Privacy Policy

1. Controller

The platform controller is [LEGAL_ENTITY_NAME], [REGISTERED_ADDRESS], Jordan. Privacy and data-subject requests: legal@merai.space (Fadi may later appoint a separate DPO mailbox at legal@merai.space).

2. Data we collect

Account data: email, password stored by the auth provider (Supabase Auth), and display name if you set one.

Community data: posts, comments, course progress, certificates, forms, orders, bookings, and coupons inside communities you join.

Payment data: checkout is handed to Stripe. We do not store full card numbers. We may store session ids, payment status, and plan.

Meta data when you connect or use Facebook Login: Facebook/Instagram user ids, access tokens for assets you approved, and conversation ids delivered via Graph or WhatsApp Cloud API. We do not call a channel Connected before App Review and a real attach.

Technical data: cookies required for session and locale, and limited error logs to run the service.

3. Why we process data

To operate accounts, communities, courses, the store, and the inbox.

To complete payments and grant access after purchase.

To reply on channels you attached.

To comply with law and with reasonable Meta requests about abuse or deletion.

4. Sharing and processors

We host the app and database with infrastructure processors (such as Vercel and Supabase) and Stripe for payments. If you enable marketing pixels, events may go to Meta, Google, or other vendors whose ids you entered.

We do not sell personal data. Other communities on the platform cannot read your members or their content because tenants are isolated.

5. Retention and transfers

We keep account data while the account is active, and payment records for as long as Jordanian tax or accounting rules require. Channel data is detached or deleted when you disconnect an asset or when a valid deletion request is completed.

Infrastructure processors may store data in the regions where they operate. Using the platform means you accept that transfer to the extent the law allows.

6. Your rights

You may request access, correction, deletion, or restriction at legal@merai.space. If we received data through Facebook Login or Meta APIs, also use the data-deletion page: https://app.merai.space/en/legal/data-deletion.

You may object to marketing messages where those exist. Pixels stay off when no ids are configured.

7. Children

Merai is not directed at children under 18 as creator-account users. We do not knowingly collect children’s data. If we learn a child created an account, we delete it.