Privacy Policy

1. Who we are

Qrenox is a software service (SaaS) that helps merchants confirm cash-on-delivery orders over WhatsApp.

The service is currently aimed at merchants in Morocco and does not currently target merchants or customers in the European Union. If we expand into the EU market in the future, we will consider appointing a representative under Article 27 of the General Data Protection Regulation (GDPR) and the registration steps required with Morocco's CNDP.

2. Our role in processing data

This is essential to understanding this policy. We handle two different types of data, and our legal role differs for each.

2.1 Merchant data — we are the controller

Data the merchant provides when creating an account and using the service. We determine the purposes and means of processing it.

2.2 The merchant's customer data — we are the processor

Data relating to the merchant's customers (name, phone number, address, order details, conversation content). The merchant is the controller, and we process this data on their behalf and solely according to their instructions.

The merchant's responsibilities as controller include:

• obtaining the consent needed from their customers to be contacted over WhatsApp
• complying with Meta's WhatsApp Business Platform policies
• responding to individuals' requests regarding their rights
• ensuring the data they upload to the service is lawful

The data processing agreement (DPA) entered into with the merchant governs this relationship in detail.

3. Data we collect

3.1 Merchant account data

3.2 The merchant's customer data

3.3 Data we do not collect

• We do not collect payment card data (payments are made by direct bank transfer)
• We do not knowingly collect special categories of personal data (health, religious, political, biometric)
• We do not use cookies for advertising tracking

4. Data sources

5. Purposes of processing and legal basis

6. Service providers (sub-processors)

We use service providers to run Qrenox. Each has a defined role, and we only share with them the data necessary to perform that role.

We inform merchants in advance of any change to the list of sub-processors.

7. International data transfers

Data is processed in the following countries:

• United States — the legal entity, and the AI provider (OpenAI)
• Depends on the selected data center — hosting (Hostinger)

No data is currently transferred to China or any country outside this scope.

8. Retention periods

Upon account closure: the merchant's data and their customers' data is deleted within 30 days, except for what must be retained under a legal obligation. Data disappears from backups within 90 days at most.

The merchant may request immediate deletion of their account and data by contacting us.

9. Individual rights

9.1 For merchants

• access their data and obtain a copy of it
• correct inaccurate data
• delete the account and associated data
• export their data in a machine-readable format
• object to processing based on legitimate interest
• request restriction of processing in certain cases
• lodge a complaint with the competent authority

To exercise these rights: contact@qrenox.com — we respond within 30 days.

9.2 For merchants' customers

We are a processor, not a controller, for this data. The request must be directed to the merchant who owns the store the purchase was made from, who is responsible for responding. We support the merchant technically in fulfilling the request.

10. Security

Technical and organizational measures in place:

• encryption of communications (HTTPS/TLS) on all paths
• encryption of sensitive credentials in the database
• password hashing with the PBKDF2 algorithm
• signature verification for every incoming webhook
• complete isolation of each merchant's data — no sharing between merchants
• role-based permissions enforced server-side
• encrypted daily backups
• audit log for AI operations and sensitive changes

In the event of a breach: we notify affected merchants and the competent authorities within the applicable legal deadlines.

11. Artificial intelligence

Qrenox uses language models to generate conversation replies.

What you should know:

• message content and order context are sent to the AI provider (OpenAI) to generate the reply
• every suggestion passes through a software validation mechanism before execution; the model proposes, it does not execute
• all model suggestions and system decisions are logged for audit and transparency purposes
• the merchant can disable AI entirely from the dashboard

The system does not make automated decisions with legal or similarly significant effects on individuals.

12. Cookies

We use only necessary cookies to run the login session and remember preferences (language). We do not use advertising tracking cookies and do not share data with advertisers.

13. Children

The service is aimed at businesses and does not target people under 16 years old. We do not knowingly collect their data. If we become aware of it, we delete it immediately.

14. Changes to this policy

We may update this policy. For a material change, we notify merchants by email or from the dashboard 30 days before it takes effect. The last-updated date appears at the top of the page.

15. Governing law and jurisdiction

This policy is governed by and construed under the laws of the State of Wyoming, United States of America, the state where StellarFlow LLC was formed.

16. Contact

For any question or request related to privacy:

Email: contact@qrenox.com
Postal address: 30 N Gould St Ste R, Sheridan, WY 82801, USA

Note: this is a structured draft, not a final legal document. Review by a specialist lawyer is recommended before final publication, particularly when expanding outside Morocco or receiving data from individuals in the European Union (appointing a GDPR representative, and putting in place a complete data processing agreement with OpenAI and Hostinger).

This page is a courtesy translation. In case of discrepancy, the Arabic version prevails.