Privacy policy

1. Who we are

SiteBazaar is operated by Ali Zein, trading as SiteBazaar, from Tripoli, Lebanon. Ali Zein is responsible for the personal data described in this policy. You can reach us on WhatsApp at +961 76 056 494 or by email at support@sitebazaar.app for anything in this policy.

2. Two roles: our data, and our clients' data

When you visit sitebazaar.app or become a SiteBazaar client, we decide how your data is used, and this policy applies to us directly.

When you shop or order on a store built with SiteBazaar, that store's owner decides how your data is used. We process it on their behalf, only to run their website. For questions about an order — delivery, returns, what they do with your number — contact the store first. We will help if they cannot.

3. What we collect

• Client accounts: your name, email address, phone number and login. Passwords are handled by our authentication provider and stored only in hashed form — we never see them.
• Store content: the products, prices, photos, videos, menus and texts you add to your website.
• Orders placed on client stores (on the store owner's behalf): the customer's name, phone number, delivery area and address, the items ordered, any notes and, when the customer pays by Whish or OMT, the payment reference they enter.
• Gifts and memory books (on the store owner's behalf): messages, photos and videos attached to a gift, and replies left by the person who receives it.
• Billing records for clients: invoices, amounts and how they were paid. We do not process or store card numbers.
• Visits to client stores: the page visited, the referring site, the country, the type of device, browser and operating system, and a visitor code that changes every day, so visits can be counted without following anyone. Our analytics never store IP addresses, and visit records are deleted after 180 days.
• Visits to sitebazaar.app: anonymous, aggregated events (for example, that a WhatsApp button was pressed). They never include what you type.
• Messages to our AI features: business descriptions and change requests that clients send to the AI assistant.
• Website briefs: the answers and files a client sends through our online brief form. The uploaded files are deleted 60 days after the brief expires or is used to build the website, or 120 days after its last change if no website is built from it.
• New-order notifications: if a store owner turns them on, we keep their browser's notification address and send alerts about new orders and messages through that browser's push service (for example Google, Apple or Mozilla).

4. The prompt box on our homepage

What you type into the "describe your website" box is saved only in your own browser, as a cookie that expires after 30 days, so it is still there if you come back. It reaches us only if you press the button and send it to us on WhatsApp yourself.

5. How we use data

• To build, host and operate websites, and to process orders placed on them.
• To notify store owners of new orders and to send account, invoice and security emails.
• To bill clients and keep accurate records of payments.
• To provide support when you contact us.
• To keep the platform secure and prevent spam, fraud and abuse.
• To understand, in aggregate, which parts of the service are used, so we can improve them.

We do not sell personal data, and we do not use advertising trackers.

6. Who helps us (service providers)

We use a small number of providers, each of which may handle data only to provide its service to us:

• Vercel — website hosting and delivery. Our servers run in Frankfurt, Germany; pages are cached worldwide for speed.
• Supabase — database, logins and file storage, hosted in Frankfurt, Germany.
• Resend — delivery of the emails the service sends. For each email we send (invitations, order notifications, invoices and receipts) we record whether it was delivered and opened, so we can tell when an important email did not arrive. We keep that record for 180 days.
• AI providers — Google (Gemini) and, where enabled, Anthropic (Claude) or OpenAI — which receive the text sent to our AI features in order to return a result. Where a store owner connects their own AI provider account, those requests are sent under that owner's account and terms.
• WhatsApp (Meta) — when you choose to contact us or a store on WhatsApp, the conversation happens in WhatsApp under its own terms. When you message SiteBazaar's own WhatsApp number, we receive your number, your name and your messages through Meta's WhatsApp Business service, and we may use them, with our AI providers, to build a preview of your website. We keep those messages for 180 days, and we delete the details of a contact who has no website with us and has not written to us for a year.

7. Where data is stored

Our database and files are stored in the European Union (Frankfurt, Germany). Some providers, such as AI and content-delivery services, may process data in other countries, including the United States, to perform their service.

8. Cookies

We use only cookies the site needs to work, or that remember a choice you made. We use no advertising or cross-site tracking cookies.

• Login session — keeps clients signed in to their dashboard.
• Language — remembers English or Arabic (sf_locale, sb_dash_locale; one year).
• Display mode — remembers light or dark (sb_v2_mode; one year).
• Prompt draft — keeps what you typed in the homepage box (sb_v2_draft; 30 days).

9. How long we keep data

We keep a client's account and store data for as long as the account is active. We also keep our own daily backup of each store for 30 days.

When a store is deleted, we first write a final backup of it, including its orders and files, which can be restored for 30 days and is then erased. Its content, orders, files and owner login are removed from our live systems. Backup copies held by our database provider expire on its rolling schedule.

Store customers' data is kept for as long as the store owner keeps it. Ask the store to delete it, or ask us and we will pass the request on.

10. How we protect data

• All traffic is encrypted in transit (HTTPS).
• Each store's data is isolated at the database level, so one client cannot read another client's data.
• Access to production systems is limited to the people who run SiteBazaar.
• Secrets such as API keys are stored encrypted.

11. Your rights

You can ask us to show you the personal data we hold about you, to correct it or to delete it, and you can object to how it is used. Message us on WhatsApp at +961 76 056 494. If your data came from a store you ordered from, we will work with that store to answer you.

We handle personal data in line with Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data.

12. Children

SiteBazaar accounts are for businesses. You must be at least 18 to open one.

13. Changes to this policy

When we change this policy we will update the date at the top. If a change is significant, we will tell clients in advance by email or in their dashboard.