App: Tatbiqi Store Manager · Developer: Tatbiqi, a brand of technology Abu Al-Ezz digital (تقنية ابو العز الرقمية), C.R. 1366116, Sultanate of Oman
Last updated: 18 October 2026
Tatbiqi Store Manager ("the App", "we", "us") is a business tool that lets a store's owner and authorised staff manage their WooCommerce store from a mobile device. This policy explains what data the App handles, why, and your choices. The App is intended for business users aged 18 and over and is not directed at children.
We do not collect your location, contacts, or photos. The camera and photo‑library permissions are used only when you choose to scan a barcode or upload a product image, and that content goes to your own store.
Solely to provide the App's features: to authenticate you, display and manage your store (orders, products, customers, coupons, reports, live visitors), and send notifications you have enabled.
We do not use your data, or your customers' data, for Tatbiqi's own marketing or for any advertising unrelated to your business, and we do not sell it. If you choose to use Tatbiqi Ads, we create advertising for your own business using only the material and settings you provide — see section 7.
We do not share your data with third parties for their own independent purposes. Where a feature cannot work without sending data to a provider, we say so: push notifications go to Google Firebase, and if you use Tatbiqi Ads your advertising material and settings go to Meta (section 7); and if you connect WhatsApp Business, your messages pass through Meta to reach your customers (section 8). Push notifications are delivered through Google Firebase Cloud Messaging, which processes the device token on our behalf as a service provider. Your store data is exchanged only between the App and your own WooCommerce store and our service that powers the App.
Account and device records are kept while your account is active. You can request deletion of your account and associated data at any time by emailing us. Deletion requests are carried out manually by our team. WhatsApp conversation data is covered separately in section 8.8.
Your sign-in credentials are stored encrypted on your device, and all communication with our servers uses HTTPS encryption. Where we must hold a credential on your behalf on our servers — such as the Meta access token described in section 7 — it is encrypted at rest using AES-256-GCM, with the key held only on our server. It is never sent to the mobile app, never displayed, and never included in an error message.
The App is not intended for or directed at anyone under 18, and we do not knowingly collect data from children.
This section applies only if you choose to use Tatbiqi Ads. If you never connect a Meta account, nothing described here happens.
You sign in on Meta's own page. We never see or ask for your Facebook or Instagram password. Meta then gives us an access token, which we store together with: your Meta user identifier; the Meta Business, Ad Account, Facebook Page and Instagram account identifiers you select; that ad account's currency; the permissions you granted; and what you are permitted to do on that ad account.
Before we charge you anything, we ask Meta whether the advertising account you selected is actually able to run advertising, and we keep the answer: its billing country, time zone and account status; whether a usable payment method is present — as a category only (card, prepaid, or none), never the card brand, the last four digits or any other payment identifier; the result of that check and when it was made. If the check fails, or if we cannot reach Meta, we do not take the service fee.
The campaign name; the ad text and headline you write; the button you choose; the destination web address; the image or video you upload; the audience you select (country, age range, gender); your daily budget and how many days it runs; and the exchange rate used to convert your budget from Omani Rials into your ad account's own currency.
The figures Meta reports for your campaigns — amount spent, reach, impressions and clicks, by day.
Solely to create and manage the campaigns you ask us to create, to show you their results, and to charge the Tatbiqi service fee.
A campaign you create is set up at Meta paused. No advertising money is spent, by anyone, until you explicitly start it in the app. When you do, Meta begins delivering the advertisement and charges your own Meta advertising account directly.
Creating an advertisement necessarily sends your creative, ad text, audience selections and budget to Meta, which processes them as the advertising platform under its own terms and privacy policy. Meta charges your advertising budget directly to your own Meta ad account; Tatbiqi never holds or passes on that budget. The Tatbiqi service fee is separate and is always charged in Omani Rials.
You can disconnect Meta from inside the app at any time. We erase the stored access token immediately when you do. You can also remove Tatbiqi's access from your own Meta account settings, which has the same effect. Disconnecting does not stop or delete campaigns that are already running at Meta — those remain under your control in your own Meta account.
Your Meta connection details, campaign records, performance figures and any internal record of operational changes we made to your campaigns are kept for as long as your Tatbiqi account exists, and are deleted when you ask us to delete them. We do not currently expire them automatically. See Deleting your data for how to request deletion and what we are required to keep.
8.1 How the connection is made. A merchant may connect their own WhatsApp Business Account to Tatbiqi using Meta's official WhatsApp Business Platform and Embedded Signup. The merchant owns the account and the business phone number, and grants Tatbiqi access through Meta. The integration is off until the merchant connects it, and the merchant can disconnect at any time.
8.2 What we process. When the merchant enables the integration, we process: WhatsApp Business Account and business phone number identifiers; the phone numbers of customers who message the merchant; the content of inbound and outbound messages; message IDs, timestamps, and delivery, read or failure status; conversation metadata such as unread state and when a conversation was handed to a person; the merchant's approved message templates; and the WooCommerce order or product information needed to answer a customer or send an order notification.
8.3 Why we process it. To show the merchant their customer conversations and let them reply; to generate AI-assisted replies only when the merchant has switched that on; to answer product and order questions using the merchant's own WooCommerce data; to send order-status notifications only when the merchant has enabled them; to track message delivery and surface failures; to hand a conversation to a human; and for security, abuse prevention and diagnosing faults.
8.4 The merchant is in control. AI replies and order notifications are off by default and are switched on by the merchant. Tatbiqi does not contact a merchant's customers for Tatbiqi's own marketing.
8.5 Meta's role. WhatsApp Business services are provided by Meta. Messages travel through Meta's systems, and Meta processes them under its own terms and privacy policy, which we do not control. Please also read WhatsApp's Business Terms and Meta's Privacy Policy.
8.6 Meta charges. Meta may charge for WhatsApp messages. Those charges are billed by Meta directly to the merchant's own WhatsApp Business Account. Tatbiqi does not collect, process or store the payment-card details used for Meta WhatsApp billing — those are entered on Meta's own pages and held by Meta.
8.7 Security. Access tokens and credentials for a merchant's WhatsApp integration are stored encrypted and are used only to operate that merchant's own integration. They are never returned to the app or shared with other merchants.
8.8 Keeping and deleting this data. Conversations and messages are kept while the integration is connected, so the merchant has their history. We do not currently delete them automatically after a fixed period. Disconnecting removes our access to the merchant's WhatsApp account and deletes the stored access token, but does not by itself erase past conversations. A merchant may ask us to delete their WhatsApp conversation data by emailing info@tatbiqi.om, and we will do so.
8.9 The merchant's responsibility. Merchants are responsible for having a lawful basis and any necessary permission to message their customers, and for their own compliance with WhatsApp's Business Messaging Policy and applicable law.
We may update this policy from time to time. Material changes will be posted on this page with a new "Last updated" date.
For any privacy question or data-deletion request:
info@tatbiqi.om
General enquiries: info@tatbiqi.om