Skip to content

Privacy

Privacy policy

What Via collects, why we use it, who helps us process it, how long we keep it, and what you can ask us to do with it.

Last updated: 7 October 2026.

Who we are

Via is a commerce platform for brands, operated by ODX Studio, Plus Mall, Southern Investors, New Cairo, Egypt ("Via", "we", "us"). This policy covers how Via handles personal data on this website (runonvia.com), in the Via app where merchants and their staff sign in and run their stores (including app.runonvia.com and Via Admin), and in the online stores that merchants run on Via.

For the Via website and the Via app, Via decides how personal data is used. For a store that runs on Via, the merchant decides what it collects from its own customers, and Via processes that data on the merchant's behalf.

Data we collect

  • Account and sign-in data: your name, email address, password (stored only as a secure hash by our authentication provider), sign-in codes or links we email you, and, if you choose Google Sign-In, the basic Google account information described below.
  • Team and permission data: your role in a store, the permissions an owner gives you, and an audit log of the changes each person makes (who, what and when).
  • Merchant business and operational data: store and brand details, products, prices, stock, orders, delivery details, returns, payment status and payout records, customer records, and messages handled in Via.
  • Data from tools a merchant connects: for example a Meta (Facebook and Instagram) business account, described below.
  • Enquiries: what you send through the Start with Via or Talk to Via forms or tell the Via Guide on this website.
  • Technical data: the network (IP) address and browser information our servers and providers receive with each request, and the data your browser keeps so you stay signed in.

Account and authentication data

Merchants and their staff sign in to the Via app with an email address and password, with a one-time sign-in link or code sent to their email, or with Google Sign-In. One email address is one Via account; access to each store is granted separately by that store's owner.

Sign-in is handled by our authentication provider (Supabase). Passwords are never stored in readable form. After you sign in, the app keeps a session token in your browser's local storage so you stay signed in; signing out removes it.

Google Sign-In

If you choose "Continue with Google", Google asks you to allow Via to receive basic information from your Google account. Via requests only these permissions (scopes): openid, userinfo.email and userinfo.profile. With your permission, Via may receive:

  • your name;
  • your email address, and whether Google has verified it;
  • your profile picture (avatar), as provided by Google;
  • a unique Google account identifier, used to recognise you the next time you sign in.

Via uses this information only to create your Via account or link Google Sign-In to your existing Via account with the same email address, to sign you in, to show who is signed in inside the Via app, and to provide the service.

  • Via never receives or stores your Google password. You enter it only on Google's own page.
  • Google Sign-In does not give Via access to Gmail, Google Drive, Google Calendar, your contacts or any other Google service. If Via ever offers a feature that needs such access, it will ask for it separately and only with your explicit permission.
  • Via does not sell Google user data, does not use it for advertising, and does not use it to train AI models.
  • Via's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
  • You can remove Via's access at any time in your Google Account under Security, "Third-party apps and services". This stops Google Sign-In for Via; your Via account and store data stay until you ask us to delete them.

Merchant business and operational data

To run a store, Via stores what the merchant and its team enter or what the store generates: catalog and stock, orders and their status, delivery addresses and contact details for orders, returns, payment and payout records, customer records, team members and their permissions, and settings. Each store's data is kept separate from every other store's at the database level.

Stores that run on Via

When you shop at a store that runs on Via, the merchant is responsible for your data and Via processes it on the merchant's behalf: your orders, delivery addresses, contact details, payment status and messages you exchange with the store.

  • Payments. Card numbers and security codes are entered on the payment provider's hosted page. Via never receives or stores them. Via records the payment outcome and a masked reference.
  • Marketing measurement. Where a merchant has connected Meta, Via sends conversion events to Meta only after the visitor's consent has been recorded, and records what was sent.
  • Messaging. Where a merchant has connected WhatsApp or email, Via sends order and service messages on the merchant's behalf and records delivery state and the consent the merchant holds.

For questions about a specific store's use of your data, contact that store first; the merchant decides what is collected and why.

This website (runonvia.com)

This website measures visits and the results of our ads with Google Analytics and the Meta Pixel, but only if you choose “Accept” in the cookie banner. If you choose “No thanks”, or make no choice, neither loads, and the website makes no request to any third party unless you start the Via Guide, described below. You can change your choice at any time with “Cookie settings” at the bottom of every page. The only data it collects is what you send through the Start with Via form or the Talk to Via form: what you would like (setup, demo or contact), your name, work email, company or brand, phone number, what you sell and where you sell today (chosen from lists), how many stores you run, the plan you are interested in, your consent to be contacted, and, if you write one on the Talk to Via form, a short message (up to 500 characters). We use these details only to contact you about Via. To limit abuse, our server keeps a one-way hash of the sending network address for a short time; the address itself is never stored. A request creates no account, no store and no charge. If you accepted measurement in the cookie banner, our server also tells Meta that a request was sent, so we can see which ads bring requests: your email address, phone number and name go only in hashed (one-way encoded) form, with your network address and browser type, as Meta requires. If you did not accept, nothing about your request goes to Meta.

