سياسة الخصوصية وحماية البيانات

Privacy Policy - Pastel (pastel-eg.com) 1. Data We Collect Account data: name, email, phone, city Booking data: event date, type, services Provider/Tenant data: business name, portfolio, packages, staff accounts Google User Data: email, profile (userinfo.email, userinfo.profile) only Meta User Data: Page ID, IG Business ID, encrypted access tokens (we never store your FB password) Technical: IP, device, cookies 2. Data Protection Mechanisms for Sensitive Data (Required by Google) Encryption in Transit: TLS 1.2+ / HTTPS with HSTS for all traffic to/from Google, Meta, and users. Encryption at Rest: AES-256-GCM for sensitive fields (emails, phones, OAuth tokens) in PostgreSQL with encrypted volumes. Token Storage: Tokens stored in encrypted DB column + secure env vars, never in logs or code. Auto-rotation. Access Control: RBAC, Principle of Least Privilege, MFA for production access, only 2 admins. No Human Access: No employee views Google/Meta user data unless user requests support and consents. No manual review for ads. Data Minimization: We request only minimum scopes needed (see Terms). We do not copy entire inbox/drive. Infrastructure: Hetzner EU, UFW firewall, daily encrypted backups, Fail2Ban, Traefik with auto SSL. Retention: Tokens deleted on disconnect (24h) or account deletion (7 days). Bookings 3 years then anonymized. No Sale/Transfer: We never sell or transfer sensitive data to advertisers or data brokers. Only necessary processors (Kashier, Fawry, WhatsApp Cloud). Compliance: Complies with Google API Services User Data Policy & Limited Use. Data not used for ads personalization. 3. How We Use Data Create/manage bookings between clients and tenants Publish content YOU explicitly approve to YOUR own FB Page/IG (after clicking Publish) Send transactional WhatsApp notifications via WhatsApp Cloud API Generate secure payment links via Kashier/Fawry (PCI-DSS, we store no card data) 4. Sharing We do not sell data. Sharing only with: Client<->Tenant to fulfill booking, technical processors (Meta, Google, payment gateways), or legal request from Egyptian authority. 5. Your Rights & Deletion See our dedicated page: https://pastel-eg.com/data-deletion Access, update, delete your data anytime Delete Tenant account: Dashboard > Settings > Delete Tenant - deletes all bookings, media, staff, tokens within 7 days Revoke Google: myaccount.google.com/permissions > Remove Pastel Revoke Meta: FB > Settings > Business Integrations > Remove Pastel 6. Google API Compliance Use of Google user data adheres to Google API Services User Data Policy, including Limited Use. We do not use restricted scope data for advertising. 7. Contact info@pastel-eg.com | +20 10 22743790 | Port Said, Egypt