1. Introduction and Scope

Welcome to Abanro. This Privacy Policy explains how Abanro (“Abanro,” “we,” “us,” or “our”) collects, uses, shares, retains, and protects personal information in connection with the Abanro platform — a service that turns Instagram Direct Messages (DMs) into a checkout experience for small and medium businesses.

The Abanro platform consists of three distinct applications that share a common backend infrastructure:

• Merchant Application (app.abanro.com): used by shop owners to manage products, orders, payments, and Instagram integrations.
• Public Storefronts ({shop}.abanro.com): publicly accessible storefront pages where customers can browse and purchase products.
• Reseller Portal (resellers.abanro.com): used by independent resellers to refer merchants to Abanro and track commissions.

This Privacy Policy applies to all three applications, our marketing website at abanro.com, and any associated APIs, services, or features (collectively, the “Services”). By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

Important Note on Roles

Abanro typically acts as a Data Controller for information collected from Merchants, Resellers, and visitors to abanro.com. With respect to End Customer information processed through a Merchant’s storefront or Instagram DM checkout, Abanro acts as a Data Processor (or Service Provider, under CCPA) on behalf of the Merchant, who is the Data Controller for that customer relationship. Section 2 explains these roles in more detail.

2. Definitions and Roles

To make this Policy easier to read, the following terms have specific meanings throughout this document:

Controller vs Processor Map

Different categories of users have different relationships with us under data-protection law:

This means that if you are an End Customer and you have questions about how a specific Merchant uses your information beyond what is described in this Policy, you should also consult that Merchant’s own privacy notice. Abanro processes End Customer data strictly to provide the Services to the Merchant.

3. Information We Collect

We collect different categories of Personal Information depending on whether you are a Merchant, End Customer, Reseller, or general visitor. This section sets out, for each category of user, exactly what we collect and from what source.

3.1 Information We Collect from Merchants

When you sign up for and use the Merchant Application, we collect:

• Account identifiers: phone number (used for WhatsApp/SMS one-time password authentication) and, where provided, email address.
• Shop information: shop name, subdomain slug, currency, country, language preference, business policies (shipping, returns, contact), and SEO metadata.
• Catalog information: products, categories, variants, images, prices, and inventory levels. These are not Personal Information about you but are processed on your behalf.
• Payment configuration: the payment methods you enable (cash on delivery, bank transfer, Stripe Connect), bank account details where you choose to accept bank transfers, and your Stripe Connect account identifier (after you authenticate with Stripe).
• Subscription billing information: your current plan, subscription status, and Stripe customer/subscription identifiers. Card details are stored by Stripe and never by Abanro — we only receive tokens and metadata.
• Instagram integration data: your connected Instagram Business or Creator account, page identifier, long-lived access token (encrypted at the application level using AES-256), and metadata such as your Instagram username and follower count where available.
• Operational and product-usage data: login timestamps, setup-wizard progress, dashboard activity, feature usage counters, and webhook event logs.
• Communications: messages and tickets you send to Abanro support, founder follow-up notes, and email correspondence.

3.2 Information We Collect from End Customers

When an End Customer interacts with a Merchant’s storefront — either through Instagram DMs or through a public storefront page — we process the following on behalf of the Merchant:

• Instagram identifiers (DM channel only): Instagram user ID (ig_user_id), current Instagram username, and current profile picture URL. These are obtained from Meta when a customer messages the Merchant’s Instagram account.
• Web session identifiers (storefront channel): an anonymous cart token (web_session_id) used to maintain a shopping cart before checkout.
• Contact information provided at checkout: name, phone number, and email address as entered by the customer during the checkout flow. These values are stored both on the customer record and as immutable per-order snapshots.
• Shipping information: delivery address, city, state/region, postal code, and country, captured at checkout.
• Order content: items selected, quantities, prices, currency, shipping method, payment method, order status, and timestamps.
• Payment-method information: for cash on delivery, only the fact that COD was selected; for bank transfer, the receipt image the customer uploads as proof of payment; for online payments, only payment metadata returned by Stripe — Abanro never receives the customer’s full card number.
• DM conversation content: the DM messages exchanged between the customer and the Merchant’s connected Instagram account, including the message text and any media references, processed for trigger matching and order flow execution.
• Audit and abandonment data: first-seen and last-seen timestamps, last order date, cart status, and abandoned-cart reminder timestamps.

3.3 Information We Collect from Resellers

When you sign up for or use the Reseller Portal, we collect:

• Authentication identifiers: your Google account profile (name, email, Google user ID) if you sign in via Google OAuth, or your phone number if you sign in via phone OTP.
• Profile and referral data: your assigned referral code, the list of Merchants who signed up using your code, and your commission percentage and balance.
• Payout request data: bank account details (IBAN or equivalent account number, account holder name, bank name) and currency, submitted by you when you request a payout. These details are reviewed manually by the Abanro team.
• Activity data: login timestamps, payout history, and commission events derived from Merchant subscription invoices.

3.4 Information We Collect Automatically

When you use the Services, we automatically collect certain technical information, regardless of your user category:

• Device and connection data: IP address, browser type and version, operating system, device identifiers, and approximate location derived from IP.
• Log data: request URLs, HTTP methods, response status codes, timestamps, and referrer URLs.
• Session and security data: JWT identifiers, session deduplication keys stored in Redis, webhook signatures, and rate-limit counters.
• Cookies and similar technologies: see Section 14 for full details.

3.5 Information We Collect from Third Parties

We receive information about you from third parties in the following circumstances:

• Meta Platforms: Instagram user IDs, usernames, profile pictures, page metadata, follower counts, message events, and webhook payloads, received through the Instagram Graph API and Messenger Platform when a Merchant connects their Instagram account.
• Stripe: payment events, subscription invoice events, payout statuses, and customer/subscription identifiers.
• Google: for Resellers who choose Google OAuth, the profile information released by Google during sign-in.
• Resellers: if you were referred to Abanro by a Reseller, we record the association between your shop and that Reseller’s referral code.

4. How We Use Personal Information

We use Personal Information only for the purposes described below. We do not sell Personal Information, and we do not use Personal Information for advertising or for any purpose unrelated to operating the Services.

4.1 Operating the Services

• Creating and authenticating Merchant, Reseller, and Customer sessions.
• Routing Instagram DMs to the correct Merchant and matching them against product triggers and category codes.
• Creating and managing carts, orders, payments, and shipping records.
• Generating product cards, carousels, and order confirmations in DM conversations.
• Sending re-engagement messages for abandoned carts and order-status notifications.

4.2 Processing Payments and Subscriptions

• Processing customer order payments through cash on delivery, bank transfer receipt review, or Stripe Connect.
• Charging Merchants for their Abanro subscriptions via Stripe and reconciling invoice-paid events.
• Tracking Reseller commissions derived from paid Merchant subscription invoices and processing manual payout requests.

4.3 Maintaining Security and Integrity

• Validating Instagram webhook signatures, deduplicating message events, and preventing duplicate order creation.
• Enforcing shop isolation so that no Merchant can access another Merchant’s data.
• Detecting and preventing fraud, abuse, and unauthorized access.
• Maintaining audit logs for financial transactions, flow execution, and notification delivery.

4.4 Improving and Supporting the Services

• Diagnosing technical issues and improving system performance.
• Responding to support requests and communications you send us.
• Internal analytics on merchant activation funnels (signups, product creation, Instagram connection, first order) to guide product development. Internal analytics are conducted on the Abanro side and are not exposed to other Merchants or to Resellers.

4.5 Legal and Compliance

• Complying with applicable laws, regulations, court orders, and lawful government requests.
• Enforcing our Terms of Service and other agreements.
• Establishing, exercising, or defending legal claims.

5. Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on the following legal bases under the General Data Protection Regulation (GDPR) and equivalent UK and Swiss law:

Where we rely on legitimate interests, you have the right to object — see Section 12. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Instagram and Meta Platform Data

Because Abanro is fundamentally a DM-first commerce platform, our use of data obtained from Meta Platforms is central to the Services. This section is provided to comply with the Meta Platform Terms and to give you full transparency.

6.1 What Meta Data We Receive

When a Merchant connects an Instagram Business or Creator account to Abanro, and when an End Customer messages that account, we receive from Meta:

• Instagram user IDs for the customer and the Merchant.
• Instagram usernames and profile picture URLs (where available).
• Message events containing the text and timestamp of each DM exchanged with the Merchant’s account.
• Page metadata, follower count (where available), and a long-lived page access token.

6.2 How We Use Meta Data

• To match incoming DMs against the Merchant’s configured product codes, category codes, and keyword triggers.
• To send replies (product cards, carousels, checkout prompts, and order confirmations) back through the Messenger Platform.
• To display the customer’s Instagram username and profile picture to the Merchant inside the Merchant dashboard.
• To maintain conversation state, deduplicate message events, and enforce Meta’s outbound messaging rate limits.

6.3 How We Protect Meta Data

• Instagram long-lived access tokens are encrypted at the application level using AES-256. Database-at-rest encryption alone is not relied upon for these tokens.
• Webhook payloads are verified using the X-Hub-Signature-256 header before any processing.
• Webhook events are deduplicated through a Redis-based dedup key for each message ID.
• Instagram tokens that expire within ten (10) days are refreshed automatically by a nightly job. On failure, the Merchant is notified and prompted to re-authenticate.

6.4 Restrictions on Use

We use Meta Platform Data strictly to operate the Services on behalf of the Merchant. We do not:

• Sell, license, or rent Meta Platform Data to any third party.
• Use Meta Platform Data to build profiles for advertising or to enrich profiles outside the Abanro Services.
• Use Meta Platform Data to discriminate against or harm users, or to make eligibility decisions for housing, employment, insurance, credit, or similar protected categories.
• Use Meta Platform Data after a Merchant disconnects their Instagram account, except as necessary to maintain order history and audit logs in accordance with Section 10.

6.5 Disconnection and Deletion

A Merchant may disconnect their Instagram account at any time from the Merchant dashboard. Upon disconnection, we stop receiving new Meta Platform Data and we delete or anonymize stored Instagram tokens. Existing orders retain their immutable customer snapshots in accordance with Section 10, but live profile fields (such as ig_profile_picture_url) cease to be updated.

7. Payment Information and Third-Party Processors

Abanro supports three customer payment methods and one subscription payment system. Different payment methods involve different third-party processors and different data flows.

7.1 Customer Order Payments

7.2 Merchant Subscription Payments

Merchant subscriptions to the Abanro platform are billed exclusively through Stripe in subscription mode. Stripe handles all card data; Abanro receives only the customer identifier, subscription identifier, invoice events, and amounts. Customer order payments and Merchant subscription payments are processed through separate webhook endpoints, separate signing secrets, and separate database tables — they are never commingled.

7.3 Reseller Payouts

Reseller payouts are processed manually by the Abanro operations team. When you request a payout, you provide your bank account details (IBAN or equivalent, account holder name, bank name, currency). These details are stored to enable the manual transfer and are accessible only to authorized Abanro personnel.

7.4 Stripe’s Privacy Policy

Stripe is an independent Data Controller for the payment data it processes. Stripe’s privacy practices are governed by Stripe’s own privacy policy at https://stripe.com/privacy. We recommend you review it if you make a payment or sign up for a paid Abanro plan.

8. How We Share Information

We share Personal Information only as described in this Section. We do not sell Personal Information, and we do not share it for cross-context behavioral advertising.

8.1 With Merchants

End Customer information collected through a Merchant’s storefront or DM checkout is shared with that Merchant. The Merchant uses this information to fulfill orders, communicate with customers, and operate their business. Each Merchant only sees information for their own shop — shop isolation is enforced on every database query and is one of our non-negotiable security rules.

8.2 With Service Providers (Sub-Processors)

We engage trusted third parties to provide infrastructure and operational services. Each sub-processor processes Personal Information on our behalf, under written agreements, and only for the purposes we specify:

8.3 With Resellers

Resellers see only aggregated and limited information about the Merchants they have referred — for example, store name, plan, subscription state, and approximate earnings. Resellers do not see Merchant order details, customer information, or Instagram tokens.

8.4 For Legal Reasons

We may disclose Personal Information if we believe in good faith that disclosure is necessary to:

• Comply with a law, regulation, legal process, or governmental request.
• Enforce our Terms of Service or other agreements.
• Detect, prevent, or address fraud, security, or technical issues.
• Protect the rights, property, or safety of Abanro, our users, or others.

