Legal & Compliance

Privacy Policy

Last updated: November 9, 2026 • Effective immediately

1. Introduction

Arravel Inc. ("Arravel", "we", "our", or "us") provides smart cloud point-of-sale (POS), retail management software, inventory tracking, online storefront builder, and advertising analytics integrations under the Arravel Business platform.

This Privacy Policy governs how we collect, store, process, and safeguard information when you use our mobile application (Arravel Business on Android/iOS), merchant web portal (app.arravel.com), and associated cloud services.

2. Information We Collect

Account & Profile Information: Merchant name, email address, phone number, physical store locations, business category, and login credentials.
Store & Point-of-Sale Data: Products, variants, barcodes, pricing, stock levels, orders, sales transactions, payment methods, customer billing addresses, and invoices.
Courier & Fulfillment Data: Consignee phone numbers, delivery addresses, courier tracking IDs, and delivery status updates from logistics partners (e.g. Steadfast, Pathao, RedX).
Device & Technical Diagnostics: IP address, device model, operating system version, crash reports, and performance telemetry to guarantee 99.9% uptime.

3. Meta Platform Integrations & Conversions API

When merchants optionally link their Facebook Page, Meta Ad Account, or Meta Pixel through Arravel Business, we interact with Meta Graph API in strict accordance with Meta Platform Terms and Developer Policies:

Cryptographic Storage: All OAuth access tokens exchanged with Meta are encrypted at rest using military-grade AES-256-GCM encryption with unique initialization vectors. Tokens are never exposed in logs or client-facing responses.
Requested Permissions: We only request permissions necessary to manage your business presence: pages_show_list, pages_read_engagement, ads_management, ads_read, catalog_management
Server-Side Conversions API (CAPI): In order to measure ad performance, Arravel dispatches purchase and order events to Meta CAPI. Any personally identifiable information (such as customer email or phone) is one-way SHA-256 hashed on the server prior to transmission, in compliance with Meta's privacy protocols.
Zero Cross-Tenant Leakage: Meta connections, Pixels, and catalog feeds are strictly isolated per merchant using PostgreSQL multi-tenant business_id scoping.

4. How We Use Your Data

We use collected data solely to deliver and optimize retail operations:

Operating offline-first POS terminals, barcode lookups, and receipt printing.
Synchronizing inventory across physical retail counters and online storefronts.
Calculating Realized Return on Ad Spend (ROAS) and True Net Profit by reconciling Meta ad spend against delivered sales and courier fees.
Automating courier parcel booking and real-time shipment status tracking.

5. Data Security & Storage

Arravel implements enterprise defense-in-depth security standards:

All network communications are encrypted via TLS 1.3 / HTTPS.
Database connections enforce SSL transport and parameterized SQL queries to prevent injection vulnerabilities.
Automated daily encrypted backups with point-in-time recovery.

6. Your Rights & Data Deletion

Every merchant has the right to access, rectify, export, or permanently delete their personal and business data at any time.

To disconnect your Facebook account or request permanent deletion of all associated data, please visit our dedicated instructions page:

View User Data Deletion Instructions $\rightarrow$

7. Contact Information

If you have questions regarding this Privacy Policy or our data protection practices, please contact our Privacy Officer:

Arravel Inc. (Data Privacy Team)

Email: privacy@arravel.com or dev.mostafiz@gmail.com

Website: https://arravel.com

Address: Dhaka, Bangladesh