This policy explains what personal data Mist collects when you use the Mist mobile app (iOS and Android) and our online stores mistalgeria.com and mistlebanon.com, why we collect it, who we share it with, and the choices you have. In this policy, “Mist”, “we” and “us” mean the Mist store you shop with: Mist Algeria for mistalgeria.com and Mist Lebanon for mistlebanon.com.
In short
- We collect what we need to deliver your order: your name, phone number, delivery address and what you bought.
- An account is optional. You can browse and order without one, and delete your account at any time from the app.
- Payment is cash on delivery. The app never asks for or stores card details.
- We do not sell your personal data.
- We share order information with delivery companies, and limited, partly encrypted (hashed) information with Meta and TikTok to measure our ads. Details are below.
1. Data we collect
Data you give us
- Account details (optional): name, email address, phone number and password. WordPress stores your password as a one-way hash; we never see it in plain text.
- Order and delivery details: name, phone number, delivery address (province/wilaya, city, street or pickup office), optional email address, the items you order, and any note you add.
- Messages: what you send us by email, WhatsApp or Instagram when you contact support.
Data collected automatically by the app
- App installation ID: a random identifier created on your device when you install the app. It lets us send notifications to the right device and apply fair-use limits (for example, one wheel spin per day). It is not your phone’s advertising identifier (IDFA or Advertising ID), which the app does not access.
- Push notification token, if you allow notifications, plus the device platform (iOS or Android), app version and language, so we can send notifications in your language.
- Technical data: like any internet service, our servers receive your IP address and basic request information when the app loads content. We use it for security and to prevent abuse.
Promotions (“Spin & win”)
When you spin a promotional wheel, we record the campaign, the prize, the coupon issued, and hashed (irreversibly scrambled) versions of your app installation ID and IP address, so we can limit how often each device can spin. Spinning is free and never requires a purchase or an account.
Data stored only on your device
Your bag, wishlist, recently viewed products, saved delivery details, language, country and theme preferences are stored on your device. Your sign-in session is kept in your device’s secure storage (iOS Keychain or Android Keystore). Deleting the app removes this data.
2. How we use your data
| Purpose | Data used | Legal basis |
|---|---|---|
| Process and deliver your orders, and contact you about them | Order and delivery details, account details | Performance of our contract with you |
| Manage your account and order history | Account details, orders | Performance of our contract with you |
| Send order updates and, if you allow them, offers by push notification | Push token, app installation ID, language | Your consent (you can turn notifications off at any time) |
| Run promotions and prevent abuse | Hashed installation ID and IP address, coupons issued | Our legitimate interest in fair promotions |
| Measure how well our ads work (see section 3) | As described in section 3 | Our legitimate interest, or your consent where the law or your device requires it |
| Keep our services secure and meet legal obligations (accounting, tax, disputes) | Technical data, order records | Legal obligation and legitimate interest |
3. Advertising measurement
We advertise on Meta (Facebook, Instagram) and TikTok. To know which ads lead to orders, our store server sends those platforms limited information about orders:
- Orders (from the website or the app): the order value, the products ordered and your phone number and/or email address in hashed form (SHA-256), so Meta or TikTok can match the order to an ad you saw without receiving your contact details in readable form.
- Android app only: if you opened the app from an ad link, the ad click identifier from that link, plus product views, “add to bag” and “begin checkout” events with a random visitor ID and the app’s user-agent string.
- iOS app: the app does not send device identifiers, ad click identifiers or browsing events to advertising platforms.
Meta and TikTok process this information under their own privacy policies: Meta Privacy Policy, TikTok Privacy Policy. To object to this use, contact us (section 8).
4. Who we share data with
We do not sell your personal data. We share it only with:
- Delivery companies that bring you your order: name, phone number, delivery address and order value (for cash on delivery).
- Our hosting and technical providers, which store and run our stores and servers on our behalf.
- Expo, which delivers push notifications and app updates, and Apple and Google, whose push notification services carry notifications to your device.
- Meta and TikTok, only as described in section 3.
- Authorities, when the law requires it.
Some of these providers process data outside your country. When they do, we rely on their contractual commitments to protect it.
5. How long we keep data
- Account: until you delete it.
- Orders: for as long as accounting and tax law requires. If you delete your account, your orders are kept but no longer linked to an account.
- Wheel spin records: 180 days. Unused prize coupons are deleted after they expire.
- Push tokens: until you delete your account or the token stops working (for example, after you uninstall the app).
6. Your choices and rights
- Delete your account in the app: Account → Delete account. This deletes your account, signs you out on all devices and removes the devices registered for notifications.
- Notifications: turn them off at any time in your phone’s settings.
- Access, correction, deletion, objection: you may ask for a copy of your data, ask us to correct or delete it, or object to how we use it, by writing to us (section 8). We reply within 30 days.
These rights are provided under applicable law, including Algeria’s Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, and Lebanon’s Law No. 81 of 10 October 2018 on electronic transactions and personal data. You may also contact your country’s data protection authority.
7. Security and children
We use encrypted connections (HTTPS) for all communication between the app and our servers, store passwords only as hashes, and keep your sign-in session in your device’s secure storage. No system is perfectly secure, but we work to protect your data and limit who can access it.
Our app and stores are not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
8. Contact us
- Mist Algeria: support@mistalgeria.com
- Mist Lebanon: support@mistlebanon.com
9. Changes to this policy
We may update this policy when our services change. We will post the new version here with a new “Last updated” date, and tell you in the app if the changes are significant.