Privacy Policy

This policy explains how Mouhamed Bakhoum, who operates Payleor as an individual ("Payleor", "we"), handles personal data. Contact: privacy@payleor.com.

1. What we collect

• Account details: your name, email address and password (stored only as a hash). If you sign in with PayPal, also your PayPal account ID and email.
• Store data: store names and settings, products, orders, and the buyer details each order needs, such as name, email and shipping address.
• Logs: technical records of requests and errors. We remove or hash personal data, such as email addresses, before it reaches our logs.
• Payment data: card and bank details go to PayPal, not to us. We receive payment status and IDs from PayPal.

2. Why we use it

• To run your account and stores and process orders, as part of our contract with you.
• To send account emails, such as verification and password reset links.
• To keep the service secure and prevent fraud and abuse, which is our legitimate interest.
• To meet legal obligations, such as keeping billing records.

We do not sell personal data or use it for advertising.

3. Merchants and buyers

For buyer data in a store, the merchant decides how it is used and is responsible for it. Payleor processes it on the merchant's behalf. Buyers should read the store's privacy policy and contact the store first.

4. Who processes data for us

• Cloudflare: hosting, networking, storage and AI Gateway.
• Aiven: the database.
• PayPal: payments, Log in with PayPal, and billing for Payleor plans.
• Resend: account emails.
• AI model providers, reached through Cloudflare AI Gateway: they run the AI agents and receive only the data a task needs.

Each of them processes data under its own terms and data protection commitments.

5. How long we keep it

• Account and store data: while the account is open, then 30 days for exports, then deleted.
• Order and billing records: as long as tax and accounting law requires.
• Logs: up to 30 days.

6. Your rights

Under Senegal's Law No. 2008-12 of 25 January 2008 on the protection of personal data, you can ask to access, correct or delete your data, and you can object to its processing. Email us and we reply within 30 days. You can also complain to the Commission de Protection des Données Personnelles (CDP).

7. Transfers outside Senegal

Our processors store and process data in other countries, including the United States and the European Union. We use providers that commit to protecting it.

8. Cookies

We use only the cookies needed to keep you signed in and to secure your session. We do not use tracking or advertising cookies.

9. Security

Data is encrypted in transit. Passwords are stored only as hashes. Access to production data is limited to the operator.

10. Governing law

This policy is governed by the laws of Senegal.

11. Changes

We announce material changes by email and on this page before they take effect.