The Via Guide (voice assistant on this website)

Where it is switched on, this website offers the Via Guide: an AI assistant you can talk to about Via. It starts only when you press Start, and it tells you it is an AI assistant before you do. Your voice, and anything you type to it, is sent to ElevenLabs, the provider that runs the voice and the language model, so it can answer you. ElevenLabs processes that conversation on our behalf. Via itself stores no recording and no transcript: it keeps the time the conversation started, how long it lasted and what it cost, to limit usage, and a one-way hash of your network address for a short time to limit abuse. Do not tell the Guide passwords, card details or other secrets.

Cookies and technical data

  • This website sets no cookies unless you accept measurement in the cookie banner. If you accept, Google Analytics and the Meta Pixel set their own cookies (such as _ga and _fbp) to count visits and to see which ads bring visitors to the website. Your choice itself is stored in your browser, not in a cookie.
  • The Via app keeps your session token in your browser's local storage, plus small preferences such as the theme and language you choose. These are needed for the app to work and are not used for advertising.
  • Stores that run on Via use strictly necessary cookies to keep a shopper's cart and checkout. A store may add its own analytics or advertising tools; its own notice describes them.
  • Server and provider logs. Like any web service, our hosting and database providers receive your network address, browser type and the pages or functions requested. We use this to run, secure and troubleshoot the service.

How we use data

  • To create and secure accounts and sign people in.
  • To provide the service: run stores, take and fulfil orders, record payments and payouts, send order and account messages, and support merchants.
  • To keep Via secure: prevent abuse and fraud, limit sign-in attempts, and keep audit logs.
  • To bill merchants for their Via plan.
  • To answer enquiries and requests.
  • To meet legal obligations.

We do not sell personal data.

Service providers

Via uses these providers to run the service. They process personal data on our instructions and only to provide their service to us:

  • Supabase: database, authentication and file storage (hosted in the European Union, Frankfurt region).
  • Hostinger: web hosting for runonvia.com and the Via app.
  • Google: Google Sign-In, when you choose it, and Google Analytics on this website, if you accept it.
  • Resend: sending email.
  • ElevenLabs: the Via Guide voice assistant on this website.
  • Payment providers such as Geidea: taking card payments on their hosted pages.
  • Meta (Facebook, Instagram, WhatsApp): where a merchant connects these tools, and the Meta Pixel on this website, if you accept it.
  • AI providers such as Anthropic: only when a merchant asks Via to read product information it chose to import, such as its own Instagram posts.
  • Delivery partners: the order details a merchant chooses to send to its courier.

Sharing and disclosure

We share personal data only: with the service providers above; with the merchant whose store you use; with a connected service when the merchant or you ask us to (for example sending an order to a courier); when the law requires it or to protect the safety and rights of people and of Via; and with a successor if Via's business is transferred, under this policy.

Data from Facebook and Instagram

When a merchant connects a Meta business account, Via receives access tokens scoped to that merchant's assets and, where the merchant enables it, business data such as ad spend, catalog and page or Instagram content the merchant owns. Tokens are stored encrypted on the server. Disconnecting Meta in the Via app deletes Via's copy of the tokens. See Data deletion for how to have the rest removed.

Security

Via protects data with: separation of every store's data at the database level, so one store can never read another's; encryption of connection tokens at rest; one-way hashes for sign-in, cart and checkout tokens and for network addresses kept to limit abuse; secrets held on the server, never in browsers; card details kept with the payment provider; encrypted connections (HTTPS); and an append-only audit log of changes. No system is perfectly secure, and we work to fix weaknesses quickly. See Security.

Where data is processed

Via is operated from Egypt. Our main database is hosted in the European Union (Frankfurt). Some service providers, including Google, process data in other countries. When data is transferred across borders we rely on our providers' contractual and technical safeguards.

Retention

  • Accounts are kept while they are active.
  • After a merchant cancels, the store's data is kept for 90 days so it can be exported, and is then deleted. We email the store owner 30 days and 7 days before it is deleted. A failed payment never causes data to be deleted.
  • Order and financial records are kept for as long as the merchant and the law require, in a form that no longer identifies people where the law allows.
  • Enquiries are kept for as long as needed to answer and follow them up.
  • Audit logs are kept for as long as the store exists, to keep a reliable record of changes.
  • Hashed network addresses kept to limit abuse are deleted after a short time.
  • Meta tokens are deleted as soon as the merchant disconnects Meta.

Your rights and deletion

You can ask us to access, correct, export or delete the personal data Via holds about you, to object to or restrict its use, and to withdraw consent you gave (for example to be contacted). If the data belongs to a store's records, we will pass the request to the merchant and help them answer it. Account owners can also ask to delete their Via account and their stores' data. To make a request, contact us as described below; Data deletion explains each case. We will confirm your identity before acting, and answer as soon as we can.

Children

Via is a service for businesses and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We will post any change to this page with a new date. If a change is significant, we will also tell account holders in the Via app or by email before it takes effect.

Contact

For privacy questions and requests, contact ODX Studio, the operator of Via: