Privacy Policy

Last updated: 28 October 2026 — Version: 1.5

This page states exactly what we collect, why, who can see it, how long we keep it, and how you delete it. It describes what the software actually does — not what it might do one day. If we change the software, we change this page with it and record the date above.

The Arabic version is the authoritative text; this English translation is provided for convenience.

1. Who we are

Mersatna is a Mauritanian platform that provides two things in one application:

An online marketplace where merchants list their products for customers.
A complete accounting program with which a merchant runs inventory, invoices, cash, debts, branches and staff.

It is used on mobile (Android and iOS) and in the browser. “We” means the operator of the Mersatna platform.

2. Two roles, not one

Your own data (your account, your store, your use of the program) — we are responsible for it and this policy governs it.
The data a merchant types in about his own customers (names, phone numbers, debts, invoices) — the merchant decides it and is responsible for it; we store and process it on his behalf so that the program works. A customer of a merchant who wants to know or delete what the merchant holds about him should ask the merchant; we help the merchant carry that out.

Under the Terms of Use, the merchant must have a lawful basis for entering his customers’ data and must inform them where required. He knows his customers; we do not.

3. What we collect

3.1 What you give us

To create an account: your phone number (verified once by a code sent to it), a password you choose and sign in with afterwards, and your name so you can be identified in chats and orders. We ask for no email address and no account at any other provider.
An internal identifier derived from your number so the authentication system can recognise it (in the form 2223xxxxxx@…). It is not an email address, nothing is ever delivered to it and it is shown to no one — we mention it only so it is not mistaken for us collecting your email.
To create a store: store name, short name used in its link, logo, description, address, map location if you choose to set it, contact numbers, product categories, and the payment accounts it accepts (as you type them, so your customers can see them), and your tax number if you set one — it is printed on your invoices.
Content you publish: product photos, names, prices and descriptions; promotions; order photos; and chat messages (text, images and voice notes).
Your accounting data: products, costs, stock (including item codes and expiry dates if you enter them), branches and warehouses; customer and supplier records and balances; invoices, expenses, cash movements and payment accounts; stock-count sheets; inter-branch shipments (what was sent, what was received, what was short and why) and step-by-step sales orders in branches that work in steps (their items, amounts, the customer name if you choose one, and what was collected against them), each carrying the name of the employee who performed every step, with its time and place; staff accounts and entries; the partners and capital ledger (partner names, each partner's type of participation and profit share, their capital, current account and loan with all movements, and settlement documents with their profit-distribution lines).
If you request a subscription or a purchased edition: any payment receipt you attach and what you write in the request.

3.2 What your use of the program creates

Orders, chats, ratings, follows and favourites.
Your store’s activity log: who did what and when (priced an item, settled a balance, corrected a batch’s expiry date, managed a branch). It belongs to you and your team, and it is how you review your staff’s work.
Aggregate statistics: product view counts and daily summaries for your store. These are numbers; they carry no visitor identity.

3.3 What is collected technically

A device notification token (if you allow notifications), so that what concerns you reaches you. It is removed from your account when you sign out.
An app attestation token (App Check), which proves a request came from our app and not from an automated script.
Crash and error reports: when a screen fails or an operation breaks for a technical reason, a report is sent containing a description of the error, its location in the code, the platform, the app version and your store identifier. The text is sanitised on your device before it is sent: phone numbers, email addresses, long identifiers and any number of four digits or more (so, amounts) are masked. Without these reports we do not know something broke for you unless you call us.
At our service provider (Google): IP addresses and technical connection data are recorded in its security logs. We do not store your IP address in our database and do not build a profile from it.
In the lifetime purchased edition: a device identifier is read to activate the licence and to stop it being moved to unlimited devices.
A device code the app generates on your device — a random code the app creates and stores locally. It is not a hardware identifier and not a phone serial number. It has one purpose: when you record an invoice with no internet, the invoice takes a number from this device's own series (such as INV#G8YR-0007) so it cannot collide with the numbering of another device in your store, and your receipt has a number you can quote to a customer before the connection returns. The code is stored in your own store's invoices — it is never used for tracking or to identify you, and it disappears when you clear the app's data from your device.

