Privacy Policy

1. Information We Collect

A. Information You Provide to Us

• Identity and contact data — full name, phone number, email address, and profile photograph (optional).
• Address data — home or delivery addresses and saved address-book entries.
• Account credentials — password (stored only in hashed form) and one-time verification codes.
• Seller business data — store name, business address, business license number, store hours, delivery radius, and product listings.
• Seller verification data — government-issued identification and supporting documents, collected solely for identity verification and fraud prevention.
• User content — product photographs, order notes, ratings, reviews, and messages sent through the Services.

B. Payment Information

All payment card processing is performed by our payment processor, Stripe, Inc. ("Stripe"). Card numbers are transmitted directly to Stripe and are never stored on Naybor servers. We receive only limited payment metadata, such as transaction identifiers, payment status, and the last four digits of the card. Seller payouts are processed through Stripe Connect, which may require sellers to provide additional identity and banking information directly to Stripe. Stripe's processing of your information is governed by the Stripe Privacy Policy.

C. Information Collected Automatically

• Device and technical data — device type, operating system, app version, browser type, IP address, and language settings.
• Usage data — pages and screens viewed, features used, search queries within the Services, and interaction timestamps.
• Approximate and precise location data — with your permission, we use location data to show nearby stores, verify delivery eligibility, and calculate delivery options. You may disable location access at any time in your device settings.
• Diagnostic data — crash reports and performance data collected through our error-monitoring provider to maintain service quality.

2. How We Use Your Information

We use personal information for the following purposes, and only to the extent necessary for each purpose:

• To create, maintain, and secure your account;
• To process orders, payments, refunds, and seller payouts, and to send order status notifications;
• To verify seller identity and eligibility, and to prevent fraud, abuse, and unauthorized access;
• To provide customer support and respond to your requests and inquiries;
• To send service communications (e.g., one-time passcodes, order updates, security alerts) by SMS, push notification, or email;
• To send marketing communications, only where permitted and always with the ability to opt out;
• To analyze, maintain, and improve the performance, safety, and functionality of the Services; and
• To comply with applicable legal obligations, including tax, accounting, and lawful requests from public authorities.

We do not sell personal information, and we do not use personal information for third-party behavioral advertising.

3. How We Share Information

We share personal information only as described below, and only with parties that are contractually or legally obligated to protect it:

A. Service Providers (Subprocessors)

We engage the following categories of service providers, who process personal information solely on our instructions and for the purposes described in this Policy:

• Stripe, Inc. — payment processing, identity verification for sellers, and payout disbursement;
• Twilio Inc. — delivery of SMS one-time passcodes and transactional text messages (your phone number is shared for this purpose);
• Google LLC (Firebase) — delivery of push notifications to your device;
• OpenAI, L.L.C. — processing of seller-submitted product photographs for the optional AI Product Scan feature, as described in Section 8;
• Cloud hosting and infrastructure providers — secure storage and operation of the Services; and
• Error-monitoring providers — collection of crash and performance diagnostics.

B. Buyers and Sellers

To fulfill a transaction, we share only the information necessary to complete it: sellers receive the buyer's name, delivery address, contact details, and order contents; buyers receive the seller's store name, address, and order-related information. Marketplace participants may use this information only to fulfill the transaction and for no other purpose.

C. Legal and Safety Disclosures

We may disclose personal information where required by law, court order, or governmental authority, or where reasonably necessary to detect or prevent fraud, enforce our Terms of Service, or protect the rights, property, or safety of Naybor, our users, or the public.

D. Business Transfers

If Naybor is involved in a merger, acquisition, financing, or sale of all or part of its assets, personal information may be transferred as part of that transaction, subject to this Policy and applicable law. We will notify you of any change in ownership or use of your personal information.

4. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law:

• Account data — retained while your account is active and deleted or anonymized within a reasonable period after account deletion, except where retention is required by law;
• Transaction records — retained as required for tax, accounting, and audit obligations;
• One-time passcodes — retained only briefly for verification and then expired;
• AI Product Scan photographs — deleted from our servers immediately after analysis (see Section 8); and
• Diagnostic logs — retained for a limited period for security and troubleshooting purposes.

