Last updated: July 27, 2026
Privacy Policy
1. Introduction
MAWG3 Inc. ("MAWG3", "we", "us" or "our") operates the MAWG3 commerce platform. This Privacy Policy explains how we handle personal information across that platform: the mawg3.com website, the merchant admin panel, storefronts published by merchants on MAWG3, and our mobile applications for iOS and Android. It applies to merchants and their team members who hold a MAWG3 account, to shoppers who buy from a MAWG3 storefront, and to visitors who browse one. Read it alongside our Terms of Service. If you do not agree with it, please do not use the platform.
2. Our Role: Controller and Processor
MAWG3 acts in two different capacities, and your rights depend on which one applies. For account holders (merchants and their team members), we are the controller: we decide why and how your account data is processed, and you can bring any request in this policy directly to us. For shoppers and storefront visitors, we are a processor acting for the merchant whose store you are using. The merchant decides what to collect and why; we store and process it on their instructions under our Terms of Service. If you shopped on a MAWG3 storefront and want your data corrected or deleted, contact that merchant first. You may also contact us and we will pass the request to the merchant and assist them in acting on it.
3. Information We Collect From Account Holders
Account and identity: your name, email address, phone number, password (stored only as a salted hash, never in readable form), and the business details you enter such as trade name, business type and store address. Authentication: two-factor settings, and if you enable them, passkey credentials (a public key and device label; the private key never leaves your device). Security records: we log sign-in attempts with the email used, IP address, browser user agent and whether the attempt succeeded, so we can detect credential stuffing and account takeover. Billing: your subscription plan and payment status. Payment card details are entered directly with our payment provider and are never stored on our servers. Support and diagnostics: messages you send us, and automatic error reports containing the page or screen involved, a technical description of the fault and your IP address. Store configuration: the API keys you enter for third-party services you connect, which are held encrypted and shown masked once saved.
4. Information We Process On Behalf of Merchants
When a merchant runs a store on MAWG3, we store the records that store generates. This includes shopper names, email addresses and phone numbers; delivery and billing addresses, including structured Kuwait addresses (governorate, area, block, street, building) and, where the shopper provides them, map coordinates; order contents, totals, payment status and payment method; returns and refunds; loyalty account balances and points history; newsletter subscriptions and contact form submissions; WhatsApp subscriber lists and message history where the merchant has connected WhatsApp; and staff notes attached to a customer record. We do not use this data for our own purposes. We do not sell it, and we do not use it to advertise to shoppers.
5. Storefront Visitors and Analytics
When someone browses a MAWG3 storefront, we record a short-lived visitor entry so the merchant can see live activity: an anonymous visitor identifier, the page being viewed, approximate country and city, approximate coordinates for that city (not device GPS), and the browser user agent. These entries are held in memory only and are discarded two minutes after the visitor stops browsing. To resolve approximate location we send the visitor IP address to ipapi.co, a third-party lookup service. If a merchant has enabled live chat, the messages exchanged in that chat are stored along with the session. Merchants may also enable third-party analytics and advertising tags on their storefront, described in the cookies section below. Those tags are chosen and controlled by the merchant, not by us.
6. Mobile Applications
Our merchant apps for iOS and Android collect the same account and store data described above, plus the following. Push notifications: if you allow them, we store a device token so we can send order alerts, and you can revoke this at any time in your device settings. Camera: used only to scan product barcodes into the search field. Scanning happens on your device and no image is uploaded or retained. Face ID, Touch ID and device biometrics: used only to unlock the app locally. Biometric data is handled entirely by your device operating system and is never transmitted to us or stored on our servers. Offline cache: the app stores a copy of your store data on the device so it can open without a connection. Signing out clears it. Credentials: session tokens are held in the device secure keychain. The apps contain no third-party advertising or tracking software development kits, and we do not track you across other companies' apps or websites.
7. How We Use Information and Our Legal Bases
To perform our contract with you: creating and running your account, hosting your store, processing subscription billing, delivering orders and providing support. For our legitimate interest in operating a safe and reliable service: preventing fraud and abuse, investigating security incidents, monitoring performance, diagnosing faults and improving features. With your consent: optional analytics and advertising tags, marketing emails, push notifications and access to your camera. You can withdraw consent at any time without affecting anything done before you withdrew it. To comply with law: keeping accounting and tax records, and responding to lawful requests from Kuwaiti authorities that are valid, specific and proportionate. We do not make decisions producing legal effects about you by automated means alone.
8. Artificial Intelligence Features
Barq AI, our in-product assistant, answers questions about your store and can prepare changes for you to confirm. To do this, your question and relevant context from your store (which may include product names, order numbers, revenue figures and customer names) are sent to Anthropic, our AI provider, and processed on their infrastructure outside Kuwait. Some image generation features use Google. Your prompts and store context are sent to these providers only to produce the response you asked for. Barq AI never applies a change on its own: every action it proposes is shown to you on a confirmation card and applies only when you confirm it. If you would prefer no store data to reach an AI provider, do not use Barq AI features. We do not use your store data to train our own models.
