Privacy Policy

Mamashop is built around running a shop, so most of the information it holds is business data that a shop owner or their staff enters while using the app: shop details, products, prices, stock, sales, expenses, customers, suppliers, and related records. We do not ask for information unrelated to running the shop, and we do not collect data from anyone who is not using the app.

Mamashop keeps a local copy of shop data on the device it is installed on, using an on-device database (Drift/SQLite). This is what lets the app work while offline or when the internet connection is unreliable, which matters for shops that do not have a constant connection.

This local database is not encrypted at rest. Anyone with access to an unlocked device and its file system could potentially read the data stored there, the same as with most apps that keep a local database. We recommend keeping the device itself secured with a screen lock and not sharing it with people outside the business.

To back up shop data, keep it available across devices, and support features like reports and subscriptions, Mamashop securely synchronizes required application and business data to our backend, which runs on Supabase. Depending on how a shop uses the app, this can include:

• Shop and account information
• Products and product images
• Selling and buying prices
• Stock levels and stock movements
• Sales and sale items
• Payment method records for transactions (for example Cash, MoMo, Card, or Credit)
• Expenses
• Customers and customer phone numbers, where a shop owner chooses to enter them
• Customer credit and debt records
• Suppliers and supplier orders
• Employee and staff account information
• Subscription and payment information
• App version, device installation, and sync status information
• Technical and security logs needed to operate and protect the service (for example error logs and sign-in activity)

We do not claim that shop or customer data stays only on the phone. Syncing this data to our backend is a core part of how Mamashop provides backup, multi-device access, and subscription features.

We use the information described above to:

• Provide and operate Mamashop
• Synchronize data across a shop’s devices
• Back up data and help recover it if a device is lost or reset
• Support shop administration, such as managing staff and permissions
• Respond to customer support requests
• Protect the service against security threats and fraud
• Verify and manage subscription payments
• Generate reports and business analytics for the shop that owns the data
• Improve Mamashop and fix problems
• Produce aggregated, de-identified analytics about how the app is used across the platform, which is not tied back to an individual shop or customer

We do not sell individual shop data or individual customer personal data to advertisers or other third parties.

Mamashop subscription payments are processed entirely through the app store you installed the app from: Apple’s In-App Purchase system (StoreKit) on iOS, or Google Play Billing on Android. That store shows the subscription price and payment options available for your account and country. Mamashop does not directly process or store your card, mobile money, or bank details for subscription payments; we store the subscription and payment status Apple or Google provides, needed to verify and manage your subscription.

We rely on service providers to help run Mamashop:

• Supabase provides our backend, database, file storage, and authentication infrastructure.
• Google Play Billing processes Mamashop subscription payments on Android.

These providers can access the data needed to perform their service and are not permitted to use it for their own purposes.

We use reasonable technical and organizational measures to protect shop and customer data, including securing data in transit to our backend and restricting who can access production systems. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Sensitive credentials such as PINs, passwords, authentication tokens, and private security keys are not intentionally exposed through the admin dashboard.

We keep shop and customer data for as long as an account is active, so that a shop can keep using its history of sales, stock, and customer records. After an account is closed or deletion is requested, we retain only what is reasonably needed for legitimate purposes such as fraud prevention, dispute resolution, security, and compliance with applicable law, and we delete the rest.

A shop owner can request deletion of their account and the associated personal and business data by contacting us through the channel below. We will delete the requested data except for information we must legitimately retain, for example for accounting, security, fraud prevention, or legal compliance reasons. For step-by-step instructions, identity verification, and expected processing time, see our Account & Data Deletion page.

A shop owner can request a copy of the data associated with their shop, or ask what data we hold about their shop, by contacting us through the channel below. We will respond to verified requests within a reasonable time.

Mamashop is a business tool intended for shop owners and staff, not for children. It is not directed at children, and we do not knowingly collect personal information from children through the app.

We may update this policy as Mamashop changes. If we make material changes, we will update the “Last updated” date above, and where appropriate, notify shop owners through the app.

For privacy questions, or to request access, export, correction, or deletion of your data, please use the Mamashop Contact page.