4. What we never collect

No bank card data and no payment inside the program. Payment happens outside the app by local means; card numbers never pass through us.
Not your password itself. It is never stored with us in readable form: the authentication system keeps it hashed with a salt. We cannot read it, and we cannot recover it for you — even if you ask. If you forget it, you set a new one with a code sent to your number.
No call content and no WhatsApp messages. The call and WhatsApp buttons open your phone’s own app; whatever happens after that is between you and the other party.
Not the PIN that locks the program on your device: it is stored on the device itself, is never sent to us, and we cannot lift it for you.

5. Why we collect it

To run the service: sign-in, your store, your accounting, orders, chats and notifications.
To keep your data so you find it on any device and can restore it.
For platform safety: preventing impersonation, abuse and manipulation, and applying limits.
To fix defects and measure software quality.
For accounting between us: subscription requests and payments.
To contact you about your account and your store.

We do not sell your data, rent it, or trade in it.

6. Basis for processing

Performing our agreement: what is needed to run the account, the store and the accounting program.
Legitimate interest: platform security, abuse prevention, fixing defects, and keeping accounting records.
Your consent: notifications, setting the store’s map location, and the advertising tracking permission — each withdrawable as it was given.
Legal obligation: what we must keep or disclose under law or a court order.

7. Notifications, ads and tracking

Notifications

You receive notifications about what concerns you: a new order, a message, your store’s status, a stock or expiry alert. You can turn them off in the program’s settings or in your device settings at any time.

Advertising measurement (Meta)

In the mobile app we use a measurement tool from Meta (Facebook) to learn which of our ads brought users, so events such as “app installed” and “product viewed” are sent to it. On iOS this only happens if you allow it in the system’s App Tracking Transparency prompt, and you may refuse it or change it later in your device settings. On Android, collection of the advertising identifier follows the same permission.

This tool is in the mobile app only: the browser version does not include it, and the lifetime purchased edition does not include it.

8. Who can see your data

You, and whoever you add to your store’s team, according to the permission you grant them — you grant and you revoke.
And whoever you transfer your store’s ownership to, if you do. A transfer happens only by an offer from you and acceptance by them, and only to the holder of an existing account on the platform. Once accepted, they become the controller of all of the store’s data — your ledger, invoices, customer records, their balances and their numbers — and your access ends immediately: no visibility and no authority remain. Both parties are notified and the transfer is written to a record that is never erased. So if your ledger holds anything you do not want another person to see, delete it before transferring, or do not transfer.
Your customers see what you published publicly (the store, its products and promotions) and what you wrote to them in chat.
The platform team sees what administration and support require: store status and public data, subscription requests and payments, the audit log, and error reports. It does not browse your accounting ledger: server-side access rules restrict it to what a given permission allows, and every sensitive administrative action is written to an audit log.
Service providers the platform runs on:
- Google — Firebase (authentication, database, storage, functions, messaging, hosting): stores and processes data on our behalf.
- Meta (advertising measurement in the mobile app only, with your permission — see section 7).
And on a lawful request from a competent authority, to the extent required.
And anyone you hand a copy you exported yourself. The app gives you two: an encrypted one we cannot read and that opens only with a passphrase you choose (and restores only into the same store), and a readable export — Excel and CSV tables and a summary sheet — which is not encrypted and contains your customers’ numbers, their balances and your profits. Once it leaves the app it is in your hands alone: keeping it, and whoever you show it to, is your responsibility.

9. Where your data is stored

On Google Cloud / Firebase servers, which are outside Mauritania (Google data centres, including the United States where our server functions run). By using the service you understand that your data is transferred and processed abroad, and that Google protects it under its contractual and technical controls.

10. Retention and deletion

What	How long
Your account, store data and accounting ledger	As long as the account or store exists
A store you closed	It is locked immediately and disappears from customers; its data is kept for 30 days by default (a period the platform sets between 7 and 90 days and which is shown to you on closure), during which you can restore it with all its data. After that, its data and image folder are deleted irreversibly and its short name is released.
An account you asked to delete	Your sessions are revoked immediately and every store you own is closed. You have the same grace period to undo it by signing in with the same account. After that, your account, your user document and your authentication record are deleted.
Phone fingerprint kept after deletion	We keep a one-way cryptographic fingerprint of your phone number (`SHA-256`) with a flag that the free trial was used. We do not keep the number itself, and the fingerprint is never readable from the app or a browser. Its only purpose is to stop the free trial being recycled with a new account.
What the books of a store you worked in attribute to you	If you were a staff member in someone else's store: your membership ends the moment you delete your account and you can no longer enter that store — but the sales, purchases and entries you recorded there, your account with it (what it owes you or you owe it), and its activity-log lines remain under your identifier and the name it had for you on the day of the work. These are the store owner's books, not your data: an entry without an author breaks the accounting trail and can lose a right of yours or theirs. Only the store owner may view them, and the activity log is deleted automatically after two years.
A "former employee" line — if your account with it was unsettled	If the store owed you, or you owed it, on the day of erasure, one line bearing your name, marked "former employee", stays in its team list. It grants you nothing: no access, no permission, no seat in the team. It stays only because the amount cannot be settled without a line saying whose it is — the store owner pays you what you are owed or deducts what you owe. It is deleted once settled. It carries nothing but the name the store had for you: no number, no permissions.
And what is erased from shared collections	Your chats with stores and their attachments, your ratings and their comments, and your follows are erased. Your name and number are erased from any request you opened, report you sent, or error record that carried your identifier; the record itself remains without identity (an open request stays as a work record for the stores that replied to it).
Payment records and subscription requests	Kept for accounting and audit after the store identity is stripped (the store name is replaced and the record is marked deleted) — the amount and date remain, the identity does not.
Administrative audit log	Kept: it is what proves what the administration did and when, and how disputes are settled.
Error reports	Grouped by error fingerprint rather than by user, and deleted 90 days after being addressed.
A reason for leaving, if you wrote one	Kept separately from your store (the store is erased, this remains) to improve the service.

11. Your rights and how to use them

Access: most of your data is shown to you inside the program, and you can export your ledger and back it up from “Your ledger and its backups”.
Correction: edit your account, store and product data inside the program.
Deletion: from inside the program, with no email and no waiting — “Delete my account” under “My account”, and “Close the store” in store settings. What happens is set out in section 10.
Withdrawing consent: turn off notifications, clear the store’s map location, or refuse the tracking permission — from the program or from your device settings.
Objection and complaint: write to us (section 16). If our answer does not satisfy you, you may refer the matter to the competent authority in Mauritania.

12. Security

Every connection to the service is encrypted in transit (HTTPS/TLS).
Server-side access rules, not only checks in the app: whoever lacks a permission is refused at the server even if the app is modified.
App Check — requests from the app carry a token proving they came from our app, used to block requests without one on the services where enforcement is switched on.
Your backups are encrypted with a passphrase you choose — whoever does not have it cannot open the file, and we do not have it.
A PIN lock for the program on your device, held on the device alone.
What we do not promise: no system is absolutely secure. Protect your phone and your account, do not grant permissions to people you do not trust, and keep a copy of your ledger yourself.

13. Children

The service is intended for people aged 18 or over: running a store and an accounting ledger is commercial activity. We do not knowingly collect children’s data; if you know of a child’s account, tell us and we will delete it.

14. Storage on your device

We do not use advertising tracking cookies on the website. What is stored on your device is what the service needs in order to work:

Your sign-in session (so you stay signed in).
A cache of your data so the program works offline and opens quickly, and an outbox that holds your operations until the connection returns.
The program’s own files in the browser cache (a service worker) so it starts without a network.
Your local preferences (dark mode, app lock, and so on).
Your device code and its numbering counter — so that what you record with no internet carries a number that cannot collide with another device (see 3.3).
And in the lifetime purchased edition: your whole ledger lives on your device and is not sent to any server.

Clearing this site’s data in your browser clears all of the above (and may clear operations that have not yet been sent).

15. Changes to this policy

If we change what we collect or why, we update this page and record the last updated date and version number at the top. If a change is material we tell you in the program before it takes effect. Continuing to use the service after it takes effect is acceptance.

16. Contact

To delete your account, or for any request concerning your data (a copy of it, or a correction): the account deletion and data requests page. It carries a form that reaches us directly, and it does not require the app to be on your device. We reply within a reasonable time.

The fastest route to delete an account is inside the app: My account → Delete account — it is immediate.