The short version
- We collect what we need to forward your parcels: your account details, delivery address, orders and the store receipts you upload.
- No advertising, no analytics or tracking tools, and we never sell your data.
- Card numbers are typed on the bank's payment page. We never see or store them.
- AI features run on Google Gemini through our own server. The weight check sends only product titles and store names.
- Fingerprint and face unlock stay on your phone. We never receive biometric data.
- You can download a copy of your data or delete your account from Settings in the app, or by email.
01Who we are
The data controller is EAG PLUS, [to confirm: legal form, e.g. SAS / SARL], registered with the RCS of [to confirm: RCS city and number], SIRET [to confirm], registered office [to confirm: registered office address].
Our receiving warehouse is at 8 avenue Charles de Gaulle, 93420 Villepinte, France.
This policy covers the EAG+ mobile app, the website www.eagplus.com and our support channels (email and WhatsApp).
Data protection contact: support@eagplus.com. [to confirm: name of a Data Protection Officer, if one is appointed]
Deliveries, cash collection and customer pickup in Lebanon are handled by [to confirm: EAG PLUS directly, or the name of the Lebanese partner company].
02What we collect
Your account
- Full name, phone number and email address.
- The password you choose. Your sign-in token is kept in the secure storage of your phone.
- The personal suite code we give you, which is your address at our warehouse.
- Verification codes we send you by email or WhatsApp when you sign up, sign in or reset your password.
Delivery
- Your delivery address and city, and whether you chose home delivery or pickup.
- An approximate location (usually the city) worked out from your IP address when your account is created. We use it to plan deliveries. The app does not use your phone's GPS.
Your orders
- The product links you paste or share into the app, and the item details we read from them: title, price, quantity, image, store name.
- Declared values, weights, insurance and delivery choices, quotes, order status, tracking, invoices and payments.
- Your wallet store credit, loyalty points, tier and account balance.
Store receipts
To place an order you upload the purchase receipt the store sent you: a photo taken with your camera, an image from your gallery, or a PDF. A receipt can show your name, address, order number and the last digits of the card you paid with, as printed by the store. We use it to match your parcel when it arrives and to declare its contents and value.
Payments
We record the payment method, amount, status and transaction reference. Card payments are entered on the hosted payment page of Mastercard Payment Gateway Services, operated for Bank of Beirut. Whish Money payments are approved in your Whish account. We never receive or store your full card number or your Whish credentials.
Messages to us
What you write to us on WhatsApp or by email, and the questions you ask the in-app assistant (see AI features).
Device and technical data
- A push notification token, only if you allow notifications.
- Your language and app version.
- Your IP address and basic request logs, processed by our hosting provider when the app or website talks to our servers.
- When the app checks for updates, it contacts Expo's update service, which sees your IP address and app version.
Kept only on your phone
- Your baskets and draft quotes, recently used stores and your settings. They stay on the device until you clear them or uninstall the app.
- Biometric lock. If you turn on fingerprint or face unlock, your phone's operating system checks it. The app only receives a yes or no. We never receive biometric data.
Cart import (Android)
If you choose to import your cart, the store's website opens inside the app and you sign in directly with the store. The app reads the items in your cart (title, price, quantity, image, link) to build your quote. We do not read or keep your store password. The store's own cookies stay in the app's browser on your phone.
Phone permissions
Camera (only when you photograph a receipt), photos and files (only the files you pick), notifications (only if you allow them), and fingerprint or face unlock (only if you turn the lock on).
What we do not collect
No advertising ID, no analytics or tracking SDKs, no contacts, no precise GPS location, and nothing about your activity in other apps or websites.
03Why we use it, and on what legal basis
Under the GDPR every use of personal data needs a legal basis. Ours are:
| What we do | Legal basis |
|---|---|
| Create and run your account, give you a suite code, send verification codes | Performance of our contract with you (Art. 6(1)(b) GDPR) |
| Quote, receive and match your parcels, ship them, clear customs and deliver them | Performance of the contract |
| Take payments, issue invoices, keep accounting records | Contract, and our legal obligations (Art. 6(1)(c)) |
| Customs declarations and answering lawful requests from authorities | Legal obligation |
| Order status notifications | Your consent, given through your phone's permission prompt. You can switch them off at any time in Settings. |
| AI weight estimates and the prohibited-items check | Our legitimate interest in accurate quotes and in not shipping forbidden goods (Art. 6(1)(f)) |
| The AI help assistant, using your account details | Performance of the contract, at your request (only when you send a message) |
| Customer support | Contract and legitimate interest |
| Security, fraud prevention and rate limiting | Legitimate interest |
| Approximate location from your IP to plan delivery | Legitimate interest |
We make no decisions about you based solely on automated processing that have legal or similarly significant effects. When the AI flags an item as prohibited, the item is only left out of the automatic quote. You can ask our team to review it.
04AI features (Google Gemini)
The app uses Google's Gemini models for two features. The app never talks to Google directly: it sends the request to our server, which calls the Gemini API.
Weight estimate and prohibited-items check
When you build a basket, we send the product titles (up to 200 characters each) and store website names. No personal data is sent. Gemini returns an estimated weight and flags items we cannot carry.
Help assistant
When you send a message to the assistant, we send Google:
- your question and the last messages of the conversation (up to 12);
- if you are signed in, a short summary of your account: name, email, phone, suite code, account balance, wallet credit, loyalty points, and up to 15 recent orders (number, date, status, total and up to three item names).
Nothing is sent until you send a message. We do not store assistant conversations on our servers. Google processes the data under its Gemini API terms [to confirm: the API key is on a paid Google Cloud billing account, so Google does not use the content to improve its models].
AI answers and estimates can be wrong. They are not binding. Your final price is the one on your invoice.
05Who receives your data
We share data only with the companies that help us run the service, each for its own task, and with authorities when the law requires it. We never sell your data.
| Recipient | What for | Where |
|---|---|---|
| MAPOS [to confirm: legal entity] | Our business software (customers, orders, invoices, accounting). Data held on Supabase and Neon databases. | EU |
| Vercel Inc. | Hosting of our API server and this website | USA / global |
| Amazon Web Services (S3, CloudFront) | Storage of receipts and files | Frankfurt, Germany |
| Google (Gemini API) | AI weight estimates, item check, help assistant | USA / global |
| Google (Firebase Cloud Messaging) | Delivering push notifications on Android | USA / global |
| Apple (Push Notification service) | Delivering push notifications on iPhone | USA / global |
| Expo (650 Industries, Inc.) | Push notification relay and app updates | USA |
| Resend | Sending emails: verification codes, password resets, order confirmations | USA |
| Meta (WhatsApp) | Verification codes and support conversations on WhatsApp | USA / global |
| Bank of Beirut and Mastercard (MPGS) | Card payments | Lebanon / global |
| Whish Money | Whish payments | Lebanon |
| Airlines, freight forwarders, customs brokers, delivery drivers | Carrying, declaring and delivering your parcel (name, phone, address, contents and value) | France, Lebanon, transit countries |
| Customs and other public authorities | Customs clearance and legal requests | France, Lebanon |
We do not send your data to the online stores you buy from. Whatever you give a store, you give it directly.
If EAG PLUS is sold or merged, your data may pass to the new owner, who stays bound by this policy.
06Transfers outside the European Union
- Lebanon. Your parcel is delivered in Lebanon, so your name, phone, address and parcel details must go there. Lebanon has no EU adequacy decision. These transfers are necessary to perform our contract with you (Art. 49(1)(b) GDPR).
- United States. Some providers above are based in the US. We rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
Ask us at support@eagplus.com for more detail on these safeguards.
07How long we keep it
| Data | Kept for |
|---|---|
| Account details | As long as your account exists. Erased within 30 days after you delete it. |
| Orders, invoices, payment records and receipts | 10 years from the end of the financial year, as French accounting law requires (Art. L123-22 Commercial Code) [to confirm]. Then deleted. |
| Support messages | [to confirm: e.g. 3 years after your last contact] |
| Push notification token | Until you switch notifications off, sign out, or delete your account |
| AI assistant conversations | Not stored by us. Google keeps API data as described in its terms. |
| Server logs | A short period, kept by our hosting provider for security and troubleshooting |
| Data on your phone | Until you clear it or uninstall the app |
08Security
- All traffic between the app, the website and our servers is encrypted (HTTPS).
- Your sign-in token is kept in your phone's secure storage and excluded from backups.
- Receipts are stored privately. Staff open them through short-lived links.
- Service keys (AI, payments) live on our servers, never in the app.
- Access to customer data is limited to the staff who need it.
- You can add a fingerprint or face lock to the app in Settings.
If a breach puts your data at risk, we will notify the CNIL and, where required, you.
09Your rights
Under the GDPR and the French Data Protection Act you have the right to:
- access your data and get a copy;
- correct it;
- have it erased;
- restrict how we use it;
- receive it in a portable format;
- object to uses based on our legitimate interest;
- withdraw your consent at any time (for example, switch off notifications);
- give instructions on what happens to your data after your death.
How to use them
- In the app: Settings → Request a copy of my data, or Settings → Delete account.
- By email: support@eagplus.com. If the in-app deletion cannot finish automatically, the app gives you this email option, and we erase the account within 30 days.
We answer within one month. We may ask you to confirm your identity first.
You can also complain to the French data protection authority: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
11Children
EAG+ is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
12Changes to this policy
We may update this policy when the service or the law changes. The date at the top shows the latest version. For important changes we will tell you in the app or by email before they apply.
13Contact
See also our Terms of Use.