Privacy Policy for 9thCart

Effective Date: January 1, 2026 · Last Updated: October 15, 2026 · Application: 9thCart (https://9thcart.ae)

1. Information We Collect

When you visit, register for an account, sign in, or place an order on 9thCart, we collect only the minimum personal information necessary to provide our e-commerce marketplace and UAE delivery services:

1.1 Google Sign-In & OAuth 2.0 User Data

If you choose to sign in or create an account using Google Sign-In (Google OAuth 2.0), 9thCart requests access to basic Google profile scopes (openid, email, and profile) and collects the following Google user data:

• Email Address: Your primary Google account email address, used as your unique account identifier, login credential, and to send transactional order receipts and tax invoices.
• Basic Profile Information (Full Name & Profile Picture): Your display name and profile avatar URL from your Google account, used solely to personalize your 9thCart customer profile header and pre-fill your name on delivery orders.
• Google Account Unique Identifier (UID / ID Token): Used strictly to authenticate your session securely via Firebase Authentication.

1.2 Account, Order & Delivery Information

• Contact Details: Your mobile phone number (verified via OTP for UAE courier coordination and WhatsApp order status updates) and email address.
• Delivery Addresses: Your building name, apartment/villa number, street address, Emirate (Dubai, Abu Dhabi, Sharjah, Ajman, Ras Al Khaimah, Fujairah, or Umm Al Quwain), and optional GPS pin location required for doorstep grocery and school stationery delivery.
• Order & Transaction History: Products purchased, order timestamps, invoice totals, and delivery status records.
• Payment Information: We do not collect or store your full credit card or debit card numbers on 9thCart servers. All card, Apple Pay, and Tamara/Tabby BNPL payments are processed directly by PCI-DSS Level 1 certified payment gateways (Stripe and Paymob UAE) over 256-bit SSL encryption.
• Device & Push Notification Tokens: If you grant notification permission on Android, iOS, or web browsers, we store a Firebase Cloud Messaging (FCM) device token to send real-time order status alerts (such as order confirmation, packing, dispatch, and delivery).

2. How We Use Your Data

9thCart uses the collected personal data and Google user data strictly for the following purposes:

• User Authentication & Account Management: To create and authenticate your 9thCart account via Google Sign-In, Email/Password, or Phone OTP, and maintain your shopping cart, saved addresses, and order history across devices.
• Order Fulfillment & 24-Hour UAE Delivery: To pack your groceries, spices, and school stationery and coordinate doorstep delivery or hub pickup across the United Arab Emirates.
• Transactional Communications & Push Notifications: To send official UAE tax invoices, order confirmations, live delivery tracking updates, and pickup notifications via Email, WhatsApp, SMS, and Firebase Push Notifications.
• Customer Support & Refunds: To assist you with order inquiries, 14-day quality guarantee returns, and wallet refunds.
• Security & Fraud Prevention: To verify user identity, prevent unauthorized account access, and comply with UAE consumer protection and tax laws.

3. Google API Services User Data Policy & Limited Use Compliance

9thCart strictly complies with Google's OAuth 2.0 policies:

• Limited Use Statement: 9thCart's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• No Sale of Data: We never sell, rent, license, or trade your Google user data or personal information to data brokers, advertisers, or any third parties.
• No Advertising or Profiling: We do not use data obtained from Google Sign-In/Google APIs for targeted third-party advertising, creditworthiness assessment, or AI model training.
• No Unauthorized Human Access: Humans do not read your Google user data unless you explicitly request customer support assistance, it is necessary for security/abuse investigation, or required to comply with applicable law.

4. Data Sharing & Disclosure

We share your information only with trusted, contractually bound service providers to the minimum extent necessary to operate the 9thCart platform:

• Cloud Infrastructure & Authentication: Supabase (encrypted PostgreSQL database) and Google Firebase (Firebase Authentication and Firebase Cloud Messaging for push notifications).
• Payment Processors: Stripe and Paymob UAE for secure 3D-Secure payment processing.
• Logistics & Courier Partners: Authorized UAE delivery drivers and fulfillment hubs receive your recipient name, delivery address, and phone number solely to deliver your order.
• Legal Compliance: When required by UAE federal law, judicial order, or regulatory authorities.

5. Data Storage, Security & Protection

We implement industry-standard technical and organizational security safeguards to protect your data:

• All data transmitted between your browser/mobile app and https://9thcart.ae is encrypted in transit using 256-bit HTTPS/TLS (TLS 1.3).
• Database records are encrypted at rest and protected by Row-Level Security (RLS) access controls and JWT authentication.
• Access to production servers is restricted via cryptographic SSH keys and role-based access controls.

6. Data Retention, Access & Account Deletion Rights

You have full control over your personal data on 9thCart:

• Access & Correction: You can view and update your full name, email address, phone number, and saved delivery addresses at any time inside the 9thCart app under Profile → Personal Information.
• Revoking Google Sign-In Access: You may revoke 9thCart's access to your Google account at any time via your Google Account Security settings (myaccount.google.com/permissions).
• Account & Data Deletion: You can request permanent deletion of your 9thCart account and all associated personal data (including Google profile data, saved addresses, and push notification tokens) either directly inside the mobile/web app under Profile → Security & Privacy, or by sending an email to support@9thcart.ae or siparaaiedu@gmail.com. Deletion requests are completed within 48 hours, except where tax invoice retention is required by UAE Federal Tax Authority regulations.

7. Cookies & Mobile App Permissions

• Web Storage & Essential Cookies: We use local storage and session cookies strictly to keep you signed in, preserve your shopping cart items, and remember your language/theme preferences.
• Mobile Permissions (Android & iOS): The 9thCart mobile app requests notification permission (POST_NOTIFICATIONS) to alert you of live order updates, and optional camera/photo permission only if you voluntarily use the AI Receipt/Booklist Scanner feature.

8. Children's Privacy

Although 9thCart sells school stationery and student booklist packages for families, accounts and purchases on 9thCart must be created and completed by parents, legal guardians, or adults aged 18 and older.

9. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect operational, legal, or regulatory updates. Any changes will be posted on this page (https://9thcart.ae/privacy-policy) with an updated revision date.

10. Contact Us

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your data rights, please contact our Data Protection & Customer Care team: