Privacy Policy

1. Scope

This Privacy Policy explains how Kranotech Studios FZE (“OrderHood”, “we”) handles personal data. This includes both (a) platform-level data we control directly — collected through the marketing website, Tenant signup, and Tenant login — and (b) Customer data (names, contact details, delivery addresses, and order history) submitted through a Tenant's storefront, which we host and process on our infrastructure to provide the Platform's Services, including order management and the Tenant's own business analytics dashboard. For that Customer data, as explained in Section 9 of the Platform Agreement, the Tenant is the data controller — it determines how that data is used toward its own Customers and is responsible for its own privacy practices and legal compliance — while OrderHood acts only as the Tenant's data processor, handling it solely to provide the Services.

2. Data We Collect

We collect the following platform-level data:

• Account data: name, email address, phone number, and password (stored as a bcrypt hash, never in plain text) when a Tenant signs up or an Admin user is created.
• Business data: store name, subdomain, logo, and business details a Tenant provides when setting up its storefront.
• Billing data: subscription plan, billing history, and payment status. Subscription payments are processed through a third-party payment gateway — card and bank details are collected and stored directly by that gateway, not by us.
• Usage data: log data such as IP address, browser type, and pages visited, collected automatically for security and diagnostics.

We also host and process the following on behalf of each Tenant, as its data processor (see Section 1):

• Customer/order data: names, contact details, delivery addresses, and order history submitted by a Tenant's Customers through that Tenant's storefront — processed to power order management, the Tenant's Customer list, and its business analytics dashboard. This is separate from payment card/bank details for those orders, which — where a Tenant enables online payments — are collected and stored directly by that Tenant's own chosen payment processor (Razorpay, Stripe), not by us.

3. How We Use It

We use this data to: create and authenticate accounts (including sending one-time login codes by email); operate and bill for the subscription; provide customer support; send service-related notices; detect and prevent fraud or abuse; and improve the Platform.

4. Who We Share It With

We share platform-level data only with the third parties needed to run the Platform, including:

• A third-party payment gateway — to process subscription billing, collect payment details, and handle related billing support;
• Email delivery providers — to send login codes and account notices;
• Cloud infrastructure and object storage providers — to host the Platform and stored files;
• WhatsApp/Meta — only where a Tenant enables WhatsApp order notifications, and only for that purpose.

Customer/order data is shared only with the relevant Tenant itself (whose storefront the order was placed on, so it can manage its own orders and Customers), the same infrastructure/notification providers listed above, and — where that Tenant enables online payments — that Tenant's own chosen payment processor. We do not sell personal data to third parties.

5. Data Retention

We retain account and billing data for as long as the account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations. A Tenant may request deletion of its account data by contacting us, subject to records we are required to keep by law. Customer/order data is retained for as long as the relevant Tenant's account is active, so that Tenant can continue to manage its own order history, Customer list, and business analytics.

6. Cookies & Similar Technologies

The Platform uses essential cookies and local storage to keep you signed in and to remember basic preferences. We do not currently use third-party advertising or tracking cookies.

7. Security

We use industry-standard measures — including password hashing, encrypted connections, and access controls — to protect the data we hold. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, or request deletion of your personal data. To exercise these rights for platform-level data, contact us at the address below. For Customer data submitted through a specific Tenant's storefront, contact that Tenant directly — as the data controller for that data, the Tenant is responsible for responding to your request, and can instruct us, as its data processor, to act on it.

9. Changes to this Policy

We may update this Privacy Policy from time to time; the version date at the top of this page reflects the version currently in force.

10. Contact

Questions about this Privacy Policy or your data can be directed to [email protected], or by mail to Kranotech Studios FZE, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates.