Privacy policy

Version 2026-11-02. This policy explains how Sarif processes the personal data of visitors to sarif.es and of people who create an account on the platform. Each store’s customer data is processed by the merchant as controller; Sarif only acts as its processor (see the Data processing agreement).

Controller

• Controller: SARIF DIGITAL SOLUTION
• Trade register: RCCM GN.TCC.2026.4.04097
• Address: Conakry, République de Guinée
• Privacy contact: contact@sarif.es

What data we process

• Account data: first and last name, email, password (stored encrypted), country, phone and company if you provide them, language, and the date and version of the terms you accepted.
• Usage and technical data: IP address, browser, access and security logs, and the actions you take in the dashboard (for example, order changes).
• Billing data for your subscription, if you choose a paid plan.
• Communications you send us.
• If you sign in with Google, we receive your name, email and profile picture.

Purposes and legal bases

• Providing the Service and managing your account (sign-up, access, stores, support): performance of the contract.
• Service emails (account confirmation, password reset, order notifications, changes to the terms): performance of the contract.
• Billing, accounting and tax obligations: legal obligation.
• Security, fraud and abuse prevention, and improving the Service with aggregated data: legitimate interest.
• Sarif news and marketing communications: only with your consent, which you can withdraw at any time from your account or with the link in each email.

How long we keep it

While your account is active. After closure, 30 days so you can recover or export your data; then it is deleted, except what is needed to meet legal obligations (for example, billing: up to 6 years) or to handle claims until they expire. Security logs are kept for up to 12 months.

Who we share it with

We don’t sell personal data. We share it only with providers that help us deliver the Service, under data processing agreements and appropriate safeguards:

• Cloud infrastructure providers: database hosting, authentication and file storage.
• Network and security providers: content delivery, attack protection and stores’ custom domains.
• Email delivery provider: platform emails.
• Google: Google sign-in, if you use it.
• Subscription payment provider, if you choose a paid plan.

You can ask us for the current list of these providers at contact@sarif.es. We may also disclose data to authorities when required by law.

International transfers

SARIF DIGITAL SOLUTION is established in the Republic of Guinea and processes data in accordance with Law L/2016/037/AN of the Republic of Guinea on cybersecurity and personal data protection. To provide the Service we use infrastructure providers that may host or process data on servers located outside Guinea; in that case we contractually require an adequate level of protection and apply technical measures such as encryption. You can ask for more information at contact@sarif.es.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to contact@sarif.es. Much of your data can be changed directly in your account.

If you think we haven’t handled your request properly, you can contact the competent authorities of the Republic of Guinea for personal data protection.

Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), encrypted passwords, isolation of each store’s data in the database, role-based access control, backups and activity logs.

Changes

If we materially change this policy, we will tell you by email or in the dashboard before it applies.