8.5 In Connection With a Business Transfer

If Abanro is involved in a merger, acquisition, reorganization, financing, or sale of assets, Personal Information may be transferred to the acquiring or successor entity, subject to the protections described in this Policy.

9. International Data Transfers

Abanro’s infrastructure is hosted on Microsoft Azure, and Personal Information may be processed in countries other than the country in which you reside. These countries may have data-protection laws that differ from those in your jurisdiction.

When we transfer Personal Information out of the EEA, the United Kingdom, or Switzerland, we rely on appropriate safeguards under GDPR, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• The UK International Data Transfer Agreement or the UK Addendum to the SCCs.
• Adequacy decisions where the destination country has been recognized as providing an adequate level of protection.

You may request a copy of the relevant safeguards used for transfers of your Personal Information by contacting us using the details in Section 19.

10. Data Retention

We retain Personal Information only for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary by data category:

When Personal Information is no longer needed, we delete it or anonymize it. Some information may persist in encrypted backups for a limited period before being overwritten in the normal course of backup rotation.

11. Security Measures

We take security seriously and have implemented technical and organizational measures designed to protect Personal Information against unauthorized access, alteration, disclosure, or destruction. Specific measures include:

11.1 Technical Measures

• Encryption in transit: all traffic to and from the Services is served over TLS (HTTPS).
• Encryption at rest: data in Azure-managed PostgreSQL and Azure Blob Storage is encrypted at rest by the cloud provider.
• Application-level encryption of sensitive tokens: Instagram long-lived access tokens are encrypted with AES-256 at the application level, on top of database-at-rest encryption.
• Shop isolation: every database query that touches orders, products, conversations, carts, or triggers is scoped to the Merchant’s shop ID derived from the JWT — Merchants cannot read or write across shops.
• Webhook security: Instagram webhook payloads are verified by X-Hub-Signature-256 before processing, and deduplicated using Redis-based keys to prevent replay or duplicate orders.
• Payment idempotency: we check provider references before confirming payments to prevent duplicate order confirmations from at-least-once webhook delivery.
• Role-based authentication: Merchant, Reseller, and admin JWTs are isolated by role claim; a Merchant token cannot access Reseller routes and vice versa.
• Rate limiting: outbound DM rate limits and login rate limits are enforced through Redis-based counters.
• Monetary precision: all monetary values are stored using fixed-precision decimals to avoid rounding errors that could affect customer-facing amounts.

11.2 Organizational Measures

• Access to production systems is limited to authorized personnel on a need-to-know basis.
• Internal operations dashboards do not have write access to financial, payment, subscription, or Stripe data.
• Audit logs are maintained for sensitive operations (payments, payouts, subscription activation, plan changes).
• Vendors with access to Personal Information are bound by contractual data-protection obligations.

11.3 No Guarantee

No system can be guaranteed to be 100% secure. While we work hard to protect your information, we cannot warrant the absolute security of any data transmitted to us, and you acknowledge this risk when using the Services.

12. Your Rights Under GDPR

If you are in the EEA, the United Kingdom, or Switzerland, you have the following rights with respect to your Personal Information:

• Right of access: to obtain confirmation of whether we process your Personal Information, and to receive a copy of that information.
• Right to rectification: to have inaccurate Personal Information corrected and incomplete information completed.
• Right to erasure (“right to be forgotten”): to request deletion of your Personal Information where one of the GDPR grounds applies.
• Right to restrict processing: to limit how we use your information in specified circumstances.
• Right to data portability: to receive your Personal Information in a structured, commonly used, machine-readable format, and to transmit it to another controller.
• Right to object: to object to processing based on our legitimate interests, including any related profiling.
• Right to withdraw consent: where we rely on your consent, you may withdraw it at any time, without affecting prior lawful processing.
• Right to lodge a complaint: with a supervisory authority in your country of residence, place of work, or location of the alleged infringement.

To exercise any of these rights, please contact us using the details in Section 19. We will respond within one (1) month of receiving your request, unless the request is complex, in which case we may extend the period by an additional two (2) months and inform you of the extension.

