Privacy Policy
1. Introduction
Welcome to Umsiyeti. Umsiyeti is operated from Nouakchott, Mauritania and provides a mobile application and website (together, the 'Service') that connects clients with wedding venues, event services, honeymoon trips, transport, and related providers. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the rights you have over it. By using the Service you accept the practices described below.
2. Information You Give Us
When you create an account or use the Service we collect: your name, phone number, email address, password (stored hashed), profile picture, preferred language, and, when relevant, your physical address, city, and a precise pin you place on the map for delivery, event location, or to find services nearby. Providers additionally give us their business name, service descriptions, photos and videos of services, pricing, availability, and bank or mobile-money payout details. When you book a service or make a payment we collect the booking details, the amount and currency, and a transaction reference; we do not store your full bank card number. That is handled directly by Stripe.
3. Information Collected Automatically
When you use the Service we automatically collect: device type and operating system, app version, language and region settings, an anonymous installation identifier, your approximate IP-based country, in-app interaction events (screens viewed, taps, errors), crash reports and performance traces (via Sentry), and push-notification tokens issued by Apple or Google. On the website we use only essential cookies needed to keep you signed in and remember your language.
4. Location Information
Umsiyeti uses precise location only while the app is in use and only after you grant permission in the system prompt. We use it to (a) sort services by distance from you, (b) show services on a map, and (c) let you pin a delivery or event address that is then shared with the relevant service provider so they can deliver the service. Umsiyeti does not collect location in the background and does not build a movement profile. You can revoke location permission at any time from your device Settings without losing access to the rest of the app.
5. AI Assistant
Umsiyeti includes an in-app AI assistant ('Umsiyeti AI') that helps you find services, plan a wedding, or summarise listings. When you use the assistant, the messages you send and the relevant context (your selected city, currency, language, and the listings being discussed) are forwarded to a third-party large-language-model provider (currently OpenAI, accessed through OpenRouter) so the assistant can produce a reply. We do not authorise that provider to use your messages to train its models. We retain a copy of the conversation linked to your account so you can re-open the chat and so we can investigate abuse. Do not enter sensitive personal information (national ID numbers, bank passwords, medical details) into the assistant. Replies are generated automatically, may be inaccurate, and are not professional, legal, financial, or medical advice.
6. Photos, Videos, Camera and Contacts
If you choose to upload a profile picture, listing image, or proof-of-payment receipt, the photo is uploaded to our storage (Cloudflare R2 / Supabase Storage) and linked to your account. The camera is used only to scan QR codes on event invitations; it does not record. If you choose to import contacts to add wedding guests, we read only the names and phone numbers of the contacts you select. We do not upload your full address book, and contacts stay on your device until you specifically add a guest.
7. Payments
Payments on Umsiyeti are processed by two providers: Stripe (international cards) and Bankily B-PAY (Mauritania mobile money). When you pay, the payment provider receives the data needed to process the payment (amount, currency, your name, and, for cards, your card details entered into Stripe's secure form). Umsiyeti receives only a transaction status and a reference. Stripe and B-PAY are independent data controllers for the payment data they collect; their privacy policies apply in addition to ours.
8. Push Notifications
If you allow notifications, we send messages about your bookings (status updates, reminders), messages from providers, and occasional service announcements. Notifications are delivered through Apple Push Notification service (iOS) and Firebase Cloud Messaging (Android) using a token tied to your account. You can disable notifications at any time in your device settings.
9. How We Share Information
We share information only with: (a) the service provider you book with, who needs your name, contact, address, and order details to fulfil the booking; (b) our payment processors (Stripe, Bankily B-PAY) to process transactions; (c) the AI provider (OpenAI via OpenRouter) for messages you send to the AI assistant; (d) infrastructure providers who host the Service on our behalf: Supabase (database and authentication), Cloudflare (media storage and CDN), Sentry (crash reporting), Apple and Google (push notifications, OAuth sign-in); (e) law-enforcement or regulators where we are legally required to do so; (f) a successor entity in the event of a merger, acquisition, or sale of assets. We never sell or rent personal data.
10. Data Retention
We keep your account data for as long as your account is active. When you delete your account, personal information is removed from our active systems within 30 days, except for records we are required to keep to satisfy tax, accounting, fraud-prevention, or other legal obligations. Those are retained for up to 7 years and access is restricted. Booking and payment records are retained per the laws applicable in Mauritania. Crash and diagnostic logs are kept for 90 days.
11. Your Rights under GDPR (European Economic Area & UK)
If you are in the EEA or the UK, you have the right to: access the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or object to certain processing, receive a portable copy, and withdraw any consent you have given. To exercise any of these rights, email hello@umsiyeti.com from the address on your account. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
12. Your Rights under CCPA (California)
If you are a California resident, you have the right to: know what personal information we have collected about you in the previous 12 months, request deletion of that information, opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioural advertising), and not be discriminated against for exercising these rights. To exercise these rights, email hello@umsiyeti.com.
13. Children's Privacy
Umsiyeti is not directed at children under 13 and we do not knowingly collect personal data from anyone under 13. To make a payment or place a booking on Umsiyeti you must be at least 18 years old, or the legal age of majority in your country, and able to enter into a binding contract. If you believe a child has provided personal information to us, please contact hello@umsiyeti.com and we will delete it.
14. International Transfers
Umsiyeti operates from Mauritania, but our infrastructure providers (Supabase, Cloudflare, Sentry, OpenAI/OpenRouter) operate servers primarily in the United States and the European Union. By using the Service you understand that your personal information may be processed in those jurisdictions. We rely on the Standard Contractual Clauses or equivalent safeguards where required.
15. Security
We use industry-standard measures to protect your information: HTTPS / TLS for all network traffic, encryption at rest in our database and storage providers, hashed passwords, row-level security policies on the database, secret rotation, rate limiting on sensitive endpoints, and an in-house payment kill-switch. No method of transmission or storage is 100% secure; if we become aware of a security incident affecting your data we will notify you and the competent authorities as required by law.
16. Account Deletion
You can delete your Umsiyeti account at any time from inside the app: open Settings, scroll to the bottom and tap 'Delete Account'. Deletion removes your profile, listings, and personal data within 30 days, subject to the retention exceptions in section 10. If you cannot access the app, email hello@umsiyeti.com from the email address on your account and we will process the deletion within 30 days.
17. Changes to This Policy
We may update this Privacy Policy from time to time. The 'Last updated' date at the top reflects the latest revision. For material changes we will notify you in the app and, where required by law, ask for your consent. Continued use of the Service after a change becomes effective means you accept the updated policy.
18. Contact
Umsiyeti (Thurayya Tech), Nouakchott, Mauritania. Email: hello@umsiyeti.com. For privacy enquiries, please write 'Privacy' in the subject line.
If you have any questions about this Privacy Policy, or to exercise any of your rights, please contact us at hello@umsiyeti.com.