1. About Misavela
Misavela is an independent software brand developing SaaS products for commerce operations, customer intelligence, financial reconciliation, and performance analysis. Where a Misavela service is commercially operated in Saudi Arabia through مؤسسة حلول الكاف التجارية, that establishment acts as the current commercial operator or contracting party as applicable. Misavela is not represented as a separate legal entity.
This Privacy Policy explains how information is processed across Misavela websites and services, including Customer Intelligence, Commerce Performance Operator (CPO), and Financial Truth.
2. Our processing role
For merchant-connected store, analytics, advertising, financial, and customer data that a merchant authorizes Misavela to process in order to provide a requested service, Misavela generally acts as a processor or service provider on behalf of that merchant.
For limited service-administration data needed to operate Misavela itself, such as merchant account registration, authentication, security, support, contractual, billing, and essential operational records, the applicable Misavela operator determines the purposes of that processing.
Misavela does not use merchant-connected data for unrelated advertising, data brokerage, or general-purpose model training.
3. Information we may process
Depending on the product and integrations a merchant chooses, Misavela may process:
- Merchant and service-user data: account identifiers, email address, authentication identifiers, organization/workspace membership, permissions, security/session metadata, support, contractual, billing, and service-administration information.
- Commerce and customer data: store, order, refund, product, category, inventory, and transaction-related records; and, where required by the selected product, customer identifiers, names, email addresses, phone numbers, city/location fields, purchase history, and derived segmentation or intelligence.
- Analytics and advertising data: connected account/property/resource identifiers, analytics metrics, reporting windows, channel dimensions, campaign/resource identifiers, and performance observations where an authorized integration is active.
- Financial data: order/payment/refund identifiers, payout and settlement identifiers, currencies, monetary amounts, financial statuses, provider references, uploaded bank/provider files, and reconciliation evidence.
- Credentials and connection data: OAuth grants, access or refresh tokens, provider connection identifiers, and related authorization metadata where persistent authorization is necessary.
Not every Misavela product stores all of these fields, and products are designed to minimize unnecessary personal data.
4. How we collect information
Information may be received directly from the merchant or service user; from third-party services the merchant chooses to connect, such as Salla, Zid, Shopify, Shopify Payments, Google, advertising platforms, or other approved providers; from files intentionally uploaded by the merchant; and from service operations, security controls, logs, and audit/provenance systems.
Misavela does not independently connect unrelated merchant accounts without merchant authorization.
5. Google API and Google Sign-In data
Customer Intelligence: uses Google Sign-In / OpenID Connect for merchant authentication. It currently uses the scopes openid email and processes the Google subject identifier, verified email information, and related authentication claims needed to create or link the merchant login identity. It does not currently persist Google access or refresh tokens for this sign-in flow.
Commerce Performance Operator (CPO): currently uses Google Analytics / GA4 with the read-only scope https://www.googleapis.com/auth/analytics.readonly. It may retrieve accessible GA4 property identifiers and analytics metrics such as sessions, active users, channel-group dimensions, reporting windows, and related provenance needed to provide merchant-requested analysis and recommendations. Where persistent authorization is required, OAuth credentials may be stored securely in encrypted form.
Financial Truth: does not currently use Google OAuth or Google merchant-data APIs.
Google Ads, Search Console, Merchant Center, or other Google integrations may be added to specific Misavela products in the future only when required by the product, separately authorized by the merchant, and reflected in applicable disclosures before activation.
Misavela's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Why we process information
- Authenticate users and maintain accounts.
- Connect merchant-authorized third-party services.
- Import, normalize, analyze, reconcile, segment, or present merchant data.
- Generate merchant-requested analytics, intelligence, evidence, recommendations, exports, or financial-close outputs.
- Maintain security, access control, auditability, service reliability, and troubleshooting.
- Provide support.
- Meet applicable legal, tax, accounting, or contractual obligations.
7. No sale, unrelated advertising, or general-model training
Misavela does not sell merchant or customer data. Misavela does not use merchant-connected data for unrelated targeted advertising. Misavela does not use merchant or customer data to train general-purpose AI or machine-learning models for Misavela's own unrelated purposes.
No live external LLM provider currently receives merchant data in the product paths covered by this policy. If an external AI provider is introduced in the future, it must pass product-specific data-use, retention, minimization, and security review before merchant data is sent to it, and relevant disclosures will be updated before activation.
8. Data minimization
Misavela products are designed to request and retain only the data reasonably required for their functions. For example, CPO deliberately excludes unnecessary customer contact and banking fields from its current canonical Salla commerce model, while Financial Truth's current Shopify financial contract excludes unnecessary customer profile fields. Customer Intelligence processes customer contact and order information where required for merchant-requested segmentation and intelligence.
Unexpected provider fields that are not required by the product are not treated as authorized data categories merely because they may appear in a provider payload.
9. Credentials and security
Where persistent third-party authorization is required, credentials and tokens may be stored securely in encrypted form and scoped to the applicable merchant, tenant, workspace, provider, and authorization grant.
Misavela uses technical and organizational measures designed to reduce unauthorized access, including tenant isolation, access control, encrypted credential storage, audit/provenance records, and redaction of secrets and unnecessary personal data from ordinary logs and diagnostic surfaces.
No security system can guarantee absolute security, but Misavela is designed to minimize stored data and restrict access according to service requirements.
10. Service providers and subprocessors
Misavela may use infrastructure and service providers necessary to deliver the services, including cloud hosting, databases, storage, cryptographic/key-management services, connected commerce platforms, payment/financial providers, analytics providers, and other approved subprocessors.
Current or planned providers may include AWS, Google, Shopify, Shopify Payments, Salla, and Zid, depending on the product and integration selected by the merchant.
The final production subprocessor list, deployment regions, and product-specific infrastructure may evolve as services move from development to production.
11. International and cross-border processing
Connected providers and cloud infrastructure may process data in more than one jurisdiction. Misavela does not currently promise that all service data is stored exclusively in Saudi Arabia.
Where cross-border processing applies, Misavela will handle it according to applicable law, contractual requirements, and the technical architecture in effect for the relevant service.
12. Retention
Misavela retains information only for as long as reasonably necessary to provide and maintain the service; preserve required security, audit, financial, reconciliation, or evidence records; resolve disputes and enforce agreements; and comply with applicable legal, tax, accounting, or regulatory obligations.
Exact retention periods may differ by product and data category and will be finalized as production retention schedules are established.
13. Disconnecting an integration and deleting data
Disconnecting, revoking, or uninstalling a third-party integration stops or disables future authorized access according to the relevant connector's behavior, but it does not necessarily delete all historical data already imported or derived.
Historical data may remain where needed for the merchant's requested service, financial/audit integrity, security, lawful retention, or until an applicable deletion process is completed.
Merchants may request account or data deletion. Misavela will process valid deletion requests subject to applicable legal or contractual retention obligations and product-specific deletion procedures.
14. Merchant responsibilities
Merchants are responsible for ensuring that they have the appropriate authority and legal basis to provide or authorize access to personal data processed through Misavela, including customer information obtained from their stores, platforms, files, or connected accounts.
Where Misavela processes personal data on behalf of a merchant, the merchant remains responsible for its own obligations as the party determining the purposes of that customer-data processing.
15. Sensitive information
Misavela services are not intentionally designed to collect special-category personal data such as health, biometric, religious, political, sexual-life, or criminal-history data. However, commerce records such as purchase history or uploaded provider files may incidentally reveal sensitive information depending on the merchant's business. Merchants should avoid providing unnecessary sensitive data, and Misavela will continue to apply data-minimization controls.
16. Privacy and data-processing terms
Product-specific terms, Data Processing Agreements (DPAs), subprocessor information, or additional privacy notices may supplement this Privacy Policy where required by the nature of a product, marketplace, integration, customer agreement, or applicable law.
17. Your choices and requests
Subject to applicable law and the role Misavela performs for the relevant data, merchants and users may request access to account information, correction of inaccurate service-account information, disconnection of third-party integrations, account or data deletion, and information about applicable processing or service providers.
Where a request concerns customer data controlled by a merchant, Misavela may direct the requester to that merchant or assist the merchant in responding as required by the applicable processing relationship.
18. Changes to this policy
We may update this Privacy Policy as Misavela products, integrations, infrastructure, or legal requirements evolve. The effective date at the top of this page will be updated when material changes are published.
Before activating materially new data uses or third-party integrations, Misavela will update relevant disclosures where required.
19. Contact
Privacy and legal inquiries: legal@misavela.com.
General support: support@misavela.com.
Website: https://misavela.com.