5. Data Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit (TLS/HTTPS), hashed storage of passwords, role-based access controls, and the use of PCI-DSS-compliant payment processing through Stripe. No method of transmission or storage is completely secure; we therefore cannot guarantee absolute security, and we encourage you to protect your credentials and notify us immediately of any suspected unauthorized access at support@thenaybor.com.

6. Your Privacy Rights and Choices

Subject to applicable law, you have the right to access, correct, update, port, restrict, or delete your personal information, and to withdraw consent where processing is based on consent. You may exercise these rights as follows:

• Access and correction — review and update most account information directly in the app or by contacting us;
• Account deletion — request deletion of your account and associated personal information at any time from within the app's account settings or by emailing support@thenaybor.com. We will process verified deletion requests within the timeframe required by applicable law;
• Marketing opt-out — use the unsubscribe link in any marketing email or adjust notification preferences in the app;
• Push notifications and location — manage these permissions at any time in your device settings; and
• AI features — decline or withdraw consent for AI features as described in Section 8.

We will not discriminate against you for exercising any privacy right. Residents of certain jurisdictions (including California and other U.S. states with comprehensive privacy laws) may have additional rights under applicable law, including the right to know the categories of personal information collected and disclosed. To exercise any right, contact us at support@thenaybor.com; we may need to verify your identity before fulfilling your request.

7. Cookies and Similar Technologies

Our websites use cookies and similar technologies that are strictly necessary for the operation of the Services (such as session management and security) and, with your consent where required, analytics technologies that help us understand how the Services are used. You can control cookies through your browser settings; disabling strictly necessary cookies may affect the functionality of the Services. We do not use third-party advertising cookies.

8. AI Features and Third-Party AI Processing

Certain features of the Services use artificial intelligence provided by a third-party processor. These features are strictly optional, are never activated automatically, and process data only when you actively choose to use them. Express consent is requested in the app before first use.

A. AI Product Scan (Sellers Only)

• What is shared: when a seller voluntarily submits a product photograph to the AI Product Scan feature, that photograph — and only that photograph — is transmitted over an encrypted connection to our servers and forwarded to OpenAI, L.L.C. (United States) for analysis. No name, email address, phone number, location, device identifier, or other account information is included in the transmission.
• Purpose: the photograph is processed solely to identify the products it depicts and to generate suggested product names, descriptions, representative images, and price estimates for the seller's listing. It is not used for any other purpose.
• Retention by Naybor: the submitted photograph is permanently deleted from our servers immediately after the analysis completes. We retain only the AI-generated text results and a scan history linked to the seller's account, which the seller may have deleted at any time upon request.
• Retention by OpenAI: under OpenAI's API data-usage commitments, content submitted through its API is not used to train OpenAI's models and is retained for a maximum of thirty (30) days solely for abuse monitoring, after which it is permanently deleted.
• Consent and control: the feature operates only after the seller has granted express consent through an in-app prompt presented before first use. Consent may be declined or withdrawn at any time; declining disables the AI feature only and does not affect any other part of the Services.

B. No Automated Decision-Making with Legal Effect

Our AI features generate suggestions only. They are not used to make decisions that produce legal or similarly significant effects concerning you, and all AI-generated listing content remains subject to human review and approval by the seller before publication.

9. Children's Privacy

The Services are not directed to, and may not be used by, anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at support@thenaybor.com.

10. International Data Transfers

The Services are operated from the United States, and personal information is processed and stored in the United States. If you access the Services from another jurisdiction, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those of your jurisdiction. Where required, we implement appropriate safeguards for such transfers.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. If we make material changes, we will notify you through the Services or by other reasonable means before the changes take effect, and we will update the "Effective Date" above. Your continued use of the Services after the effective date of any update constitutes acknowledgment of the revised Policy.

12. Contact Us