MallBasket Privacy Policy

Effective Date: March 19, 2025
Last Updated: October 4, 2026

This Privacy Policy explains what personal information MallBasket collects, why, who it is shared with, how long it is kept, and the choices and rights you have. It applies to the MallBasket website (mallbasket.com), the store websites MallBasket hosts for the stores on it ("storefronts"), and the MallBasket apps for iOS and Android (together, the "Platform").

1. Who we are

The Platform is operated by GENERICS LAB SOFTWARE, LLC ("MallBasket", "we", "us"). We are responsible for the personal information described in this policy. You can reach us at support@genericslab.com.

The stores on MallBasket are independent businesses. When you order from a store, that store receives the details it needs to fulfil your order (section 4.1) and is responsible for how it uses them. A store may publish its own privacy policy, which you can read on its store page and at checkout.

2. Information we collect

2.1 Information you give us

Account details: your email address and password if you sign up with email, or the name, email address and photo your Google or Apple account shares if you sign in with one. Passwords are handled by our authentication provider and are never visible to us.
Profile: the name, gender, date of birth, photo and contact methods you add to your profile.
Phone number: when you verify one, which cash on delivery requires. We send the verification code by SMS or by WhatsApp, as you choose.
Guest checkout: if you buy without an account, the email address you give at checkout (section 6).
Delivery addresses: country, region, street address, city, postal code, and a delivery phone number for the courier.
Orders: what you order, the options and quantities you choose, notes you add, the amounts charged, the delivery method, and the order's status as it progresses.
Messages, reviews and reports: messages you send to stores, the reviews and ratings you post, and content you report to us.
Store owners and members: your store's details, logo, contact methods, product listings, policies, team members and business hours; bank account details for payouts; and the credentials you connect for your own Stripe, PayPal or custom payment gateway. Credentials are stored on our servers and are never shown to buyers or to other stores.
AI features: the images and text you submit when you choose to use an AI feature, such as analyzing a product photo or writing a description.
Support: what you tell us when you contact us.

You do not have to give us your personal information, but some of the Platform cannot work without it: we need an email address to send your receipts and order updates, a delivery address to ship an order, and a verified phone number for cash on delivery.

2.2 Information collected automatically

Device and usage information: your device type, operating system, app version, IP address, the screens and pages you use, and crash reports. The app uses Google Firebase Analytics for this.
Approximate country: worked out from your IP address on our own servers, using a local database, so we can preselect your country and phone dial code. We do not store it.
Notification tokens: an identifier for your device, so we can send push notifications to it.
Security signals: Google reCAPTCHA and Firebase App Check check that requests come from our genuine website and apps, which helps us stop fraud and abuse.

2.3 Information from others

Sign-in providers: Google or Apple, as described in section 2.1.
Payment providers: confirmation that a payment went through, its amount and reference, and, from Stripe or PayPal, the email address you paid with.
Dropshipping suppliers: the status and tracking of a shipment they send to you.

2.4 Payment card details

We do not receive or store your full card number. You enter it with the payment provider (section 4.3), which processes it under its own security standards. We keep a record of each payment's status, amount and provider reference.

3. How we use your information

To run the Platform: your account, baskets, checkout, orders and order history, store pages and storefronts, search, and chat between buyers and stores. We do this to provide the service you asked for.
To keep you informed about your orders: receipts and order status updates by email, push notification and in the app.
To process payments and payouts: including platform fees, refunds and disputes.
To deliver dropshipped orders: by passing the order to the supplier that ships it (section 4.2).
To verify accounts and prevent fraud: such as verifying phone numbers before cash on delivery, and detecting abuse of the Platform. We do this in our legitimate interest in keeping the Platform safe.
To provide AI features: only when you use them.
To improve the Platform: by understanding how it is used and fixing what goes wrong.
To meet our legal obligations: such as accounting and tax records, and responding to lawful requests from authorities.

Marketing. We do not currently send marketing messages. If we offer them in the future, we will send them only if you have agreed to receive them, and every message will let you unsubscribe. Receipts, order updates, security notices and notices about changes to our terms are service messages, not marketing, and are sent whether or not you agree to marketing.

4. Who we share your information with

We do not sell your personal information.

4.1 The stores you buy from

When you place an order, the store receives your name, email address, phone number, delivery address, the order's details and any notes you add, so it can fulfil and support the order. Stores you message also receive your messages.

4.2 Dropshipping suppliers

Some stores sell items that a supplier ships directly to you. If your order contains one, the supplier (currently CJ Dropshipping) receives your name, delivery address, phone number and email address to ship it.

4.3 Payment providers

Each store chooses the provider its buyers pay through: Cybersource (a Visa company) for MallBasket's own checkout, or the store's own Stripe, PayPal or custom payment gateway. The provider receives the amount, the order reference, your email address and the payment details you enter with it, and processes them under its own privacy policy. Purchases inside our apps are processed by Apple or Google.

4.4 Service providers

These companies process information on our behalf, only to provide their service to us:

Google (Firebase and Google Cloud): accounts, databases, file storage, the servers that run our services, push notifications, app analytics, reCAPTCHA and App Check, SMS verification codes, and the Gemini models behind our AI features.
Algolia: search across products, stores and orders. So that stores can search their own orders, a store's order records there include delivery addresses and order notes.
Amazon Web Services: sending our emails.
Meta (WhatsApp): verification codes, when you choose to receive yours by WhatsApp.
Vercel: hosting our website.

4.5 Other people on the Platform

Store pages and storefronts are public. Reviews you post are public and show your name, unless you choose to post anonymously.

4.6 Legal reasons and business changes

We may share information when the law requires it, to protect the rights, safety or property of our users or ourselves, or as part of a merger, acquisition or sale of our business, in which case this policy will continue to apply to it.

5. International transfers

Our service providers store and process information in several countries, including the United States and countries of the European Union, which may be outside the country you live in. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses for these transfers.

6. Guest checkout

On our website you can buy without creating an account. In that case:

We create a temporary guest account for you, kept in your browser, which holds your basket, delivery addresses and orders.
We ask only for your email address, and use it only to send your receipts and order updates.
Guests pay online. Cash on delivery needs an account.
If you later create an account in the same browser, your guest orders become part of it. If you sign in to an account you already have, we move your guest orders and addresses into that account.
If you clear your browser's data, you lose access to the guest session, though order emails still reach you. To have your guest information deleted, email us from the address you checked out with.

7. How long we keep your information

Your account: for as long as it is open. When you delete your account, it is deactivated straight away and permanently deleted after 30 days, unless you sign back in during that time. Deletion removes your sign-in account, your profile, your device tokens and your notifications. A store owner must close or hand over their store before their account can be deleted.
Orders and payment records: kept after your account is deleted, for as long as the stores and we need them for accounting, tax, refunds, disputes and legal obligations.
Reviews, messages and saved addresses: reviews you posted and messages you sent to stores may remain after your account is deleted. Ask us and we will delete them, along with your saved delivery addresses.
Guest information: kept like an account's until you ask us to delete it.
Security and technical logs: kept only for as long as they are needed to keep the Platform secure and working.

8. Your rights

Depending on where you live, you may have the right to:

see the personal information we hold about you and get a copy of it;
correct it if it is wrong;
have it deleted;
object to, or ask us to restrict, how we use it;
receive it in a portable format; and
withdraw any consent you have given, at any time.

You can edit your profile and delete your account yourself, in the app or on our website. For anything else, or as a guest, email support@genericslab.com. We may need to confirm it is you before we act, and we will answer within the time the law allows. You also have the right to complain to the data protection authority where you live, such as Israel's Privacy Protection Authority or a data protection authority in the European Union.

9. Cookies and similar technologies

Our website uses your browser's storage to keep you signed in, to keep a guest's basket, and to remember preferences such as your theme. Google reCAPTCHA, which protects our website from abuse, sets its own cookies and collects information about your device. Our apps use Google Firebase Analytics. We do not use advertising cookies. You can clear your browser's storage at any time, but you will be signed out and a guest basket will be lost.

10. Children

The Platform is not meant for children. You must be at least 18 years old, or the age of majority where you live if that is higher, to create an account, open a store or place an order. We do not knowingly collect information from children; if you believe a child has given us their information, contact us and we will delete it.

11. Security

We protect your information with measures such as encryption in transit, access controls on our databases, and keeping payment credentials on our servers only. No system is perfectly secure, so we cannot guarantee that your information will never be accessed without permission. If a breach affects your information, we will notify you and the authorities as the law requires.

12. Other websites and stores' own policies

The Platform links to websites and services we do not run, including the payment pages of providers a store uses and the links stores add to their pages. Their own privacy policies apply to them.

13. Changes to this policy

We will update this policy when how we handle your information changes, and change the "Last Updated" date above. If a change is significant, we will tell you by email or in the app before it takes effect.

14. Contact us

For questions about this policy, or to exercise your rights, contact:

GENERICS LAB SOFTWARE, LLC
📧 support@genericslab.com