Privacy Policy

1. Who we are

Koraa ("Koraa", "we", "us") is a Cameroonian commerce platform operated from Cameroon. We provide merchants with a hosted e-commerce storefront, a mobile-money checkout, and related tools through koraa.cm and its subdomains.

For the purposes of data protection law, Koraa is the data controller for the personal data of merchants and their staff. For personal data submitted by a merchant's customers at checkout, the merchant is the controller and Koraa acts as a data processor on their behalf.

Our contact address for all privacy matters is privacy@koraa.cm.

2. What we collect and why

We collect personal data in three main contexts: when a merchant creates and manages an account, when a visitor browses or buys from a storefront, and when a payment is made. The table below gives an overview; the sections that follow go into detail.

3. Merchant data

When you create a Koraa account we ask for your full name, email address, and a password. If you sign in with Google, we receive your name, email address and Google account identifier from Google; we do not store your Google password.

During merchant onboarding you provide a business name, phone number, and optionally a business address. This information appears on invoices and is used to set up your payout account with our mobile-money payment partners.

We use your email address to send you:

• A verification email when you sign up
• Password-reset and security notifications
• Receipts for your Koraa subscription payments
• Product updates and announcements — you can opt out at any time from your account settings

We do not sell your contact details to third parties, and we do not use your business data to train machine-learning models without your explicit consent.

4. Storefront visitor and customer data

When someone visits a storefront powered by Koraa we collect aggregated, anonymised analytics: pages visited, referrer domain, browser family, operating system, and approximate country (derived from the IP address, which is then discarded). This data is attributed to your store, not to an individual visitor, and is presented in the analytics section of your dashboard.

When a customer places an order they provide a name, phone number, and the mobile-money number they are paying from. This data is stored in Koraa's database and is visible to you, as the store owner, in your order management dashboard. You are responsible for how you use and retain that customer data, and you must inform your customers according to any applicable law.

Customers do not need a Koraa account to buy from your store. We do not set tracking cookies on storefront pages.

5. Payments and financial data

Koraa integrates with MTN Mobile Money and Orange Money to process payments. When a payment is initiated, your mobile money number (or your customer's) is passed to the relevant network's API to generate a payment prompt. Koraa stores the transaction reference, amount, currency, and outcome for accounting and dispute purposes. We do not store, and never see, full card numbers or mobile-banking PINs.

Your subscription to Koraa is also billed by mobile money. The payout number you add to your account is used by our payment partner to settle merchant funds to you according to their payout schedule.

Financial records are kept for seven years to satisfy Cameroonian legal and tax obligations, even after you close your account.

6. Cookies and local storage

On the Koraa dashboard we use:

• Session storage and IndexedDB — to keep you signed in via Firebase Authentication. These are cleared when you sign out or when the browser session ends.
• Local storage — to remember lightweight UI preferences (such as your chosen theme). No personal data is stored here.

We do not use advertising cookies, fingerprinting, or any form of cross-site tracking. We do not run Google Analytics or Meta Pixel. Our own analytics are first-party only and use aggregated, IP-discarded data as described in section 4.

7. Who we share data with

We share personal data only where necessary to deliver the service:

• Firebase (Google) — for authentication (sign-in, email verification, password reset). Firebase processes the minimum data needed to confirm your identity.
• MTN Mobile Money / Orange Money — phone numbers and payment amounts, to initiate and verify transactions.
• Fapshi — our payment gateway partner, which processes mobile-money transactions on our behalf under its own data processing agreement.
• Resend — our transactional email provider, which receives your email address and the content of system emails (receipts, password resets). Resend does not use this data for any purpose other than delivery.
• Cloudflare — our CDN and storage provider. Images and static assets you upload are stored on Cloudflare R2. Cloudflare may log requests for security purposes.

We do not sell personal data. We do not share data with advertisers. We will disclose data to law enforcement or regulatory authorities only when required by Cameroonian law and after verifying the legal basis for the request.

8. How long we keep data

• Account and store data — retained while your account is active and for 90 days after you request deletion, to allow for data export and dispute resolution.
• Order and payment records — retained for seven years from the date of transaction for legal and tax purposes.
• Analytics data — aggregated, non-personal. Retained for the period visible in your dashboard (30 days on the free plan, up to 365 days on Pro and Enterprise).
• Support communications — retained for two years from the last message, after which they are deleted.

9. Security

We implement the following measures to protect your data:

• All data in transit is encrypted with TLS 1.2 or higher
• Passwords are never stored in plain text — authentication is managed by Firebase, which uses industry-standard hashing
• Database access is restricted to the application server; direct public access is disabled
• Media storage is access-controlled; publicly linked assets are served through authenticated signed URLs
• Staff access to production systems is limited to those who need it and is reviewed regularly

No system is perfectly secure. If you discover a vulnerability, please report it to security@koraa.cm and we will investigate promptly.

10. Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data, which you can do directly in your account settings
• Export your store data in a machine-readable format from the dashboard
• Delete your account and associated data — go to Settings → Account → Delete account, or email us
• Object to marketing emails at any time by unsubscribing or updating your notification preferences

To exercise any right, or if you have a question we have not answered here, contact us at privacy@koraa.cm. We will respond within 30 days.

11. Children

Koraa is intended for use by adults operating businesses. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a minor has created an account without parental consent, please contact us and we will delete the account promptly.

12. Changes to this policy

We may update this policy when we change how we handle data or when the law requires it. When we make a material change we will notify merchants by email and display a notice on the dashboard for 30 days. The "Last updated" date at the top of this page always reflects the current version. Continuing to use Koraa after a change takes effect means you accept the updated policy.

13. Contact us

For privacy questions, data requests, or to report a concern:

See also our Terms of Service.