Privacy Policy

1. What we collect

Account details: business name, the name of the person responsible for purchasing, email, phone, delivery address, and tax/commercial registration details where a tax invoice is required. This is what we need to open a wholesale account and fulfil orders.

Order data: products, quantities, agreed prices, purchase orders you upload, order correspondence and delivery records.

Technical data: IP address, browser and device type, pages visited and when, and error logs. Used to operate and secure the site and to detect abuse.

Conversations: your messages with our AI assistant on the site or over WhatsApp, including images you send to request a quotation.

We do not collect patient health information, we do not ask for it, and nothing in the store requires it.

2. Cookies

We use strictly necessary cookies to operate the site: keeping you signed in, holding your cart, and protecting forms from abuse. These cannot be disabled while the site still works.

We may use measurement cookies to understand which pages are used most and improve our catalogue and search. This is aggregated and is not used to track you across other websites.

You can delete or block cookies in your browser settings, though blocking the necessary ones may prevent signing in or completing an order.

3. Why we use it

To fulfil orders: issuing quotations and invoices, preparing shipments, delivering, and handling after-sales matters.

Operational contact: answering an enquiry, telling you an order’s status, or flagging a delivery problem.

Pricing: wholesale prices and payment terms are set at account level, which requires orders to be linked to your business account.

Improving the service: understanding what customers search for so we can improve product naming, search results and catalogue structure.

Legal compliance: accounting, tax and e-invoicing requirements in Egypt.

4. Legal basis and retention

We process data to perform our contract with you, to comply with law, and for our legitimate interest in operating and securing the store and preventing fraud.

Order and invoice records are kept for the period Egyptian law requires for accounting and tax records, including after an account is closed.

Account data and conversations are deleted on request, except where retention is legally required or needed to resolve an open dispute.

5. Sharing and service providers

We do not sell, rent or trade personal data, and we do not share it with any advertising network.

We share it only with service providers acting on our behalf and only as far as needed to deliver the service: server hosting, delivery and courier companies, payment processing, and our messaging provider (WhatsApp Business).

We may disclose data where required by law or court order, or to defend our legal rights.

If the business is sold or merged, data transfers with the assets and this policy continues to apply to it.

6. Where data is stored

Our servers run on cloud infrastructure that may be located outside Egypt. Some data is transferred to and stored in those locations. Our obligation to protect it under this policy applies wherever it is held.

7. AI assistant and automated processing

The site uses an AI assistant to answer questions, read quotation-request images and suggest products. Your message is processed automatically for that purpose.

We do not use your conversations to train generalised AI models.

No automated decision with legal effect is made about you; order approval and payment terms are decided by a member of staff.

8. Marketing communications

We may send operational notices about your orders. These are part of the service and cannot be switched off while the account is active.

Any promotional message is sent only to those who opted in, and can be stopped at any time via the unsubscribe link or by writing to us.

9. Security

Data is held on access-restricted servers, and traffic between your browser and our servers is encrypted over HTTPS.

Internal access is limited to staff whose work requires it and is governed by role-based permissions.

No system is perfectly secure. If a breach affects your personal data we will contain it and notify affected parties and the relevant authorities as the law requires.

10. Google Ads API application (internal tool)

We operate an internal marketing console, used only by our own employees, to manage our own Google Ads account. This section describes that application specifically, not the storefront visitor experience.

The only scope requested is https://www.googleapis.com/auth/adwords. It is used to access the Google Ads account we own: to read search volumes and keyword ideas that inform how we name our products and write their page content, to create our own advertising campaigns, and to read back the performance of those campaigns.

We do not access any advertising account belonging to a third party, we do not offer this tool to any client or outside party, and we do not sell it.

The refresh token is stored in a configuration file on our own server with restricted operating-system permissions. It is never exposed to a browser, never transmitted to any other party, and access is limited to our system administrators.

We do not sell Google user data, do not share it, do not use it to advertise on behalf of others, and do not use it to train generalised AI models. It is used solely for the purposes described above.

Authorisation can be revoked at any time at https://myaccount.google.com/permissions, after which the application immediately loses access. Deletion of any data derived from it can be requested at the address below.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

11. Your rights

You may request a copy of your data, ask us to correct or delete it, restrict or object to processing, or withdraw a consent you previously gave.

We respond within a reasonable period and may ask you to verify your authority over the account before acting, to protect it.

12. Not intended for individuals

The store is for medical businesses buying at wholesale. It is not directed at individual consumers or at anyone under 18, and we do not knowingly collect children’s data.

13. Changes to this policy

We may update this policy as our services or legal obligations change. The last-updated date appears at the top of this page, and we notify account holders of any material change.

14. Contact

For any privacy question or request: info@ultrateb.com