Privacy Policy

1. Our Commitment to Privacy

Hawwelly is committed to protecting the privacy of merchants and buyers who interact with our manual payment verification service. This document outlines how data is collected, stored, protected and deleted.

2. Information We Collect

We collect only the bare minimum technical data required to verify manual payments:

• Merchant Information: Store name, myshopify.com domain, merchant contact email, recipient InstaPay IPA handles, and wallet numbers.
• Buyer & Payment Proof Data: Sender name, bank/wallet reference number, uploaded screenshot file, and corresponding Shopify order ID.
• Optional details entered by the buyer: A mobile / WhatsApp number for contact and an email address, if provided.
• Order data from Shopify: Order number, total, currency and payment status, read through the Shopify Admin API (read orders) to confirm the order and its amount. We write review tags and metafields to the order and, only if the merchant turns it on, mark it as paid.
• Subscription data: Plan, status and dates, the transfer reference for subscriptions paid by direct transfer, and any promo code used.

🛡️ 3. Sensitive Financial Data We NEVER Store

Hawwelly NEVER asks for or stores banking passwords, ATM PINs, card CVVs, or OTP verification codes. All money transfers occur peer-to-peer (P2P) on official Central Bank of Egypt-regulated platforms.

4. How We Use Collected Data

• Presenting receipt screenshots to the merchant for 1-click verification.
• Updating the order in Shopify after merchant approval: a tag and review metafields, and marking it as paid if the merchant enabled that option.
• Delivering real-time status tracking timelines to the customer.
• Deduplicating transaction references to prevent slip reuse and fraud.

5. Security & Infrastructure

Data travels over encrypted connections (HTTPS) and is stored in a PostgreSQL database hosted in Frankfurt (Germany) with Neon; the app runs on Vercel in the same region. Payment links and receipt links are signed and time-limited, and only people with access to the store can open its receipts.

6. Third-Party Sharing

We never sell, rent, or trade merchant or customer data. We only use the infrastructure providers needed to run the service: Shopify (the store concerned), Vercel (hosting), Neon (database) and an email provider if email notifications are enabled. WhatsApp links open WhatsApp on the merchant's own device and the data does not pass through us.

7. Data Deletion & Contact

Payment proofs (names, transfer references and receipt images) are kept for 6 months from the day they are uploaded, then permanently and automatically deleted. When the app is uninstalled we remove the access keys to your store immediately, and the store data (receipts, payment methods, merchant account) is deleted when Shopify's deletion request arrives; we also process the customer data requests and deletions Shopify sends. Merchants may also request full data deletion at any time. For privacy inquiries or compliance requests, please contact: