This Privacy Policy explains how YKB Finance ("we", "us") handles personal data when you visit our website, request access, or use the YKB Finance platform (the "Service"). We have written it in plain language and in line with Egypt's Personal Data Protection Law No. 151 of 2020 and its executive regulations (together, the "PDPL").
The short version
- We only read your store, courier and ad data to calculate your real profit. We never change anything in your accounts, and we never take or hold payments.
- Your customers' phone numbers are stored only as salted hashes, never as readable numbers.
- You own your business data. You can export it and ask us to delete it at any time.
- We use a small number of service providers (hosting, email, WhatsApp, AI) to run the service, and we don't sell personal data.
1.Who we are
YKB Finance is a service operated by its founder in Egypt, who is responsible for the Service and for the personal data described in this policy.
For questions about this policy or your personal data, contact us on WhatsApp at +20 12 0486 6669.
2.Our two roles: controller and processor
Under the PDPL, the party that decides why and how personal data is processed is the controller, and a party that processes it on the controller's behalf is the processor. We act in both roles, depending on the data:
- We are the controller for data about our own users and prospects: the people who request access, hold an account, or contact us, plus billing records and usage logs.
- We are a processor for data about your end customers (the people who buy from your store). You, the seller, collected that data and decide what to import or connect, so you are its controller. We process it only to provide the Service to you, following your instructions as set out in these documents.
3.What data we collect
- Access requests: your name, business or page name, mobile number, email address (optional), approximate monthly orders, store platform, courier and any notes you send us through the request-access form.
- Account data: your name, email address, password (stored by our authentication provider as a one-way hash, never readable by us), role in the business, the business name and settings, and team members you invite.
- Billing data: your plan, subscription dates, amounts due and paid, payment reference codes, and proof-of-transfer images you send for InstaPay or bank transfers. We never receive card numbers or bank login details.
- Seller business data that you import (Excel/CSV files, Google Sheets) or sync from tools you connect: orders and order items, products and costs, shipments and delivery outcomes, courier payouts and fees, ad spend by campaign, expenses, and partner profit shares.
- End-customer data contained in your orders: phone numbers, which we convert to a salted SHA-256 hash before storage (the readable number is never saved), governorate and city, and order contents and amounts. We do not need or ask for customer names, street addresses or national ID numbers.
- Integration credentials: the access tokens you give us to read your store, courier or ad account, encrypted at rest.
- Notifications and AI: WhatsApp numbers and email addresses you choose to receive alerts and reports on, questions you ask the AI assistant and its answers, and usage counts.
- Usage and log data: sign-in times, IP address, browser and device type, pages visited, actions taken in the app, and error logs, used to keep the Service secure and working.
4.How we use data
- To review access requests, create invited accounts and let you sign in.
- To calculate profit, delivery, return, cash-flow and marketing reports from your data, and to show them to you and your team.
- To send the alerts, reports and renewal reminders you set up or need, by email and WhatsApp.
- To provide optional AI features, such as written insights and the assistant, when your plan includes them.
- To record payments, manage your plan and apply its limits.
- To secure the Service, prevent abuse, fix errors and keep an audit trail of administrative actions.
- To improve the Service using aggregated, de-identified statistics. We do not use your data to train AI models, and we do not sell personal data or use it for third-party advertising.
- To comply with legal obligations, such as tax and accounting record-keeping.
5.Legal bases
We process personal data only where the PDPL allows it, mainly on these bases:
- Contract: to provide the Service you signed up for and to take steps you request before signing up (for example, answering your access request).
- Legitimate interest: to keep the Service secure, prevent fraud, and improve the product, where this does not override your rights.
- Legal obligation: to keep billing records and respond to lawful requests from authorities.
- Consent: where the law requires it, for example for certain cross-border transfers or optional communications. You can withdraw consent at any time; this does not affect processing that already happened.
- For end-customer data, the seller as controller is responsible for having a valid legal basis to collect it and share it with us.
