Privacy Policy

1. Who we are

Codit is an order management service for cash-on-delivery e-commerce sellers in Morocco. Codit is a product of SteinStack LLC, a Wyoming limited liability company (EIN 98-1982079) at 30 N Gould St Ste R, Sheridan, WY 82801, United States ("SteinStack", "we", "us"). SteinStack LLC is responsible for the personal data described in this policy. This policy explains what we collect, why, and what you can ask us to do about it. It covers the Codit web application, the Codit mobile application, and this website. Questions about anything here go to contact@codit.ma.

2. Information we collect

Account data: your name, email address, phone number, business name, and the role you hold in your workspace. If you sign in with Google or Apple, we receive the account identifier and the profile details they share with us. If you use a passkey or two-factor authentication, we store the public key or the encrypted secret needed to verify you, never your private key. We also record when you last signed in.

Connection data: the access tokens and API credentials you authorise when you connect a store platform (Shopify, YouCan, WooCommerce, Lightfunnels, Storeep), a courier account (Sendit, OzonExpress, Coliix, ForceLog, Ameex), a WhatsApp Business number, or a Meta or TikTok ad account. For a WhatsApp number we also store the two-step verification PIN set during connection. All of these are stored encrypted.

Order data from your connected stores and channels: order references, products, quantities, prices, order status, and your end customer's name, phone number, email address when available, and delivery address. Where your store provides it, we also receive how the customer arrived at your shop: landing page and referrer, campaign tags (UTM), ad click identifiers (such as fbclid or ttclid), IP address, and browser user agent.

Advertising data: when you connect an ad account, we import daily campaign-level spend, impressions, and clicks so your reports can show real profit. This data is about your campaigns, not about individual people.

Payment records: for card payments, handled by our payment processor Stripe, you enter your card details on Stripe's secure page, and we only receive the payment status, amount, and reference; we never see or store card numbers. For bank transfers, we store the amount, your payment reference, the receipt you upload, and the date.

Usage data: pages visited, actions taken in the app, browser and device type, IP address, and error reports, collected through PostHog to understand how the product is used and to fix faults.

3. How we use your information

We use your data to run the service you signed up for: importing orders, letting your agents confirm them, sending confirmation messages on WhatsApp when you enable it, creating shipments with your couriers, tracking deliveries, managing your stock, calculating agent commission, reporting conversions to the ad platforms you connect, and producing your dashboards and reports. We use your account and payment records to manage your free trial and subscription, verify payments, and contact you about renewals, expiry, and service notices. We use usage and error data to keep the service working, diagnose faults, and improve the product. We do not use your end customers' personal data for our own marketing, and we do not sell personal data to anyone.

4. Your end customers' data

When Codit imports or receives an order, we process your customer's personal data on your behalf. You remain responsible for that data towards your customers, for having a lawful basis to hold it, and for informing them of how it is used, including any WhatsApp messaging and advertising measurement you enable. We act as your processor and only use it to deliver the service to you. Customer contact details are encrypted at rest and are visible only to users in your workspace whose role and assignment gives them access: a confirmation agent sees the orders assigned to them, not your whole customer base. Phone numbers are matched for duplicate and blacklist checks using a keyed hash, not in readable form. When a connected platform sends us a deletion or redaction request for a customer (for example a Shopify privacy webhook), we remove or anonymise the matching personal data. Test orders are kept separate and are never sent to couriers, ad platforms, or AI providers.

5. WhatsApp messaging

This section applies only if you connect a WhatsApp Business number. Codit connects to the WhatsApp Business Platform (Cloud API) operated by Meta, as a Meta Tech Provider. You can keep using the WhatsApp Business app on the same number.

When you enable order confirmation on WhatsApp, Codit sends your customer a template message containing their name, the order reference, your store name, the products, the amount due, and the delivery address. Replies and conversations with your customers are stored in your workspace, with message content and the customer's WhatsApp profile name encrypted. If you accept Meta's offer during connection, up to 180 days of your existing chats and contacts are imported so your inbox is complete.

Messages pass through Meta's systems under Meta's own terms and privacy policy. You are responsible for having your customers' permission to contact them on WhatsApp and for following WhatsApp's Business and Commerce policies. Meta bills you directly for messages; Codit does not add a fee.

6. Advertising platforms

This section applies only if you connect a Meta or TikTok ad account. When an order is confirmed and when it is delivered, Codit reports the event to Meta (Conversions API) or TikTok (Events API) so your campaigns can optimise for real sales. Each event includes the order value and currency. The customer's phone number, email address, and order identifier are hashed with SHA-256 before they leave Codit. The ad click identifier, IP address, and browser user agent are sent as received, because the platforms need them to match the event to an ad. The customer's name and address are never sent.

