PRIVACY
Privacy policy
Effective and last updated: 26 August 2026
This policy explains how EKMOBAIL FZCO processes personal data in the EKMOBAIL website, mobile application, customer account, catalogue, order, support and Price API services.
Data we process
Depending on how you use the service, we may process your name, email, phone or WhatsApp number, customer number, company name, country, role, registration details and website; order items, quantities, delivery address, comments, status, documents and chats; API applications, approval history, key metadata and API usage; and technical data such as IP address, device, operating system, app version, language, request times and security events. We do not collect payment-card details through these services.
Sign-in, one-time codes and sessions
The mobile app uses an email one-time code for sign-in and stores an authentication token in protected device storage after verification. One-time codes are used only to verify access; security records may show that a code was requested or checked, but should not contain the code itself. The website customer portal uses a customer access code and Secure, HttpOnly, SameSite session cookies. Signing out or deleting the account revokes applicable sessions and tokens.
Orders, support and Price API
We use contact, company, order, chat and document data to confirm availability, prepare commercial terms, fulfil and support requests, maintain an order history and respond to disputes. Company and contact data submitted for Price API access is used to review the application, communicate a decision, set limits and protect the API. API key secrets are displayed once; the service retains a protected verifier and operational metadata rather than a recoverable copy of the secret.
Push notifications
If you enable notifications, we may process an Expo push token, device platform, app version, notification preference and delivery result to send order, chat, account or API-review updates. Delivery can involve Expo and the Apple or Google push-notification service. You can disable notifications in the device settings; some transactional updates will remain available inside the app.
Product images and external content
Catalogue images and product content may be delivered from EKMOBAIL infrastructure or an authorised seller, marketplace or content-delivery network, including Ozon-hosted image domains. When remote content loads, that provider may receive technical information such as IP address, user agent and the requested URL or referrer as required to deliver it. External map, email and WhatsApp links are governed by the provider you choose to open.
Purposes and service providers
We process data to provide requested services, take steps before or perform a contract, communicate with you, secure accounts and systems, prevent abuse, comply with legal obligations and improve reliability. We may use hosting and cloud providers, email delivery, Expo, Apple, Google and content-delivery providers as processors or independent providers. We do not sell personal data or use order and account data for third-party advertising.
International processing
EKMOBAIL FZCO operates from the United Arab Emirates. Data may be accessed by authorised personnel in the UAE and processed by service providers in other countries. Where required, we use contractual, organisational and technical safeguards appropriate to the transfer and the service.
Retention
We keep account data while the account is active and retain orders, chats, documents, API applications, key status and security records only as long as reasonably needed for operations, legal or accounting obligations, fraud prevention and dispute handling. After an eligible deletion request, data that is no longer required is deleted or anonymised; protected backups age out through their normal lifecycle. Some transaction or security records may remain where law or legitimate claims require it.
Security
We use HTTPS, access controls, protected sessions, token and secret hashing, and encryption at rest for designated contact, address, chat, document and internal-note fields. Access is limited by role and operational need. No system is completely secure, so do not send passwords, one-time codes, payment-card details or API secrets by email or chat.
Your choices, deletion and contact
You may request access, correction or deletion and may object or withdraw consent where applicable. Delete an account in the app under Account → Delete account, or use the public deletion page linked below if you cannot sign in. We may verify identity before acting. Deletion revokes account and API access but does not automatically erase records that must be retained for an active order, legal obligation or dispute. This business service is not directed to children. We may update this policy when services or providers change.