If you are an End Customer and your request relates to a Merchant’s processing of your information, we will either forward your request to that Merchant (as the Data Controller) or assist the Merchant in responding.

13. Your Rights Under CCPA / CPRA

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). This section is intended to comply with those laws.

13.1 Categories of Personal Information

In the preceding twelve months, we have collected the following categories of Personal Information, as defined under CCPA:

Note: Customer-to-Merchant DM messages routed through the Messenger Platform are processed by Abanro on behalf of the Merchant to operate the Services; they are not analyzed by Abanro to derive sensitive inferences.

13.2 Sources, Purposes, and Disclosures

The sources from which we collect this information, the business and commercial purposes for which it is used, and the categories of third parties to whom it may be disclosed for a business purpose, are described in Sections 3, 4, and 8 of this Policy respectively.

13.3 No Sale and No Cross-Context Behavioral Advertising

We do not sell Personal Information for monetary or other valuable consideration, and we do not share Personal Information for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA.

13.4 Your California Rights

• Right to know: you may request information about the categories and specific pieces of Personal Information we have collected, the sources, the purposes, and the categories of third parties with whom we have shared it.
• Right to delete: you may request deletion of Personal Information we have collected from you, subject to legal exceptions (e.g., records we must keep for tax or fraud-prevention purposes).
• Right to correct: you may request correction of inaccurate Personal Information.
• Right to limit use of sensitive Personal Information: as noted above, we do not collect sensitive PI for purposes that would trigger this right.
• Right to opt out of sale or sharing: we do not sell or share Personal Information for cross-context behavioral advertising; nonetheless, you may submit a request and we will confirm our practice in writing.
• Right to non-discrimination: we will not deny you the Services, charge you a different price, or provide you a lower-quality experience because you exercised your CCPA rights.

13.5 How to Exercise Your California Rights

To submit a request, contact us using the details in Section 19. We will verify your identity before responding to a right-to-know or right-to-delete request, typically by matching information you provide with information we already hold. Authorized agents may submit requests on your behalf, subject to verification of their authority.

We will respond within forty-five (45) days; this period may be extended by another forty-five (45) days when reasonably necessary, with notice to you.

14. Cookies and Tracking Technologies

Abanro uses cookies and similar technologies to operate the Services. The categories we use are:

We do not use advertising cookies. Where local law requires consent for non-essential cookies (e.g., in the EEA and UK), we will request your consent through a cookie banner before setting them. You can manage cookie preferences through your browser settings; note that blocking strictly necessary cookies may prevent you from using the Services.

15. Children’s Privacy

The Services are not intended for, and we do not knowingly collect Personal Information from, individuals under the age of sixteen (16). If you are under 16, please do not provide any information to us.

If we learn that we have collected Personal Information from a child under 16 without verifiable parental consent, we will delete that information promptly. If you believe a child has provided us with Personal Information, please contact us using the details in Section 19.

Merchants are responsible for ensuring that their own Services and storefronts comply with applicable laws relating to minors, including the Children’s Online Privacy Protection Act (COPPA) where it applies to them.

16. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects on you, within the meaning of Article 22 of the GDPR.

Some operational features of the Services involve automated logic — for example, trigger matching of DM messages against product codes, abandoned-cart detection, and FeatureGate enforcement of plan limits — but these are operational rules that govern how the platform behaves, not automated decisions about your eligibility for a service, employment, credit, or similar.

17. Third-Party Links and Services

The Services may contain links to or integrate with third-party websites and services, including Instagram, Stripe, Google, and Merchants’ own external links (for example, in their storefront footers). This Policy does not apply to those third parties. We are not responsible for the privacy practices of any third party, and we recommend you review their privacy policies before providing them with Personal Information.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, in applicable law, or in our data practices. When we make a material change, we will:

• Update the “Last Updated” date at the top of this Policy.
• Notify Merchants and Resellers by email or via an in-app notice.
• Where required by applicable law, request your consent before applying the change.

We encourage you to review this Policy periodically. Your continued use of the Services after a change becomes effective constitutes your acknowledgment of the updated Policy, except where additional consent is required.

19. Contact Us and Data Protection Inquiries

If you have questions about this Privacy Policy, want to exercise any of the rights described above, or wish to make a privacy complaint, please contact us: