Privacy Policy

1) Data Controller

2) Data We Collect

• Account data: name, email, mobile phone number (verified by an SMS code), password (stored hashed), roles and permissions, and the date you accepted our Terms and this policy.
• Usage data: technical logs (IP address, browser, device), actions in the app, timestamps, session identifiers.
• Business data: products, prices, orders, and settings you enter or import into the app.
• Your customers' data: names, phone numbers, delivery addresses, and order details of your customers, received from the stores and channels you connect (Shopify, WooCommerce, PrestaShop, Google Sheets, TikTok lead forms) or entered manually. For this data, you are the data controller and Prestio acts as your processor: we only process it to run the Service on your instructions (order confirmation, shipping, tracking).
• Integration credentials: API keys and access tokens you provide for delivery providers and sales channels, stored encrypted.
• Support data: messages and attachments you send to support or through the contact form.
• Callback requests: the name, phone number, orders per day, website and language you give on our callback request page, and the ad that brought you there (the link's utm_* parameters and Facebook click ID).
• Google and Facebook data (if you use them): only the fields you authorize on their consent screen: your name, email, and account ID when you sign in, and the Google Sheets you choose to connect.

3) Purposes and Legal Bases

Note: Prestio does not sell personal data and does not use your Google data for personalized advertising.

4) Cookies and Local Storage

Essential cookies, which the Service needs to work, do not require consent. Optional cookies are only set if you accept them in the cookie banner, and you can change your choice at any time from the "Cookies" link in the footer.

• prestio_session (essential): keeps you signed in during your visit. Expires after a period of inactivity.
• XSRF-TOKEN (essential): protects forms against cross-site request forgery. Same duration as the session.
• remember_web_* (essential): keeps you signed in between visits, only if you tick "Remember me". Up to 400 days, or until you log out.
• appearance and sidebar_state (preferences): remember your light/dark theme (1 year) and whether the dashboard sidebar is open (7 days).
• cookie_consent (essential): remembers your cookie choice. 6 months, after which we ask again.
• Local storage: your language, theme, and dashboard menu layout are also kept in your browser's local storage. They never leave your device.
• _fbp and _fbc (optional, Meta pixel): set by Meta's pixel on our homepage, signup page and callback request page, only if you accept all cookies. They let Meta measure how our Facebook and Instagram ads perform and show them to people who visited our site. 90 days.

5) Sharing and Processors

We do not sell personal data. We share it only as needed to provide the Service, with providers bound by confidentiality and security obligations, or when required by law.

6) Hosting and International Transfers

Some of our providers may host or process data outside Algeria. Any such transfer is made in accordance with Law No. 18-07, including prior authorization from the national personal data protection authority (ANPDP) where required, and, for data covered by the GDPR, with appropriate safeguards such as the EU Standard Contractual Clauses.

7) Retention

• Account data: for as long as your account is open, then deleted, subject to legal obligations.
• Your customers' data: for as long as your account is open. When you close it, we delete it unless the law requires us to keep it.
• Security logs: 6–12 months.
• Billing records: per legal requirements (typically 5–10 years).
• Support and contact messages: 24 months after the last exchange.

8) Security

We implement appropriate security controls: encryption in transit (HTTPS), hashed passwords, encrypted integration credentials, optional two-factor authentication, access controls, backups, logging, and data minimization.

9) Your Rights

Under Law No. 18-07 you have the right to be informed, to access your data, to have it rectified, updated, or deleted, and to object to its processing for legitimate reasons, including for direct marketing. If you are in the European Union, the GDPR also gives you the rights to restriction and portability. You can withdraw your consent at any time (for cookies, from the "Cookies" link in the footer), and close your account from your profile settings. You may lodge a complaint with the national personal data protection authority (ANPDP) or, in the EU, with your local supervisory authority. If you are a customer of a merchant who uses Prestio, please contact that merchant first; we will help them answer your request.

10) Children

The Service is intended for businesses and professionals and is not directed at minors. We do not knowingly collect children's data.

11) Changes

We may update this policy. The latest version is published on this page with an updated date, and material changes are notified by email or in the app.