Privacy Policy

1 Who we are

NoqtaShop is operated by NoqtaX Solutions LLC, a Wyoming limited liability company, of 30 N Gould St #60420, Sheridan, WY 82801, United States. For the data described in this policy that we decide the purposes of, that company is the data controller.

This policy covers two different situations, and it matters which one you are in. If you are visiting this website or using NoqtaShop as a merchant, we decide what is collected and this policy applies to you directly. If you are a shopper who bought something from a store built on NoqtaShop, the merchant decides what is collected — we only hold it for them, and their own privacy policy is the one that applies to you.

For anything in this policy, write to privacy@noqtashop.com.

2 What this website stores on your device

A cookie and three browser-storage entries at most, all set by us, none used to track you. Two of them exist only while you are signing up for a store:

• noqtashop_lang — a cookie holding “en” or “ar” so the page arrives in the language you chose. It is written only if you actually use the language switch: read the site in the language it offers you and no cookie is set at all. It lasts a year, is limited to this site (SameSite=Lax, no subdomains), and is sent over HTTPS only. The server needs it before it renders, which is why it is a cookie and not browser storage.
• Which language we offer you before you choose comes from your browser. Every request carries an Accept-Language header, and we read one thing from it — whether the language you listed first is Arabic — so an Arabic reader is not shown an English page. We do not store that, and it is not a cookie: a preference we guessed is not a preference you gave us.
• noqtashop.theme — a browser storage entry holding “dark” or “light” so the site does not flash the wrong theme on your next visit. It never leaves your device.
• ns.signup — written when you submit the sign-up form. It holds your new store’s name and address, its languages, your email address and, on a paid plan, a one-time ticket that signs you into your store once payment is done — so the page you come back to from the payment step can finish setting you up. It is session storage: it lasts only as long as that browser tab.
• ns.google.signup — written only if you choose “Continue with Google”. It holds what you had filled in on the sign-up form, so nothing is lost on the way to Google and back, and a random value that proves the reply from Google belongs to your request. It is removed as soon as your sign-up completes, and otherwise disappears when you close the tab.

That is the entire list. There is no analytics on this site, no tag manager, no advertising or social pixel, no session recording, and no A/B testing tool. Nothing here profiles you, and nothing here follows you to another site.

We serve every font, image and script from our own domain — nothing is fetched from a CDN, a font host or an ad network. There are no embeds and no third-party frames anywhere on this site, so simply loading a page does not reveal your IP address to anyone but us.

Because none of these is used for tracking or advertising, and each is needed for something you asked for to work correctly, we do not show a consent banner. There is nothing to consent to.

3 When you contact us

The enquiry form on this site asks for your name and email address, and optionally your company, phone number and a message. Fields you leave blank are not sent at all. We use them to reply to you and to keep track of the conversation — nothing else. They are not added to a marketing list, and we do not sell or share them.

To be precise about what happens to it: the enquiry becomes an email to our own mailbox, which Google Workspace holds for us (see below), and a copy of that email — including what you wrote — is stored in our system so we have a record of the correspondence. Your email address also appears in our application log for that request. The endpoint is rate-limited by IP address, so your IP is processed to stop the form being abused.

Before the form is sent, your browser also solves a small puzzle that our own server sets. The puzzle carries nothing about you; it makes sending the form thousands of times slow and costly, which is what stops scripts flooding it.

The servers and the content delivery network in front of this site keep ordinary access logs — IP address, page requested, time, and the browser’s user-agent string — used to keep the service running and to investigate abuse. The site’s own application adds nothing of its own to them.

4 When you open a store

To run a store for you we hold your account details (name, email address, and the password stored only as a one-way hash), your store’s settings and content, your plan and its billing status, and records of what happens in the console.

If you invite staff, we hold the same kind of account details for them, and a record of what each account did — that log exists so a store owner can answer “who changed this”, and so we can investigate a security problem.

We use this to provide the platform, to bill you, to send you service email about your account, and to keep the platform secure. We do not sell it.

5 Your shoppers’ data

When someone buys from a store built on NoqtaShop, the data collected — name, delivery address, phone number, email, order history — belongs to that merchant’s relationship with their shopper. The merchant decides what is collected and why; we process it on their instructions so the store works.

We do not sell shoppers’ data, do not advertise to shoppers, and do not use one merchant’s data to do anything for another merchant.

If you shopped at a store and want your data corrected or deleted, ask the merchant — they are the one who can decide. If you cannot reach them, write to us and we will help you get to them.

6 Payments

We never see or store card numbers. Card payments in your store run through the merchant’s own payment account with HyperPay, and the card details go directly to that processor — they do not pass through NoqtaShop and are not written to our database.

Merchants pay us for their own subscription through Stripe, which is a separate arrangement between the merchant and us. Shoppers never reach it.

What we do hold is the result: whether a payment succeeded, when, for how much, and the processor’s reference for it, so the order and the merchant’s records make sense.

Cash on delivery involves no processor at all.

7 Who else processes data, and for what

We keep this list short on purpose. Each of these does one job, and only receives what that job needs:

• Amazon Web Services — hosting, storage, the database, and the email we send. Our email goes out through Amazon SES, which receives the recipient’s address and the message. All of it, in Frankfurt.
• Google Workspace — our own mailboxes. It receives and holds the email sent to us: what you write to any of our @noqtashop.com addresses, such as privacy@noqtashop.com and legal@noqtashop.com, and the notices our own platform sends us about merchants’ accounts and stores, support tickets, billing and enquiries, which can name a merchant and their email address. It also sends the replies we write. These mailboxes are not part of our Frankfurt hosting: Google keeps them in its own data centres, which may be in other countries.
• HyperPay — card payments in a merchant’s store, through the merchant’s own account with them.
• Stripe — subscription payments from merchants to us. No shopper ever reaches it.
• Evolink — AI image enhancement. Receives the specific product image you ask it to enhance, when you ask.
• Google (Gemini) — translation. Receives the specific text you ask it to translate, when you ask.
• Google (sign-in) — only if you choose “Continue with Google” when signing up. You sign in on Google’s own page, and Google shares the basic profile you approve — your name and email address — which we use to open your account.

The two AI services run only when someone deliberately triggers them, on the content they point at. Neither is used to train a model on your catalogue as part of normal operation, and neither runs in the background.

We do not use advertising networks, data brokers or analytics providers, so none appear on this list.

8 Where your data is held

On Amazon Web Services in the eu-central-1 region — Frankfurt, Germany. That region was chosen because it is the closest well-connected European region to Jordan, and because it puts the data under a strong protection regime.

The one exception is our mailboxes. What you write to our @noqtashop.com addresses, and the notices our platform sends us about merchants’ accounts and stores, support tickets, billing and enquiries, are held in Google Workspace, outside our Frankfurt hosting, in Google’s own data centres.

The database is encrypted at rest and backed up daily, with backups kept for seven days. Traffic between you and us is encrypted in transit, and so is the traffic between our own edge and our servers.

Some of the third parties above operate outside Jordan and the EU. Where data reaches them it is transferred under the safeguards their own terms provide.

9 How long we keep things

• Your account and store data — for as long as the account is open, and for a short grace period after you close it.
• Orders, invoices and payment records — for the period accounting and tax law requires us to keep them, which outlasts the account.
• Server request logs — about two weeks. These can contain an email address where one appeared in a request, which is the main reason they are kept briefly rather than indefinitely.
• Enquiries sent through this site — while the conversation is live and for a reasonable period after, so we can pick it up again.
• Email in our mailboxes — what you send to our @noqtashop.com addresses, our replies, and the notices our platform sends us — while the conversation or the matter is live and for a reasonable period after. A privacy request or a legal notice is kept for as long as we may need to show how we handled it.
• Addresses we must stop emailing (the suppression list) — when an email we send bounces for good, or the person it reached reports it as spam and their email provider passes that on, Amazon SES and our own system record the address and the reason. A permanent bounce stops all email to that address; a spam report stops newsletters and other marketing email to it from every store on NoqtaShop, while order and account email still arrive. An address stays on the list until it is taken off, because taking it off lets the email start again. You can ask us to take yours off.
• Backups — seven days, after which they roll off automatically. Data deleted from the live database therefore takes up to a week to disappear from backups.

10 How we protect it

Passwords are stored as one-way hashes and never in a form we could read. Sessions use short-lived tokens; the token that keeps you signed in is held in a cookie the browser will not hand to scripts.

The servers are not reachable from the public internet directly — traffic arrives only through our content delivery network, and administrative access is through an audited channel rather than an open port. The database sits on a private network with no public address.

No system is perfect. If a breach affects your personal data we will tell you and the relevant authority as quickly as we can, with what we know and what we are doing about it.

11 Your rights

You can ask us to give you a copy of your data, correct it, delete it, or stop a particular use of it. You can also ask for it in a portable form.

Write to privacy@noqtashop.com and we will answer within thirty days. There is no charge. We will ask you to confirm who you are first, because handing someone’s data to the wrong person is itself a breach.

To be straightforward with you: these requests are handled by a person, not by a self-service button in the console. If that changes, this page will say so.

If you are unhappy with how we handled a request, you can complain to the data protection authority where you live.

12 Children

NoqtaShop is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child’s data has reached us, tell us and we will remove it.

13 Changes to this policy

We will update this page when what we do changes. The date at the top is always the date it last changed, and if a change matters to you we will tell you rather than relying on you noticing.

14 Contact

privacy@noqtashop.com reaches whoever handles privacy questions. For anything about the contract rather than the data, see our Terms of Service or write to legal@noqtashop.com.