9. Service Providers and International Transfers
We do not sell personal information. We share it only with providers who need it to deliver a part of the service you or your merchant has chosen, and only for that purpose. Hosting and infrastructure providers store platform data. Payment processing is handled by providers licensed by the Central Bank of Kuwait, including Tap Payments, MyFatoorah, UPayments and Bookeey. Delivery and shipping partners, including Jaak, Armada, DoDelivery, DHL and Aramex, receive the recipient name, phone number and delivery address needed to complete a dispatch. Anthropic and Google provide the AI features described above. Apple and Google deliver push notifications. ipapi.co resolves approximate visitor locations. Where a merchant connects them, Meta, TikTok, Snap, Google, Mailchimp, Xero, Prodigi and Acuity receive data according to that merchant's configuration. We may also disclose information where Kuwaiti law, a court order or a competent authority requires it, or to establish or defend legal claims. Several of these providers operate outside Kuwait, so your information may be processed abroad. Where it is, we rely on contractual confidentiality and security commitments with each provider, and we transfer only what that provider needs. A current list of our service providers is available from [email protected] on request.
10. Cookies and Similar Technologies
On mawg3.com and the admin panel we use a small number of strictly necessary cookies to keep you signed in, remember your session and protect against cross-site request forgery. These cannot be switched off without breaking sign-in. We also store your language and display preferences locally in your browser. On storefronts, merchants may choose to enable third-party analytics and advertising tags such as Google Analytics, Google Tag Manager, Google Ads, the Meta pixel, the TikTok pixel, the Snapchat pixel or a live chat widget. Where these are enabled, the merchant is responsible for obtaining any consent required and for displaying a cookie notice. You can clear or block cookies in your browser settings, and blocking strictly necessary cookies will prevent sign-in from working.
11. Data Retention
Live storefront visitor entries are discarded two minutes after activity stops. Sign-in attempt records and technical error reports are kept for up to twelve months for security investigation. Account data and store content are kept for as long as the account is open. When an account is deleted, we begin removing account data and store content within thirty days, except where we must keep records for longer. Order, invoice and payment records are kept for ten years from the end of the financial year to which they relate, in line with the record-keeping obligations of the Kuwaiti Commercial Code and tax rules. Backups are overwritten on a rolling cycle, so a deleted record may persist in backup for a short period after deletion from the live system. Merchants control the retention of their own shoppers' records and can delete them at any time.
12. How We Protect Information
All traffic to the platform is encrypted in transit. Passwords are stored only as salted hashes. Third-party API keys you enter are encrypted at rest and displayed masked once saved. Access to production systems is restricted to staff who need it. We log sign-in attempts and rate-limit authentication to slow brute-force attacks, and we support two-factor authentication and passkeys, which we recommend enabling. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information and is likely to put you at risk, we will notify you and the competent authority without undue delay, and we will tell you what happened, what data was involved and what you should do.
13. Your Rights
You may ask us to give you a copy of the personal data we hold about you, correct anything inaccurate, delete your data, restrict or object to how we use it, provide your data in a portable machine-readable format, or withdraw a consent you previously gave. Merchants can export store data and delete their account from within the platform. To make any other request, email [email protected]. We will verify your identity before acting, and we will respond within thirty days. If we cannot do what you asked, we will explain why. Requests about shopper data held for a merchant are handled as described in section 2. If you believe we have handled your data improperly, you may complain to the Communication and Information Technology Regulatory Authority (CITRA) in Kuwait, or to your local data protection authority if you are outside Kuwait.
14. Children's Privacy
MAWG3 accounts are for business use and are not available to anyone under 18. We do not knowingly create an account for a person under 18, and we will close any account we discover belongs to one. Storefronts on MAWG3 are operated by independent merchants who set their own age requirements for their products. We do not knowingly collect personal information from children through our own services. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.
15. Where Your Data Is Processed
MAWG3 is operated from the State of Kuwait. Some of the providers listed in section 9 process data on servers outside Kuwait, including in the European Union and the United States. When information leaves Kuwait we transfer only what the provider needs to perform its function, and we require each provider to maintain confidentiality and security protections by contract. If you are in a jurisdiction with additional transfer requirements, contact [email protected] and we will tell you what applies to your data.
16. Changes to This Policy
We may update this policy as the platform changes or the law requires. The date at the top of this page shows when it was last revised. If a change materially affects your rights or how we use your information, we will tell you by email or by a notice in the platform at least thirty days before it takes effect. Continuing to use MAWG3 after a change takes effect means you accept the updated policy.
17. Contact Us
For any privacy question, or to exercise a right described in section 13, email [email protected]. You can also write to us at MAWG3 Inc., Kuwait City, State of Kuwait. This policy is governed by the laws of the State of Kuwait, and the courts of Kuwait have jurisdiction over any dispute arising from it.