7.Data stored outside Egypt
Our main database is hosted in the European Union (Frankfurt), and some providers (such as Vercel, Anthropic and Meta) may process data in other countries, including the United States. This means personal data is transferred outside Egypt.
Because our providers host data outside Egypt (for example in the European Union), we use providers that offer contractual safeguards for the protection of personal data. By using the Service, you acknowledge that your data is hosted and processed outside Egypt as described in this section. We will take any additional steps required under the PDPL and its executive regulations.
We choose providers that offer strong security and contractual commitments, and we minimise what leaves our systems (for example, phone numbers are hashed before storage and are never sent to AI providers).
8.How long we keep data
- Account and business data: for as long as your account is active. After you close your account, we keep it for 30 days so you can export it, then delete it, unless you ask for earlier deletion.
- Read-only accounts: if a subscription lapses after the 7-day grace period, the account becomes read-only and your data is kept until you renew, export or ask us to delete it. If an account stays read-only with no activity for 12 months, we delete its data.
- Imported files and raw data: uploaded files are processed to extract rows; we keep only the normalized data. Where we keep raw copies of imported files or data received from connected tools (to re-process them after a fix), we delete them after at most 90 days.
- Access requests that do not become accounts: up to 12 months.
- Billing records and payment proofs: for 5 years, to meet Egyptian tax and accounting requirements.
- Security and audit logs: up to 12 months.
- Backups: deleted data may remain in encrypted backups for up to 30 days until they are overwritten.
9.How we protect data
- Encryption in transit (HTTPS) everywhere, and encryption at rest by our hosting providers.
- Integration tokens encrypted with AES-256-GCM before they are stored.
- Customer phone numbers stored only as salted one-way hashes.
- Row-level security in the database so each business can only access its own data.
- Read-only access to the stores, couriers and ad accounts you connect.
- Multi-factor authentication required for platform administrators, and every administrative action written to an audit log.
- Access to production data limited to the staff who need it.
No system is perfectly secure. If a personal data breach occurs, we will contain it, notify the Personal Data Protection Center and affected people where the PDPL requires, and tell affected sellers without undue delay.
10.Your responsibilities as a seller
For your end customers' data, you are the controller and we are your processor. This means you are responsible for:
- Having a legal basis to collect your customers' data and to share it with service providers like us, and telling your customers about it in your own privacy notice.
- Only importing or connecting data you are allowed to use, and not uploading data the Service doesn't need (such as national ID numbers or payment card details).
- Passing on to us any request from your customers that affects data held in the Service.
- Managing who on your team has access, and keeping your login details safe.
As your processor, we process this data only to provide the Service, keep it confidential and secure, use only the sub-processors listed above, help you respond to customer requests, and delete or return it when you close your account.
11.Your rights
Under the PDPL you have the right to:
- Know what personal data we hold about you and access or obtain a copy of it.
- Correct, update or complete it.
- Have it erased, or restrict its processing to a specific scope.
- Withdraw consent you have given.
- Object to processing, including for direct marketing.
- Be informed of any personal data breach affecting you.
To exercise these rights, contact us on WhatsApp at +20 12 0486 6669, using the email address or phone number linked to your account, or tell us how to verify your identity. We will respond within 30 days. Most account data can also be viewed, edited and exported directly in the app.
If you are an end customer of a seller who uses YKB Finance, please contact that seller first, because they control your data. If you contact us, we will forward your request to them.
If you are not satisfied with our response, you can complain to Egypt's Personal Data Protection Center.
13.Children
The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
14.Changes to this policy
We may update this policy as the Service or the law changes. We will post the new version here with a new "last updated" date and, for significant changes, notify account owners by email or in the app before the changes take effect.
15.Contact us
YKB Finance, a service operated by its founder in Egypt. Contact us on WhatsApp at +20 12 0486 6669.
Questions about this document? Contact us on WhatsApp at +20 12 0486 6669.