Cha-ChingTwo kinds of people
This policy covers two groups, and the distinction matters throughout.
- Our users — the sellers and call-centre staff who hold accounts. For their data we are the controller.
- Their customers — the people who place cash-on-delivery orders. For that data the seller is the controller and we are a processor acting on their instructions. The data processing terms set that out.
What we collect about users
- Account details: name, business name, email, telephone, country, tax identifier.
- Billing details: the card brand, last four digits and expiry — never a full card number, which has no column in our database.
- Usage: sign-ins, actions taken in the product, and the IP address a request came from.
- Anything you send us in a message or a support request.
What we process about customers
On the seller's behalf: name, telephone number, delivery address, what was ordered, and the record of calls made about it — who called, when, for how long, and what the outcome was.
We process it to run confirmation calls, to move the order through its stages, and to produce the operational measures both sides are paid against. Nothing else.
Who it reaches
- The call centre the seller engaged, for the shops assigned to them — and within that centre, only the agents cleared for those shops. Both conditions are checked on every read.
- Our staff, where needed to operate the service or to settle a dispute between a seller and a centre. Every such action that changes something is logged against a named person.
- Our infrastructure providers — hosting and database, and an email provider where one is configured. They process on our instructions and nothing else.
- Nobody else. We do not sell data, we do not run advertising, and we do not train models on customer personal data.
How long we keep it
- Account data: while the account is open, then ninety days.
- Orders and call records: while the account is open, then as the seller instructs.
- Commission entries, invoices and the audit trail: seven years. These are financial and dispute records belonging to both parties.
- Sign-in attempt records: a short rolling window, for rate limiting.
Where it lives
On managed infrastructure in the European Union. Where a transfer outside it is necessary, it is covered by standard contractual clauses.
How it is protected
Encryption in transit and at rest. Shop access tokens encrypted with AES-256-GCM before storage and never selected into any page or log. Password hashes, tokens and webhook secrets on a structural deny list the admin console cannot read through. Access enforced per request rather than per screen. The security page is specific, including about what we do not claim.
Your rights
Access, correction, deletion, portability, objection, and restriction. For account data, write to us and we will act within thirty days. For customer data, the request belongs to the seller as controller — if you are an end customer, contact the shop you ordered from, and we will support them in answering you.
Cookies
We set a session cookie when you sign in and a cookie remembering your light or dark preference. There is no analytics, advertising or third-party tracking on this website or in the product. See the cookie page.
Children
The service is for businesses. We do not knowingly process the data of anyone under sixteen as a user.
Contact
Privacy questions, requests and complaints go to our contact page and reach a person. You also have the right to complain to your local data protection authority.