Privacy Policy

Last updated: 30 October 2026

This policy explains how we collect, use, share and protect your personal data when you use cloudpastry.com and seller.cloudpastry.com and the CloudPastry Hub app for sellers and the Marketplace app for buyers on iOS and Android, or when you contact us. We do so in line with the Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations issued by Ministerial Decree No. 816 of 2025.

1. Who we are

CloudPastry is an online platform operated by the following company ("Hunters, LLC"): Hunters, an Egyptian limited liability company, Commercial Registry No. 2578 (Gamasa Investment Commercial Registry Office), Unified Registry No. 11090 01000 02578, Tax Registration No. 648-530-116, head office: Plot No. (17), Block (C), Phase 3, Industrial Zone, Gamasa City, Dakahlia. Throughout this policy, "CloudPastry", "we", "us" and "our" mean Hunters, LLC operating the CloudPastry platform. You can reach our data-protection contact about anything related to your data at: Email info@cloudpastry.com and phone/WhatsApp +20 110 029 0291.

2. Data we collect and where it comes from

• Account data: name, phone number and email, and business details for sellers.
• Order data: delivery address, order contents, value and date, payment method, and your messages with us about the order.
• Location data: your approximate or precise location, used only to show shops that deliver to your area and to verify delivery coverage.
• Payment data: we do not store full card numbers. Card payments entered on our card payment page (with the bank's 3D Secure OTP) or made via Apple Pay are processed by our licensed banking partner CIB on secure PCI-DSS-compliant systems. We receive only the transaction result and limited reference data.
• Conversations: the content of messages you send us through WhatsApp and our contact forms and website chat (text, photos, voice notes and files), and your name and account ID as the messaging platform shows them to a business account.
• Voice recordings: when you use voice ordering we receive your voice and convert it to text to process your order.
• Technical data: IP address, device and browser type, and usage data collected by the cookies and measurement tools described in this policy.

We receive this data from you directly when you use our services or contact us; from payment providers (the transaction result only); and from the seller you order from. We do not ask you for sensitive data such as health or religious data. Financial data is sensitive data under the law, which is why we do not store full card numbers. If you tell us something about your health, such as an allergy to an ingredient, we use it only to serve your order.

3. Why we use your data

• To create and manage your account.
• To process and deliver your orders and provide after-sales service.
• To take payment and issue invoices, including electronic invoices and receipts for the Egyptian Tax Authority where required.
• To verify your phone number with a code sent by text message.
• To answer your questions, messages and complaints.
• To use artificial-intelligence tools that help us understand and answer your messages and the photos you send and your voice orders.
• To operate and secure the website and prevent fraud.
• To measure use of the website with cookies, only after you accept.
• To send marketing messages, only with your consent.
• To comply with the law and respond to requests from competent authorities.

4. Legal basis for processing

We process your data on one of the following bases:

• Performance of a contract: to fulfil your order, your account or our agreement with you.
• Legal obligation: such as tax, e-invoicing and consumer protection.
• Legitimate interest: to operate, secure and improve our services, without overriding your rights.
• Consent: for marketing messages, non-essential measurement tools and any case where the law requires your consent. You can withdraw your consent at any time.

5. Sharing your data

We do not sell your personal data. We share it only as needed with:

• The seller of your order, to prepare and hand over the order.
• Competent government bodies where the law requires it, including the Egyptian Tax Authority for e-invoicing.

We also share it with service providers that process data on our behalf, under confidentiality obligations:

• Hetzner: hosting of our servers, databases, email and backups (Germany and Finland).
• Backblaze: storage of encrypted backup copies of our data (United States).
• Google (Google Fonts): loading the website fonts; your device's IP address reaches Google when a page opens (United States).
• Google (Google Analytics): measuring visits to the website and how it is used (United States).
• Google (Gemini): an artificial-intelligence model that helps us understand and answer your messages (United States).
• Anthropic (Claude): an artificial-intelligence model that helps us answer the website chat (United States).
• ElevenLabs: speech-to-text and text-to-speech for voice ordering (United States).
• TypeSafe: automated classification of the photos you send in a chat.
• AcruxLab (ApiChat) and Meta (WhatsApp): connecting WhatsApp conversations to our customer-service system.
• Cequens: sending text messages (SMS), such as verification codes.
• Commercial International Bank (CIB): processing card and Apple Pay payments as our licensed banking partner.
• Geidea: processing online payments.
• Apple: Apple Pay and in-app payment of seller subscriptions on iOS.
• Google (Google Play Billing): in-app payment of seller subscriptions on Android (United States).

When you message us on WhatsApp, Meta also processes your messages under its own policy.

6. Our role for sellers' customer data

For marketplace orders, we are the controller of your account and order data, and we share with the seller what it needs to fulfil the order. When a seller uses CloudPastry software (point of sale and store management) to record data about its own customers, the seller is the controller of that data and we are its processor: we store and process it on the seller's behalf and on its instructions, and we do not use it for our own purposes. If you are a customer of a seller and want to exercise your rights over that data, contact the seller directly; we will help the seller answer your request. Under the Seller Agreement, the seller must use buyer data only to fulfil buyers' orders, must not use it for marketing without their consent, and must keep it confidential under the Personal Data Protection Law No. 151 of 2020.

7. Transfers outside Egypt

Your data is stored on servers outside the Arab Republic of Egypt and is transferred to the following countries:

• Germany and Finland: the Hetzner servers that run our systems, and their backups.
• United States: encrypted backup copies at Backblaze, and the services of Google, Anthropic, ElevenLabs and Meta.

Some of the service providers listed may also process data in other countries where their servers are located. The Personal Data Protection Law and its Executive Regulations require a licence or permit from the Personal Data Protection Center for these transfers. We have applied for it, and until it is issued we transfer only what is needed to provide the service.

8. How long we keep your data

We keep your data for as long as needed for the purpose we collected it for, and then for the periods required by law, such as tax and commercial law. After that we delete the data or remove what identifies you. A seller's data is not deleted because a paid subscription is cancelled; the seller can ask to close its account once balances are settled.

9. Security

We take technical and organisational measures to protect your data against loss, misuse and unauthorised access, including:

• Encryption of the connection between your device and our websites over HTTPS.
• Administrative access to our servers over SSH is by key only.
• Encrypted backups.
• Access rights set for each user according to their work.

10. Your rights

The law gives you the following rights:

• To know what data we hold about you, to see it and to obtain it.
• To withdraw your consent to processing at any time.
• To have your data corrected, changed, added to or updated.
• To have your data erased.
• To restrict processing to a specific scope.
• To object to processing or its results where it conflicts with your fundamental rights and freedoms.
• To be informed of any breach of your personal data.

Withdrawing consent does not affect processing carried out before it. We may keep some data after an erasure request where the law requires us to.

11. How to exercise your rights

Send your request to our data-protection contact at: Email info@cloudpastry.com and phone/WhatsApp +20 110 029 0291. We may ask you for proof of identity before we act on a request, so that we do not give your data to someone else. We answer your request within six (6) working days of receiving it.

12. Complaints

If you believe our processing of your data breaks the law, you have the right to complain to the Personal Data Protection Center in Egypt. We ask you to contact us first so that we can try to solve the problem.

13. Data breach notification

If a breach of your personal data occurs, we notify the Personal Data Protection Center within seventy-two (72) hours of becoming aware of it, and we also notify you if you are affected, as the law requires, explaining what happened and what we have done.

14. Cookies and measurement tools

We use essential cookies to run the website, for example to keep you signed in, keep your shopping cart and remember your language; these do not need your consent. We also use the following analytics and advertising tools:

• Google Analytics: sets cookies that measure visits, the pages you open and where the visit came from.

On your first visit a cookie banner shows two equal buttons: "Accept" and "Reject". Before you choose, no analytics or advertising cookies are stored on your device and no identifiers are used. Google tags run in Consent Mode v2 with every permission denied (analytics_storage, ad_storage, ad_user_data and ad_personalization), and Google may receive limited signals without cookies, such as a page load and your approximate country. Measurement with cookies and advertising tools start only after you press "Accept". After you accept, data from these tools reaches Google in the United States. If you choose "Reject", they stay off and you can still use the website. You can change your choice at any time from the "Cookie settings" link at the bottom of the page; we keep your choice in your browser for 12 months. The website also loads Google Fonts from Google's servers, so your device's IP address reaches Google when a page opens.

15. Electronic marketing messages

We send you marketing messages by text message, WhatsApp or email only after your prior consent. Every marketing message clearly shows CloudPastry, or Hunters, its operator, as the sender. You can stop these messages at any time by contacting us at: Email info@cloudpastry.com and phone/WhatsApp +20 110 029 0291. We stop them free of charge. Service messages, such as order confirmations and verification codes, are sent because they are needed to provide the service. If you are a business owner and ask us to stop contacting you about the platform's services, we record your request and do not message you again.

16. Children

Our services are not directed at people under 18, and we do not knowingly collect their data without a guardian's consent. If you learn that a child has sent us their data, contact us so that we can delete it.

17. Changes to this policy

We may change this policy from time to time. We publish the updated version on this page with its "Last updated" date. If a change is material, we tell you about it in a suitable way before it takes effect.

18. Contact

Hunters — Plot No. (17), Block (C), Phase 3, Industrial Zone, Gamasa City, Dakahlia. Email info@cloudpastry.com and phone/WhatsApp +20 110 029 0291.