Privacy policy

This policy explains what personal data Wassile collects when you use wassile.com or order from us, why we use it, who else receives it, how long we keep it and what rights you have.

Who is responsible

• The controller is the person who runs Wassile, named with a postal address in our Impressum.
• For anything about your data, write to support@wassile.com or message us on WhatsApp.

What we collect

• Your account: name, email, phone number, saved address, and your password, which we store only as a one-way hash. If you sign in with Google, we receive your name and email from Google.
• Your orders: the products, pickup or home delivery, your address and district, phone number, payment method, payment reference and, for Whish Money or OMT, the receipt screenshot you upload.
• Guest orders with cash on delivery: we keep a record linked to your phone number so the cash on delivery limits apply to every order.
• What you send us: WhatsApp and email messages, custom product requests (links, photos, notes), reviews and your wishlist.
• Technical data: IP address, browser and device type, the pages you open and error reports. We need these to run the site and keep it safe.

Why we use it

• To take, buy, ship and hand over your order and to talk to you about it (performance of a contract, Art. 6(1)(b) GDPR).
• To keep the bookkeeping and tax records German law requires (legal obligation, Art. 6(1)(c) GDPR).
• To keep the shop secure, prevent fraud and abuse and fix errors — for example limits on login attempts, and on cash on delivery after a refused delivery (legitimate interest, Art. 6(1)(f) GDPR).
• To measure visits with Google Analytics, only if you accept cookies (consent, Art. 6(1)(a) GDPR). You can withdraw your consent at any time.

Who else receives your data

These providers process data on our behalf, only for the purposes above:

• Vercel (USA): hosts the website and counts visits without cookies (Vercel Web Analytics).
• Supabase: our database, on servers in Frankfurt, Germany.
• Cloudinary (USA): stores product photos and the receipt screenshots you upload, which are deleted automatically within 72 hours.
• Resend (USA, sending from the EU): sends our order emails.
• Sentry (servers in Germany): collects error reports so we can fix problems.
• Upstash: short-lived counters that stop abuse such as repeated login attempts.
• Google: Google Analytics, only with your consent, and Google sign-in, only if you choose it.

These receive data when your order needs it, under their own privacy policies:

• Telegram: order alerts and receipt screenshots go to our private Telegram chat so we can check payments quickly.
• Meta (WhatsApp): when you message us or we message you about your order.
• Whish Money and OMT: you pay them directly; we only see the payment reference and your receipt.
• PayPal and Stripe: only if you pay with PayPal or by card (when offered at checkout).
• Our hub and delivery partners in Lebanon: your name, phone number and address, to hand over your order.

We never sell your data and we do not use it to build advertising profiles.

Data outside the EU

• To deliver your order we have to send your delivery details to Lebanon (Art. 49(1)(b) GDPR).
• Some providers above are based in the USA or elsewhere outside the EU. We use them with the safeguards the GDPR allows, such as the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

Cookies and storage on your device

• Necessary: a sign-in cookie when you log in, and in your browser's storage your cart, language, currency, light or dark mode and your cookie choice. These need no consent.
• Optional: Google Analytics cookies, only after you tap Accept. To change your choice, clear this site's cookies and storage in your browser and the banner will ask again.

How long we keep it

• Receipt screenshots: deleted automatically within 72 hours of upload; the copy in our Telegram chat is kept only as long as we need it for your order.
• Orders and payment records: as long as German tax and commercial law requires, up to 10 years.
• Your account: until you delete it. When you delete your account you can no longer sign in, and order records we must keep by law remain — ask us to erase the rest and we will.
• Technical logs and error reports: up to 90 days.
• WhatsApp and email messages: as long as needed for your order and any follow-up questions.

Your rights

• You can ask for a copy of your data (Art. 15 GDPR), have it corrected (Art. 16), erased (Art. 17) or its use restricted (Art. 18), receive it in a portable format (Art. 20), and object to processing based on our legitimate interest (Art. 21).
• Where you gave consent, you can withdraw it at any time (Art. 7(3) GDPR); this does not affect anything done before.
• Write to support@wassile.com. You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work, or in Germany, where we are based.

Security

• The whole site runs over an encrypted connection (HTTPS), passwords are stored only as one-way hashes, receipt screenshots are kept in private storage, and our admin accounts are protected with two-step login. No system is perfectly secure, but we work to keep your data safe.

Children

• Wassile is not meant for children under 16.

We update this policy when our services change. Last updated: 25 September 2026.