Privacy policy

1. Who we are

Counterpoint is retail software made by Pragmatech, based in Cairo, Egypt (“we”, “us”).

We play two different roles. For visitors and account holders (the data in section 2) we decide how the data is used, so we are the controller. For the data a shop keeps about its own customers and staff (section 3) the shop decides how it is used and we are its processor.

Questions about this policy: support@pragmatech.work.

2. What we collect about you

• Account details. Your business name, your email address, the plan and billing period you chose, and a password. The password is kept only as a one-way hash, so we cannot read it.
• Where you came from. When you arrive from an ad or a link we note the campaign tags in the address (for example utm_source and utm_campaign), the ad click identifier if there is one (fbclid, gclid, li_fat_id), the site that referred you, and the first page you landed on. This is kept on your device. If you then create a store, it is saved with the store so that we can tell which campaigns bring real customers.
• Security and usage records. Sign-in events, the IP address of requests (used to limit abuse), error logs, and an audit trail of actions taken inside your shop.
• Email. We send the messages your account needs: address confirmation, password reset, invitations and billing notices. If you write to us, we keep the conversation.
• Advertising and measurement tags, only if you agree. If you accept them on our cookie notice, Meta, Google and LinkedIn tags run on our public pages and receive page views and a sign-up event. Meta also receives a lead event if you click the demo or WhatsApp link on sign-up: it names the button, not you, and our server sends Meta the same lead with the same event id. When you create a store, our server tells Meta that registration completed: a one-way hash of your email (and of a phone number, digits only with country code 20, if we have one), your IP address, your browser, the page address, the campaign tags and click id from that address, and the Meta cookies _fbp and _fbc when your browser has them. If you accepted the tags, that server event uses the same id as the browser sign-up event so Meta counts it once. Section 9 and the cookie policy say exactly what.

3. Your shop’s data

What you enter into Counterpoint (products, stock, sales, receipts, staff, and your customers’ names, phone numbers, emails and purchase history) is yours. You decide what to collect and why. We store and process it only to run the service for you, and we do not sell it, use it for advertising, or look at it except to give support you ask for or to keep the service secure.

You are responsible for having a lawful basis, and any consent needed, to hold your customers’ data and to contact them (for example, a customer’s opt-in before a WhatsApp campaign).

When you connect your own accounts (a payment provider, a courier such as Bosta or Mylerz, WhatsApp, your accounting system), Counterpoint sends the data needed for that feature to that provider on your behalf. Their own terms and privacy policies then apply to what they receive.

4. Why we use data, and on what basis

• To create your store, sign you in and run the service you asked for (performance of our contract with you).
• To invoice you and keep the records the law requires (contract and legal obligation).
• To keep Counterpoint secure, prevent abuse and fix faults (our legitimate interest in a safe service).
• To learn which campaigns lead to sign-ups, using the first-party campaign tags described above and a server-side registration event to Meta (our legitimate interest in measuring our own advertising), and to run the Meta, Google and LinkedIn tags and the matching lead event (your consent, which you can withdraw at any time).
• To tell you about changes to the service or these terms (contract and legitimate interest). We do not send marketing email unless you ask for it.

5. Who we share it with

We use a small number of service providers to run Counterpoint, and they handle data only on our instructions:

• Vercel hosts this website.
• Fly.io runs our servers.
• Supabase hosts our database.
• Resend delivers our account emails.

If you accept advertising tags, Meta, Google and LinkedIn receive the data described in the cookie policy and act as independent controllers of it. Meta also receives the server-side registration event described in section 2 when you create a store. We also disclose data when the law requires it, or to protect the safety of our users and service, and if the business is sold we would pass it to the buyer under the same commitments. We do not sell personal data.

6. Where it is stored

Our providers run data centres outside Egypt, for example in France. By using Counterpoint you understand that your data is transferred and stored there. We choose providers that commit contractually to protecting it, and we will not move your data to a place where the law gives it less protection without a safeguard in place.

7. How long we keep it

We keep account and shop data while your account is open. If you close your account, your shop is kept for a 30-day grace period in case you change your mind, and then deleted. Copies in backups are overwritten on our hosting provider’s normal backup cycle.

We keep invoices and billing records for as long as accounting and tax law requires. Security logs are kept only as long as they are useful for security and debugging. The campaign tags stored in your browser stay until you clear your site data.

8. How we protect it

• Everything travels over HTTPS.
• Passwords are hashed, and the keys you give us for your own integrations are encrypted at rest.
• Each shop’s data is separated from every other shop’s inside the database, and staff roles limit what each person can see.
• Two-step sign-in is available for every account, and actions in a shop are recorded in an audit trail.

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities within the time the law requires.

9. Advertising and cookies

Our public pages (the home page, pricing, sign-up and these policies) can load advertising and measurement tags from Meta, Google and LinkedIn, but only after you accept them on the cookie notice. They never load inside the signed-in product, the register, receipts, or any page whose address carries a private link or token. Creating a store also sends Meta the server-side registration event in section 2, whether or not you accepted the tags. The cookie policy lists each tag and how to change your choice.

10. Your rights

Under Egypt’s Personal Data Protection Law (Law No. 151 of 2020), and under other laws that apply to you, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, or limit or object to how we use it;
• withdraw a consent you gave, at any time. Withdrawing does not affect what we did before.

You can export your shop’s data yourself from your account, even if it is suspended. To use any other right, write to support@pragmatech.work; we will answer within the time the law allows. If you are not satisfied, you can complain to Egypt’s Personal Data Protection Centre or to the authority where you live.

If you are a customer of a shop that uses Counterpoint, please contact that shop first: it decides how your data is used.

11. Children

Counterpoint is for businesses. It is not directed at children, and we do not knowingly collect their data.

12. Changes

If we change this policy in a way that matters, we will email the owner of each account and update the date at the top. The latest version is always on this page.