Privacy Policy

1Who this policy covers

Merchants and teams: People who create an account to build pages, sell products, and manage orders, plus the team members they invite.
Suppliers: Businesses that list products for merchants to sell through Tajer.
Shoppers: People who visit a store or landing page built on GDM and place an order.
Visitors: Anyone browsing gdm-iq.com and our marketing pages.

2What we collect

Account details: Name, email address, phone number, password (stored only as a secure hash), and your language and team settings.
Billing details: Plan, billing history, and payment status. Card details go directly to Stripe; we never see or store your full card number.
Store content: Store names, products, images, prices, page designs, domains, and settings you create.
Orders and shopper details: What shoppers enter on a merchant's order form, such as name, phone number, city, and address, plus the products ordered. If a shopper starts a form but does not finish, we may save what they entered so the merchant can follow up.
Messaging: If you connect WhatsApp or Telegram, the messages and order notifications sent through those connections.
Device and usage data: IP address, browser and device type, pages viewed, and actions taken. We use IP addresses to block fake and duplicate orders.
Cookies: Small files that keep you signed in, remember your language, and protect forms from bots. See "Cookies and tracking" below.

3How we use it

To run the Service: host your pages, save orders, send notifications, and show you reports.
To process payments and manage your subscription.
To keep the platform safe: stop spam, fake orders, fraud, and unauthorised access.
To answer your support requests and send important account and service messages.
To understand how the Service is used so we can fix problems and improve it.
To send product news and offers, only if you agreed. You can unsubscribe at any time.
To meet our legal obligations and enforce our Terms.

4Shopper data on merchant pages

When a shopper orders from a merchant's page, the merchant decides what to collect and how to use it. GDM stores and processes that data on the merchant's behalf so they can fulfil the order.

Merchants can connect advertising pixels (such as Meta, TikTok, Snapchat, or Google) to their pages. When they do, those platforms may receive information about page visits and orders, under the platforms' own privacy policies.

If you are a shopper and want to change or delete your order details, contact the store you ordered from first. If you cannot reach them, email us and we will help.

5Who we share it with

We do not sell personal data. We share it only in these cases:

Service providers: Companies that run parts of the Service for us: Supabase (database, login, and file storage), Vercel (hosting), Stripe (payments), Cloudflare Turnstile (bot protection), and email delivery providers. They may only use the data to provide their service to us.
Tools you connect: If you connect WhatsApp, Telegram, Google Sheets, or advertising pixels, we send them the data needed for that connection to work.
Legal reasons: If the law, a court, or a government authority requires it, or to protect the safety and rights of our users and of GDM.
Business changes: If GDM is merged, acquired, or sells assets, data may move to the new owner under the same protections described here.

6Cookies and tracking

We use essential cookies to keep you signed in, remember your language, and protect forms. Without them, the Service cannot work properly.

Merchants' pages may also load the advertising pixels the merchant has connected. You can block or delete cookies in your browser settings, but some features may stop working.

7How we protect it

All data is encrypted in transit with HTTPS (TLS).
Passwords are hashed, never stored in plain text.
Access to data is limited by role, both inside your team and inside GDM.
Bot protection and rate limits guard the login and order forms.
Databases are backed up regularly.

No system is perfectly secure. If we discover a breach that affects your data, we will tell you without undue delay.

8How long we keep it

We keep your data while your account is active. After you delete your account, we remove your data within 30 days, except records we must keep for legal, tax, accounting, fraud prevention, or dispute reasons. Those are kept only as long as needed, then deleted.

9Your rights and choices

You can ask us to:

Give you a copy of the personal data we hold about you.
Correct data that is wrong or incomplete.
Delete your account and data.
Export your data in a common format.
Stop using your data for marketing, or limit how we use it.

Most of this you can do yourself in your dashboard. For anything else, email support@gdm-iq.com. We may ask you to confirm your identity first.

10Our mobile app

This policy also covers our mobile app for iOS and Android. In addition to the data above, the app uses:

Camera: Only to scan product barcodes and supplier return QR codes. Images are processed on your device and are not recorded or uploaded.
Photos: Only the images you choose to upload for products or categories.
Files: CSV or text files you choose to import, and invoice PDFs you create to share.
Secure storage: Your login session is stored using your device's secure storage (iOS Keychain or Android Keystore).

The app has no advertising, no third-party analytics, and no cross-app tracking. It does not access your location, contacts, or microphone.

11Children

The Service is not for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, email support@gdm-iq.com and we will delete it.

12Where data is stored

Our providers may store and process data on servers outside Iraq. Wherever data is stored, we require the same level of protection described in this policy.

13Changes to this policy

We will update this policy when our practices change and change the "Last updated" date above. For important changes, we will also tell you by email or in your dashboard.