When you enable customer lists (audiences), Codit sends hashed phone numbers of delivered customers to build an audience, and of refused or returned customers to exclude them. Ad platforms process this data under their own terms and privacy policies. You are responsible for informing your customers of advertising measurement and for having a lawful basis for it.

7. AI features

AI features are off unless they are enabled for your workspace. When enabled, Codit uses third-party AI models, currently Anthropic's Claude, with OpenAI and Google Gemini as possible alternatives, to answer customers on WhatsApp, take orders from WhatsApp conversations, match free-text city names to courier cities, and assist your team inside the app.

We send the AI provider only what the task needs: for a confirmation conversation, the ordered products, quantities, total, city, address, the customer's first name, your store information sheet, and the conversation so far; for order-taking, the relevant part of your catalogue. The customer's phone number is never sent. The AI assistant tells customers it is an automated assistant. Prompts that contain names or phone numbers are not written to our logs, AI conversation transcripts are encrypted, and we keep a usage record (tokens and cost, never content) for 13 months. We use the providers' business API services, under terms that do not allow them to train their models on the data we send.

8. Mobile application

The Codit mobile app uses your camera only to scan parcel tracking codes, and only when you open the scanner. It sends push notifications through Expo's push service, Google Firebase Cloud Messaging, and Apple Push Notification service, and stores your sign-in token in the device's secure storage. It does not access your location, contacts, or photo library. You can request deletion of your account from the app; the account is deleted after 30 days, and then anonymised.

9. Who we share data with

We share data only where it is needed to run the service, and only with the services you connect or that we use to operate Codit:

Store platforms and couriers you connect, to import orders and create and track shipments. Meta (WhatsApp Business Platform, Conversions API, ad insights and audiences) and TikTok (Events API, reporting and audiences), when you connect them. AI providers (Anthropic, and OpenAI or Google if used), when AI features are enabled. Stripe, for card payments. PostHog, for product analytics and error tracking. Google Maps Platform, for address suggestions when an address is typed in the app. Expo, Google Firebase, and Apple, for push notifications. Google and Apple, when you choose to sign in with them. Our hosting and email delivery providers, which process data on our instructions and under contract.

Each of these acts under its own terms or under contract with us. We may disclose data where the law requires it, or to establish or defend legal claims. We never sell your data or your customers' data.

10. International transfers

SteinStack LLC is based in the United States, so we process your data there. Some of the providers above, including PostHog, Stripe, Meta, TikTok, Google, Apple, and the AI providers, also process data outside Morocco, in particular in the United States and the European Union. We only transfer the data each service needs, and we do so in accordance with Moroccan Law 09-08 and the requirements of the CNDP.

11. Data retention

We keep your account and order data for as long as your workspace is active. After a subscription ends we keep your data for 12 months so you can return without losing your history, then delete or anonymise it. When you delete your account, it is removed after 30 days and anonymised; if you are the last administrator of a workspace, the workspace and its data are deleted with it. AI usage records are kept for 13 months. Payment records and invoices are kept for as long as Moroccan tax and accounting law requires. You can ask us to delete your workspace sooner and we will do so, apart from records we are legally required to keep.

12. Security

Customer contact details, message content, and all connection credentials and tokens are encrypted at rest. Passwords are stored hashed, never in readable form. Access to your workspace's data is scoped by role and assignment, workspaces are isolated from each other, and every status change on an order is recorded with the user who made it and when. We support two-factor authentication and passkeys, and we recommend enabling one of them. Data is transmitted over encrypted connections. No system is perfectly secure; if a breach affects your personal data we will tell you and the competent authority as required by law.

13. Your rights

Under Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data, you may ask us for a copy of the personal data we hold about you, ask us to correct it if it is wrong, ask us to delete it, and object to certain processing. Write to contact@codit.ma and we will answer within 30 days. We may ask you to confirm your identity first. If you are an end customer of a seller who uses Codit, please contact that seller first, since they decide how your data is used; we will help them answer you. If you are not satisfied with our answer you can complain to the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

14. Cookies

We use cookies that are necessary for the service to work: a session cookie that keeps you signed in, a security token that protects forms against forgery, and preference cookies that remember your language and light or dark theme. We also use PostHog analytics cookies to understand how the product is used; PostHog may record how pages are used to help us fix problems, with what you type into form fields masked. You can block cookies in your browser, but the service will not function properly without the necessary ones.

15. Changes and contact

We may update this policy as the service changes. When we make a material change we will update the date at the top of this page and notify account holders by email. For any question about this policy or your data, contact contact@codit.ma.