Enab Privacy Policy

1.Scope of this policy

It covers Enab's website enab.app, the dashboards, storefronts, mobile apps, APIs and MCP server.

Store customers' data (such as orders and delivery addresses) is controlled by the store, and we process it on the store's behalf to run its storefront. Each store may publish its own privacy policy; if you're a store's customer, contact that store first.

2.Data we collect

• Account data: name and phone number; business name, type, address and branches; logo and photos; staff names, phone numbers and roles.
• Store customer data: name, phone number and delivery address (plus GPS location if the customer allows it), order contents and notes, and ratings.
• Payment data: transaction amount, status and reference. Card details are entered directly with the payment gateway; we don't store card numbers.
• Usage and device data: IP address, browser and device type, signed-in sessions, technical request logs, and store visit counts.
• Website data: what you enter in sign-up and contact forms, bot checks (Cloudflare Turnstile), and visit analytics (Google Analytics) when enabled.
• Communications: WhatsApp messages, including verification codes, and support conversations.

3.How we use it

• To run the service: sign-in, showing storefronts, receiving and fulfilling orders, processing payments and requesting deliveries.
• To send notifications (new orders and updates) via the app, WhatsApp and email.
• For support, protecting the platform from fraud and abuse, and fixing bugs.
• To understand and improve how the platform is used, and to contact you about your subscription.
• To comply with the law and requests from competent authorities.

We don't sell personal data, and we don't use your store's or your customers' data for advertising.

4.Connecting AI assistants (MCP) such as ChatGPT and Claude

Enab's MCP server lets a store owner connect an AI assistant to their store to manage products, orders and offers by chatting. Here's what happens to your data when you connect one:

• Consent: a connection is only created after you sign in to the dashboard, pick one store and choose the scopes you allow (read or edit the catalog, read or update orders, read customers, read or edit promotions).
• Access: the assistant can only reach that store's data, within the scopes you chose and the permissions of the staff member who approved it. Permissions are re-checked on every request, so removing the staff member or their permission takes effect immediately.
• What's sent to the assistant: the results of the tools it calls — for example products, stock, orders, and customer names, phone numbers and addresses when it reads orders or customers. That data goes to the assistant's provider (such as OpenAI or Anthropic) and is handled under their privacy policy.
• What we store: the connection record (app name, store, user, scopes, last-used time) and SHA-256 hashes of its tokens — never the tokens themselves. Access tokens expire after one hour and refresh tokens after 90 days.
• Logging: for each request we log the time, IP address, client user agent, the name of the tool called and whether it succeeded. We don't log tool inputs or results. These logs are deleted automatically after 90 days.
• Sharing: we don't share MCP data with anyone other than the assistant you connected yourself, and we don't use it to train AI models.
• Revocation and deletion: you can pause or revoke any connection at any time from Dashboard → Settings → AI Assistant (MCP), or by disconnecting it inside the assistant. Revoking deletes the connection record and its tokens immediately. To have logs deleted before the 90 days are up, message us on WhatsApp.

5.AI features inside Enab

When you use the AI tools in the dashboard (such as generating descriptions or translating), we send the model provider (Google Gemini) only the text or image that task needs, and record the number of tokens used to apply your plan's limits.

6.Who we share data with

• Infrastructure, hosting, security and content-delivery providers (such as Cloudflare).
• Online payment gateways, to process payments.
• Delivery companies the store enables: we send them the shipment details and the customer's address and phone number.
• Messaging and notification services: WhatsApp, app push notifications and email.
• AI model providers and the assistants a store connects, as described in the two sections above.
• Google Analytics, for website visit statistics, when enabled.
• The store itself: the store owner and staff see their customers' order data.
• Competent authorities when the law requires it, or to protect our rights and our users.

Our service providers may only use the data to provide their services to us. If Enab is acquired or merges with another company, the data transfers with it under this policy.

7.Cookies and local storage

We use cookies and local storage to keep you signed in, remember your language, selected branch and cart, and for visit analytics. You can clear them in your browser settings, but some features may stop working.

8.How long we keep data

• Account, store and order data: for as long as the account is active, then deleted or anonymized within 90 days of closure — except financial records the law requires us to keep.
• Technical request logs in our database (including MCP logs): 90 days, then deleted automatically.
• Operational server logs: rotated and deleted on a rolling basis.
• Verification codes: expire within minutes.
• Backups: replaced on a rolling basis; deleted data may remain in them for a short time until they're replaced.

9.How we protect data

We use encrypted connections (HTTPS), store hashes of access tokens instead of the tokens, encrypt payment-gateway keys, and restrict access with role permissions. No system is perfectly secure; if a breach affects your data, we'll tell you.

10.Your rights and choices

• View and correct your data: most of it is available directly in the dashboard.
• Request a copy of your data or deletion of your account and its data: message us on WhatsApp from your registered number; we respond within 30 days.
• Revoke any AI assistant connection or MCP key at any time from the dashboard.
• Withdraw location (GPS) permission in your device settings.
• Store customers: contact the store first about your order data; if it doesn't respond, message us and we'll help.

11.Children

Merchant accounts on Enab are meant for adults, and we don't knowingly collect children's data. If you learn a child has given us their data, message us and we'll delete it.

12.Transfers outside Iraq

Some of our service providers (such as hosting, AI and analytics) process data outside Iraq. We choose providers that apply appropriate safeguards.

13.Changes to this policy

We may update this policy and change the “Last updated” date at the top. For material changes we'll notify you through the dashboard or WhatsApp.