Jana Merchant Privacy Policy

1 About this policy

Jana Merchant is operated by Parcel Delivery, Bahrain ("Jana", "we", "us" or "our"). Jana Merchant enables business owners and authorised staff to create and manage ecommerce stores, products, customers, orders and related business operations.

This Privacy Policy explains how we collect, use, share and retain information through the Jana Merchant mobile application, related merchant and store services, and the Join Jana enquiry form. It also explains the separate use of analytics on our public marketing website. Merchant storefronts may have their own privacy notices covering the merchant’s sales and customer relationship.

Privacy contact: jana@tryparcel.com. Address: Parcel Delivery, Building 1226, Floor 6, Road 5124, Block 351, Kingdom of Bahrain. Websites: jana.now and tryparcel.com.

2 Information we collect

• Merchant enquiries: Your full name, mobile number, consent to be contacted, and any company name or message you provide. Enquiries are forwarded to an external enquiry service rather than stored as merchant applications in Jana’s database. Jana retains the applicant’s phone number and IP address for 30 days for abuse prevention and rate limiting.
• Merchant and staff accounts: Your name, email address, optional phone number, hashed password, two-factor authentication information if enabled, and login and session information. We do not store your original password.
• Store and business information: Store name, contact email and phone number, address and map location, VAT number, Commercial Registration number, social media handles, store logos and product or category images, and branch names, addresses, contact details and opening hours. Payment instructions may include bank-transfer details supplied by the merchant. We do not currently store KYC identity documents or business verification documents.
• Customers and orders: Customer names, email addresses, phone numbers, delivery addresses and map locations; order history, products purchased, order amounts, payment methods, payment status and transaction or reference numbers; customer order notes, return reasons, reviews, abandoned-cart information and internal merchant notes about customers.

We also process information needed for account security and service operation, including IP addresses, failed sign-in or OTP attempts, session records, notification tokens and delivery records. Some staff-management functions can display shopper phone or email details and IP addresses associated with failed sign-in attempts to authorised merchant users, according to their permissions.

3 How we use information

We use information to:

• Respond to enquiries and contact applicants who have agreed to be contacted.
• Create and authenticate accounts, manage sessions, store access and staff permissions, and protect accounts against abuse.
• Build and operate stores, publish products and images, manage inventory, customers, orders, returns and invoices, and send operational communications.
• Provide enabled payment, delivery, map and AI features.
• Investigate errors, provide support, maintain service reliability and prevent fraud or misuse.
• Handle privacy requests and meet applicable legal, financial and recordkeeping obligations.

Where applicable, we rely on processing necessary to provide services under a contract, comply with legal obligations, or pursue legitimate interests such as service security, subject to individual rights. We obtain consent where required. You may withdraw consent by contacting us; withdrawal does not affect processing that was lawful before withdrawal.

4 Merchants and their customers

Authorised merchants and staff can access customer and order information relevant to their stores, subject to store permissions. Merchants determine how they conduct sales and manage their customer relationships. Jana processes customer and order information to provide the platform and separately handles account administration, security and its own legal obligations.

A shopper’s request concerning a merchant’s use of their information should be directed to that merchant using its published contact details. Shoppers may also contact jana@tryparcel.com about Jana’s handling of their information.

5 Sharing and service providers

We share information needed for the relevant service with authorised merchant users and providers of hosting, database storage, file storage, communications, diagnostics and enabled business functions. These services include:

• Hosting and storage: Our production hosting infrastructure, PlanetScale for database records, and Cloudflare network services and R2 for uploaded images.
• Communications and mobile services: Our email services, Parcel SMS infrastructure, Expo, Apple Push Notification Service and Firebase Cloud Messaging, as applicable, for builds, updates and operational notifications.
• Diagnostics and maps: Sentry for error reporting and OpenStreetMap/Nominatim for map or address functions.
• Delivery: Parcel receives relevant customer contact details, delivery addresses, map locations and shipment information when an order is dispatched.
• Enquiries, payments and AI: The external enquiry service, payment providers used by an enabled checkout, and providers used by enabled AI features.

We may disclose information when required by applicable law or a valid legal process, or where lawfully necessary to investigate misuse and protect the rights or security of Jana, users or others. Independent merchants, payment providers and delivery providers may also process information under their own privacy notices and legal responsibilities.

6 Payment information

Payment card details are entered directly on the relevant payment provider’s hosted payment page. Jana does not receive or store customer card numbers, CVV/security codes, expiry dates or payment card credentials. Jana may store the payment method, status, amount and transaction or reference number needed to manage an order.

Payment services available through the platform include Mastercard/AFS hosted payment services and Tap through Parcel Pay, depending on the features enabled for the store. Merchant-provided bank-transfer instructions are separate from payment card credentials.

7 App permissions and device storage

• Camera: Optional access when you choose to take a product or store-related image.
• Photo library: Optional access when you choose an existing image for products, store branding or categories.
• Push notifications: Optional notifications about new orders, order changes, returns and low stock. The app continues to work if notification permission is denied.

You can manage permissions in your device settings. Denying camera or photo access may limit the corresponding image feature. Jana Merchant does not currently request access to device location, contacts, Bluetooth or advertising/tracking identifiers. Store and delivery addresses or map coordinates supplied through the service are still processed as described above. Jana Merchant does not use the microphone or record audio.

Authentication and session tokens are stored in secure device storage. Preferences and cached application information may be stored locally. Customer and order data can remain in the app cache for up to seven days and is cleared when you sign out. Generated invoices and cached images may remain temporarily in device storage. Uninstalling the app or clearing local data does not erase server records.

8 Error reporting

We use Sentry to investigate errors in the web platform and Jana Merchant app. Error events may include page or request URLs, error messages, store or order identifiers, and navigation or network breadcrumbs. Server-side errors may contain form or request information.

The mobile configuration does not enable session replay, screen recording, screenshot capture, view hierarchy capture or default personal-information collection. Error events can nevertheless include personal information contained in the technical details described above.

9 AI features

When you use an enabled AI feature, the prompts, messages or other information you submit, together with information needed to provide the requested response, may be sent to the AI service provider used for that feature. Jana may also store AI assistant conversations as described below.

The platform includes integrations with OpenAI, Cloudflare Workers AI, QwenCloud and Google Gemini. Some integrations are disabled; a provider processes information when its integration is used for an enabled feature. Provider handling is subject to the applicable service arrangements and privacy terms. Avoid submitting unnecessary personal or confidential information to AI features.

10 Advertising analytics and marketing

The Jana Merchant mobile app does not currently contain advertising or analytics SDKs, collect advertising identifiers or perform cross-app advertising tracking. It does not currently send promotional push notifications, promotional SMS or marketing email. Operational service messages and responses to enquiries are handled separately.

Our public marketing website uses Google Analytics through Google Tag Manager to understand website usage. This is separate from the mobile app. Merchant storefront integrations for Meta Pixel, TikTok Pixel and Google Analytics are currently disabled.

If we introduce promotional messaging or additional analytics or advertising features, we will update the relevant privacy information and provide consent or opt-out controls where required before enabling them.

11 Storage security and international processing

Account, merchant, customer and order records are primarily stored in PlanetScale PostgreSQL. Uploaded images are stored in Cloudflare R2. Diagnostic information is processed through Sentry, and notification tokens and delivery information are handled through the relevant notification services.

Our security measures include HTTPS connections, password hashing, encryption of two-factor authentication secrets, secure device storage for authentication tokens, and store-level access controls and staff permissions. No transmission or storage method can provide absolute security.

Our providers may process or store information outside Bahrain or the country where you use Jana. International processing is subject to applicable data-protection requirements, including any required safeguards or authorisations for transfers. Contact us for information about the providers and international processing relevant to your information.

12 Data retention

We retain information according to its purpose and applicable service, security and legal requirements. Current retention settings for temporary records are listed below.

Account, store, customer and order information may be needed while services remain active, to complete transactions, meet applicable recordkeeping obligations, or investigate specific security incidents or disputes. Suspension or soft deletion does not itself erase the underlying records.

Orders, audit logs, SMS logs, uploaded images, abandoned carts and soft-deleted customer, store and business records currently have no automatic expiry. Closing an account or suspending a store does not automatically erase these records. Requests for erasure are assessed individually, including whether records are needed to complete transactions, comply with legal or financial recordkeeping duties, prevent fraud, investigate security incidents or resolve disputes.

The periods above describe Jana’s configured retention settings. Service-provider retention periods and backup cycles may differ. Copies in backups may remain until overwritten or expired through the applicable backup process. Contact us for information about the retention of a particular record or an erasure request.

13 Your privacy rights

Depending on applicable law and its conditions, you may request information about processing, access to your personal information, correction, blocking or deletion, objection to certain processing, withdrawal of consent, or receipt or transfer of your information in a structured format where the law provides for it. You may also complain to the relevant data-protection authority, including Bahrain’s Personal Data Protection Authority.

Send privacy questions and requests to jana@tryparcel.com. We may need to verify your identity and authority to protect your information and information belonging to others. We assess requests under applicable law, including any conditions or exceptions affecting the requested action.

14 Account deletion

To request account closure or erasure of your personal information, email jana@tryparcel.com using the email address associated with your account, where possible. You may also use an account-deletion request option where available in the app. You do not need access to the app to contact us. We may ask for information reasonably needed to verify your identity and authority. Do not send your password or payment card details.

The account-closure process deactivates your account and revokes its sessions. If you are the sole owner of a store, that store is suspended, including its storefront, checkout, staff access, push notifications, API keys and background jobs. Removing a staff member’s store access does not itself delete that person’s Jana account.

Deactivation is separate from erasure and does not automatically delete existing orders, customer records, products, images, audit records or other historical information. The current closure process does not include automatic final erasure of all associated records.

We assess requests to erase personal information under applicable law, including any obligations to retain particular records. We will explain the outcome of your request and, where information must be retained, the relevant reason and applicable retention period or criteria. We respond within the time limits required by applicable law. Uninstalling the app does not close an account or erase server information.

15 Children

Jana Merchant is intended for business owners and authorised staff and is not directed at children. If you believe a child has provided personal information through the merchant app, contact jana@tryparcel.com so we can assess and address the matter. Merchants are responsible for privacy information and applicable requirements relating to customers of their independent storefronts.

16 Changes and contact

We may update this Privacy Policy when our services, information-handling practices or applicable requirements change. The updated policy will show its effective date. We will communicate material changes where required by applicable law.

For privacy enquiries, contact jana@tryparcel.com or write to Parcel Delivery, Building 1226, Floor 6, Road 5124, Block 351, Kingdom of Bahrain.