you what personal data we hold about you and give you a copy
• Correct data that is wrong. Sellers can change their name in their account settings
• Delete your data, except what we must keep by law
• Give you your data in a common format, such as CSV
• Stop using your data for something you object to, or stop marketing

You can disconnect Telegram, download a copy of your data, and delete your account at any time in your account settings. To use any other right, email hello@crode.online. We may need to confirm your identity first. If your request is about a store's shopper data, we will work with that seller to answer it.

The Service is not directed at children, and sellers must be legally able to enter into a contract. If we learn that we hold a child's data without a lawful basis, we will delete it.

We will update this policy when the Service, our providers or the law change. We will tell active sellers about material changes by email or in the dashboard before they take effect. See also our Terms.

The Service is operated by NAPCO Group PVT LTD, Ga. Aakashvilla, K. Malé, Maldives (Registration No. C21812025, TIN 1175832).

For any privacy request or question, email hello@crode.online.