Privacy policy

Effective 30 July 2026. Mallello processes personal data to operate accounts, hosted purchases, vendor services, support, security, and communications.

Data we process

This can include account identity and contact details, vendor applications, delivery addresses, order and refund records, saved and followed listings, support messages, security/audit information, and limited card references such as brand, expiry, and last four digits. Mallello does not receive full card numbers or card security codes.

How data is used

We use data to authenticate users, authorize account roles, provide and fulfill requested services, process payments and refunds, send transactional messages, prevent abuse, maintain records, comply with law, and improve reliability. We do not currently use non-essential advertising cookies or sell personal data.

Service providers

Supabase provides authentication, PostgreSQL, and file storage; Stripe provides payments, billing, connected-account onboarding, and payouts; and the configured email provider delivers transactional and support email. Deployment and monitoring providers may process technical request data. Each provider processes data under its own terms and applicable data-processing commitments.

Legal bases and sharing

Depending on location, processing is necessary to perform a contract, meet legal obligations, protect legitimate security and operational interests, or act on consent. Order details are shared with the relevant vendor as necessary for fulfillment. Data may also be disclosed where legally required or during a properly protected business transfer.

Retention and security

Account and commerce records are retained only as needed for the service, disputes, fraud prevention, tax/accounting, and legal obligations. Access is role-restricted, sensitive configuration is kept server-side, payments are delegated to Stripe, and administrative actions are audited. No system can guarantee absolute security.

Your choices and rights

You may update common account details in the dashboard and request access, correction, deletion, restriction, portability, or objection where applicable. Some commerce records must be retained after account deletion. Use the Contact and support page to make a privacy request; identity verification may be required.

International transfers and children

Providers may process data outside your country using lawful safeguards. Mallello is not intended for children who cannot enter a binding purchase contract in their jurisdiction.

Changes

Material changes will be posted here with an updated effective date. This policy must be reviewed against the operating company’s identity, actual provider regions, retention schedule, and launch jurisdictions before live deployment.