The MK LLC (ذا ام كي) · mymayz.com · myMayz Inbox (inbox.mymayz.com)
Document ID MK-PRIV-001 · Version 2.0 · Effective date: 10 October 2026 · Replaces version 1.0 (effective 23 September 2026) · Review cycle: annual · Owner: Ahmed Samir Amin, Co-Founder & Director · Classification: Public
1. Who we are and what this policy covers
myMayz is an Egyptian lifestyle brand operated by The MK LLC (ذا ام كي), a limited liability company registered in Dokki, Giza, Egypt ("myMayz", "we", "us", "our"). We sell fashion, ceramics, kitchenware, tableware and gourmet food through our online store at mymayz.com, our store at Mall of Egypt, and our customer-service channels.
The MK LLC is the data controller for the personal data described in this policy. This means we decide why and how that data is used.
This policy covers:
- our online store at mymayz.com and our retail operations;
- our customer-service channels: WhatsApp, Instagram, Facebook Messenger, TikTok, email and telephone. This includes public comments on our own posts and ads;
- myMayz Inbox (inbox.mymayz.com), the internal tool our customer-service team uses to read and answer messages from those channels. Only our own team uses myMayz Inbox, and only myMayz's own business accounts are connected to it. We do not offer it to other businesses.
We process personal data under Egypt's Personal Data Protection Law No. 151 of 2020 ("Law 151"). When our store serves customers outside Egypt, we also follow the EU General Data Protection Regulation (GDPR) where it applies to them.
2. Summary
| Question | Short answer | Details |
|---|---|---|
| What do we collect? | Your order and delivery details, the messages and comments you send us, call recordings, and technical data from our website. | Sections 3–5 |
| Why? | To sell and deliver your orders, answer your questions and complaints, keep our pages free of spam and abuse, and meet our legal duties. We send marketing only if you agree. | Section 7 |
| How is it used? | Our customer-service team reads and answers messages in myMayz Inbox. A team member can ask an AI tool to draft a reply. On TikTok, a team member sends every reply. | Sections 4–6 |
| Where does it go? | Only to the service providers listed in Section 9. Some of them are outside Egypt. We never sell it. | Sections 9–10 |
| How is it protected? | Encrypted connections (TLS 1.2 or higher), AES-256 encryption at rest by our database provider, access only for active customer-service team members, private storage for the files you send, and checks that platform notifications are genuine. | Section 12 |
| How long do we keep it? | Conversations: 24 months after the last message. Call recordings: 12 months. TikTok data: deleted within 7 days after our TikTok connection ends. Orders and invoices: 5 years. | Section 11 |
| What are your rights? | Access, a copy, correction, deletion, restriction, objection and withdrawal of consent. Email hello@mymayz.com and we will reply within 6 working days. | Section 13 |
3. Data we collect when you shop with us
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email address, phone number, shipping and billing address | You give it at checkout, at registration or in conversation |
| Orders and transactions | Items bought, order value, delivery status, returns, exchanges and refunds, payment method type and payment confirmation | Created when you shop with us. We never store full card numbers. Licensed payment providers process card payments. |
| Technical and usage | IP address, device and browser type, pages viewed, cookie identifiers | Collected automatically when you browse mymayz.com (see Section 15) |
| Marketing preferences | Newsletter subscription status, campaign interactions | You give it; our marketing tools record it |
Sections 4 and 5 describe the messages you send to customer service.
4. Customer-service channels
4.1 How your messages reach us
When you contact one of our business accounts, the platform sends your message to us through its official business API. For WhatsApp, Instagram and Messenger this is Meta's API. For TikTok it is TikTok API for Business. Our server stores the message in myMayz Inbox so our team can read it and reply.
We receive only:
- conversations that you start with our business accounts; and
- comments posted on our own posts and ads.
Meta and TikTok also process your messages under their own privacy policies. This policy covers what we do with your data once it reaches us.
4.2 What we store for each channel
| Channel | What we store |
|---|---|
| Your phone number and WhatsApp profile name. If your profile has no name, we may use the name on your myMayz order for that number. Also your messages and attachments (photos, voice notes, files). | |
| Facebook Messenger | The ID Messenger assigns you for our Page, the name Meta returns for that ID, and your messages and attachments |
| Instagram direct messages | The ID Instagram assigns you for our account, the @username or name Meta returns for that ID, and your messages and attachments |
| Instagram and Facebook comments on our posts and ads | Comment text, your username (comments on Facebook ads reach us without a name), the post or ad you commented on, the time, and our replies and moderation actions |
| TikTok | See Section 5 |
| Your email address, name, message and attachments | |
| Telephone | Your phone number, the time, length and direction of the call, call recordings and voicemails |
On every channel we also store:
- our replies and the name of the team member who sent each one;
- internal notes our team adds;
- order numbers linked to the conversation;
- the conversation's status;
- any rating you give our service.
4.3 How we use customer-service data
We use it to:
- answer your questions and complaints on the channel you used;
- handle orders, deliveries, returns, exchanges and refunds. To answer a question about an order, we look it up in our store system (Shopify) and our returns system;
- moderate comments on our own posts and ads. This means replying, or hiding or deleting spam, abuse and personal details posted in public;
- block contacts who send abuse or spam. We still store messages from a blocked contact, but our team gets no alert and no automatic reply is sent;
- check how well we serve you, for example response times and the ratings customers give us.
4.4 Phone calls
We record calls to and from our customer-service line. At the start of every call, before the conversation begins, a short message in Arabic and English tells you that the call may be recorded. Recordings are kept by our telephone provider (Twilio) and can be played only by our customer-service managers (administrators) through our own server. We use recordings to resolve disputes and to check the quality of our service. If you do not want to be recorded, contact us on WhatsApp or by email instead.
5. TikTok
5.1 Our TikTok connection
We connect only myMayz's own TikTok Business Account to myMayz Inbox, through TikTok API for Business. By authorizing this connection, we allow myMayz Inbox to:
- read and manage the messages in our TikTok inbox;
- send messages on our behalf;
- read our account type.
Only our administrators can connect or disconnect TikTok, from the settings of myMayz Inbox. We can also end the authorization at any time from the TikTok app. We do not connect any other business's TikTok account, and myMayz Inbox refuses data from any TikTok account other than ours.
TikTok direct messages reach myMayz Inbox only while the connection is active. Messages sent through TikTok Shop are not part of this integration.
5.2 TikTok direct messages: what we receive and keep
When you send a direct message to our TikTok account, TikTok sends us a notification about it. We keep only the fields listed below and discard the rest of the notification.
| Data | What it is | Why we keep it |
|---|---|---|
| Your TikTok user ID | The identifier TikTok gives us for your account | To keep your messages together in one conversation |
| Your TikTok username | Shown as @username | So our team knows who they are talking to |
| Conversation ID and message ID | TikTok's identifiers for the conversation and for each message | TikTok needs the conversation ID before we can reply. Message IDs stop us storing the same message twice. |
| Message text | What you write to us | To answer you |
| Photos and videos you send | A copy we download through TikTok's API and store in our file storage | So our team can see what you sent, for example a damaged item |
| Posts you share | The link to the TikTok post | So our team can open the post you mean |
| Stickers, emoji and reactions | A short label such as "(sticker)", or the reaction emoji. We do not store sticker or emoji images. | So the conversation makes sense |
| Card messages | The card's title | So the conversation makes sense |
| Where the conversation started | The name or ID of the TikTok ad, or the TikTok.me link reference, that led you to message us | To answer in the context of the ad or link you saw |
| Time | When we received each message | To keep the conversation history |
| Our replies | The text and images our team sends you, and which team member sent them | To keep a record of the service we gave you |
From TikTok we do not collect your phone number, email address, profile picture, followers, follow status, location or read receipts, and we do not look up your TikTok profile. We do not store voice notes from TikTok.
If you are in the European Economic Area, Switzerland or the United Kingdom, TikTok does not send us the content of your messages through this integration. We store nothing about these messages.
5.3 Comments on our TikTok videos and ads
We have asked TikTok for access to manage comments on our own TikTok videos and ads. This section applies only after TikTok approves that access and we turn the feature on. Until then, myMayz Inbox does not receive TikTok comments.
Once the feature is on, we will receive and keep the comment text, the commenter's username and TikTok user ID, the video or ad commented on, and the time. We will also keep our replies and moderation actions. We will use comments only to answer questions and to hide or remove spam, abuse or personal details posted in public. All moderation will go through TikTok's official API.
5.4 How we use TikTok data and what we never do with it
We use TikTok data only to answer the messages and comments you send to our TikTok account, and to handle any orders, returns and complaints they relate to.
We never:
- sell TikTok data, or give it to anyone except the service providers in Section 9 that store and process it for us;
- use TikTok data for advertising, retargeting, ad audiences or profiling;
- combine TikTok data with other data to build a profile of you (we look up an order only to answer your question about it);
- message a TikTok user who has not messaged us first;
- send an automated or AI-written reply on TikTok without review (a team member sends every TikTok reply);
- use TikTok messages to train AI models, or save them as examples for AI-drafted replies to other customers;
- download TikTok posts (videos or images published on TikTok), or move TikTok content to other accounts or platforms;
- send TikTok any sensitive data, such as health or financial data or data about children.
5.5 Where TikTok data goes
- Our hosting providers Supabase, Railway and Vercel store and run myMayz Inbox (Section 9).
- Anthropic receives the conversation only when a team member asks for an AI draft in a TikTok conversation (Section 6).
- Team members' browsers receive an alert with your @username and the first 120 characters of your message. The alert is encrypted between our server and the browser. The browser maker's push service delivers it but cannot read it.
- TikTok receives our replies, including any images we send you, so it can deliver them.
5.6 How long we keep TikTok data
- Conversations, messages, photos and videos: 24 months after the last message in the conversation, then deleted.
- When our TikTok authorization ends: this happens if we disconnect it, revoke it in the TikTok app, or let it expire without renewal, or if TikTok ends our access. We then delete our TikTok access tokens immediately. Within 7 days we delete all TikTok conversations, messages, photos and videos, and every copy of them, including copies in team alerts. If we reconnect the same account within those 7 days, the deletion is cancelled. We detect an authorization that has ended when TikTok refuses to renew our access, and through a daily check.
- If TikTok ends our access to its API: we stop using TikTok data immediately and delete it as TikTok's terms require.
If you buy from us, the order and invoice records are kept in our store systems for the periods in Section 11, even after the TikTok conversation is deleted.
6. AI-assisted replies
We use Claude, an AI model from Anthropic, to help our team write replies.
When we use it
- Drafts, any channel (including TikTok): a team member can click "AI draft" or "Polish". The AI suggests a reply, and nothing is sent until the team member has reviewed, edited and sent it.
- Automatic replies, WhatsApp only: when we switch this feature on, the AI can reply to you automatically. Our team monitors these conversations, and you can ask to speak with a person at any time.
- Fixed out-of-hours messages: on some other channels, a fixed message that is not written by AI may be sent automatically outside our working hours. This never happens on TikTok.
What we send to Anthropic
- up to the last 40 messages of the conversation;
- up to 3 recent photos you sent;
- the details of an order or return, when an order number appears in the conversation;
- for "Polish", the team member's draft.
If you sent voice notes, OpenAI's Whisper service first turns up to 3 recent ones into text so the AI can read them.
Examples of good answers
When a WhatsApp, Instagram, Messenger or email conversation is closed as resolved, we may save the customer's last message and our reply as an example of a good answer. The AI sees up to 3 of these examples when it drafts other replies. We never save TikTok conversations as examples, and examples are never used in TikTok conversations. Examples are deleted within 24 months.
What the AI does not do
The AI only writes text. It does not issue refunds, cancel orders or change your data.
Training
We do not use your data to train AI models. Anthropic states that, by default, it does not use inputs or outputs from its commercial products to train its models.
7. Why we use your data and our legal grounds
Law 151 (Article 6) allows processing in four cases:
- you have given explicit consent;
- it is needed for a contract with you;
- the law requires it;
- it is needed for our legitimate rights and does not conflict with your fundamental rights and freedoms.
| Purpose | Legal ground |
|---|---|
| Processing, delivering, returning and exchanging your orders, and taking payment | Contract |
| Answering messages, calls and emails on the channel you chose, including TikTok direct messages | Contract, when it concerns an order or a purchase you are considering. Otherwise, our legitimate interest in answering people who contact us. |
| Order notifications, for example order confirmation and delivery updates on WhatsApp | Contract |
| Moderating comments on our own posts and ads, including on TikTok | Our legitimate interest in keeping our pages free of spam and abuse |
| AI-drafted replies that our team reviews | Our legitimate interest in answering quickly and accurately |
| Recording customer-service calls | Our legitimate interest in resolving disputes and checking service quality. You are told at the start of the call and can use another channel instead. |
| Marketing newsletters and offers | Your consent (Law 151, Article 17). You can withdraw it at any time. |
| Preventing fraud and abuse, and keeping our systems secure | Legitimate interest; legal obligation |
| Legal, tax and accounting records | Legal obligation |
| Aggregated, de-identified statistics about sales and support | Legitimate interest |
We collect only what each purpose needs, and we do not sell personal data.
8. Who can see your data
Inside myMayz
- Only active customer-service team members can see conversations in myMayz Inbox. They can see all conversations, on every channel, because any of them may answer you. These team members are employees of The MK LLC. Accounts that are not on the customer-service team, and team members whose access has been removed, see nothing. Our database enforces this on every table that holds customer data.
- Only administrators can manage team members, change roles and reset sign-in PINs.
- Staff who handle orders, deliveries and returns see the order data they need for that work.
- We log which team member opened each conversation, and when.
- We remove a team member's access when they leave, and the alerts on their devices stop immediately.
Outside myMayz
- The service providers in Section 9, which process data on our instructions.
- Meta and TikTok, which deliver messages between you and us.
- Couriers and payment providers, to complete your orders.
- Public authorities, when Egyptian law, a court order or a competent authority requires it, and where needed to prevent fraud.
- Our affiliates, for store and order data only, under the same protections as this policy. We never share TikTok data with affiliates.
9. Service providers
9.1 Providers that handle customer-service data, including TikTok data
| Provider | What it does for us | Data it handles | Where it processes the data |
|---|---|---|---|
| Supabase | Database, team sign-in and file storage for myMayz Inbox | All customer-service data, including TikTok data | France (Paris, eu-west-3) |
| Railway | Runs the myMayz Inbox server | All customer-service data while it is being processed; server logs, which contain no message text | United States (California, us-west2) |
| Vercel | Hosts the myMayz Inbox web app at inbox.mymayz.com | The pages our team views, and requests from our team's browsers to our server | United States (Washington, D.C., iad1); static files through Vercel's global network |
| Anthropic | Drafts AI-assisted replies (Section 6) | Conversation excerpts, photos and order details, including from TikTok conversations when a team member asks for a draft | United States |
| OpenAI | Turns voice notes into text for AI drafts | Voice notes (no TikTok data) | United States |
| Twilio | Phone calls, call recording and voicemail | Phone number, call audio, call recordings, call details | United States |
| 99cloudtech | Telephone line provider | Phone number, call details | Egypt |
| Google (Gmail / Google Workspace) | Our email | Emails you send us | Google's global data centres |
| Resend | Receives some emails sent to us and passes them to myMayz Inbox | Emails you send us | United States |
| Shopify | Order look-ups from myMayz Inbox | Order details | See 9.2 |
| Browser push services (the maker of each team member's browser) | Deliver encrypted alerts to team members' browsers | An encrypted alert they cannot read | n/a |
Meta (WhatsApp, Instagram, Messenger) and TikTok deliver messages between you and us under their own terms and privacy policies.
9.2 Providers for our store
| Provider | What it does for us |
|---|---|
| Shopify | Online store, checkout and customer accounts |
| Odoo | Orders, inventory and invoicing |
| Cloudflare | Website delivery |
| PayTabs, Paymob and acquiring banks | Payments. They handle card data; we do not store it. |
| Couriers | Delivery. They receive your name, address, phone number and shipment details. |
| Analytics and Ads, through Google Tag Manager | |
| Meta | Meta Pixel and Meta Conversions API |
| Judge.me | Product reviews |
| Langify | Website translation |
| GeoJS | Detects your country from your IP address so the site shows the right prices and formats |
10. International transfers
Several providers in Section 9 store or process data outside Egypt. Law 151 (Articles 14–16) allows this only in two situations:
- the destination protects personal data at least as well as Egyptian law, and the Personal Data Protection Center has granted a licence or permit; or
- one of the cases in Article 15 applies, with your explicit consent (for example, to perform a contract in your favour).
We transfer data abroad only to providers bound by data-processing terms, and the data is encrypted in transit and at rest. Where Law 151 requires a licence or permit from the Center, we obtain it. Section 9 shows where each provider processes customer-service data.
11. How long we keep data
Law 151 (Articles 3 and 4) does not allow us to keep personal data longer than its purpose needs.
| Data | How long we keep it | Why |
|---|---|---|
| Store account data | For the life of your account on mymayz.com | Serving returning customers |
| Customer-service contact records (name, phone, email, notes) | Deleted once none of your conversations, recent calls, returns or orders remain, which is after the 24-month conversation period at the latest | Answering you on every channel |
| Orders, invoices and transaction records | 5 years from the end of the financial year | Egyptian tax and accounting law |
| Customer-service conversations on all channels, with their photos, voice notes, internal notes and copies in team alerts | 24 months from the last message, then deleted | Handling complaints and checking service quality |
| Saved examples of good answers (Section 6) | Deleted with the conversation, and within 24 months at most | AI-drafted replies |
| Call recordings and voicemails | 12 months from the call, then deleted from our systems and from our telephone provider. We keep the call record (time, number, length). | Resolving disputes and checking service quality |
| TikTok data after our TikTok authorization ends | Access tokens deleted immediately; all other TikTok data deleted within 7 days | TikTok requirements; keeping no more data than we need |
| Server logs | Up to 12 months | Security monitoring |
| Marketing lists | Until you unsubscribe, or after 24 months of inactivity | Consent-based marketing |
| Backups | Our database provider's daily backups expire after 7 days. Deleted data disappears from backups when they expire. | Recovering from failures |
Deletion runs automatically every day. When you ask us to delete your data, we do so within the time in Section 13. We keep only the records the law requires.
12. How we protect your data
These measures are in place today:
- Encrypted connections. myMayz Inbox, its server and its database accept only TLS 1.2 or TLS 1.3 and refuse older versions. inbox.mymayz.com tells browsers to use HTTPS only (HSTS). Our server connects to TikTok's API only over HTTPS.
- Encryption at rest. Supabase, our database and file-storage provider, encrypts stored data with AES-256.
- Checking notifications are genuine. We accept a TikTok notification only if it has a valid signature made with our TikTok app secret (HMAC-SHA256) and is less than 5 minutes old. We also check the signature on notifications from Meta.
- Access only for the customer-service team. Only active customer-service team members can use myMayz Inbox. Every request to our server, and every database table that holds customer data, checks this. Tables that hold access tokens and settings can be read only by our server.
- Platform access tokens. Our TikTok access tokens are stored in a table that only our server can read. They are never shown in myMayz Inbox.
- Files you send us. Photos, videos, voice notes and documents you send are stored in private storage. Our team opens them only through links that expire after 10 minutes.
- Call recordings. Kept by our telephone provider and played only through our own server, which checks that the person is on our customer-service team.
- Logs. Our server logs do not record message text, commenters' names, request bodies or sign-in credentials.
- Access history. We log which team member opened each conversation, and when.
- Leavers. We remove a team member's access when they leave, and their device alerts stop immediately.
- Administration. Only administrators can add team members, change roles or reset sign-in PINs, and our server enforces this.
- Providers. Our service providers are bound by data-processing terms.
If a breach happens
- We notify the Personal Data Protection Center within 72 hours of becoming aware of it.
- We notify the people affected within 3 working days of that notification (Law 151, Article 7).
- If TikTok data is affected, we notify TikTok without delay.
13. Your rights
Under Law 151 (Article 2) you have the right to:
- know what personal data we hold about you, access it and get a copy. We provide copies in a common electronic format such as CSV or JSON;
- withdraw consent you have given us;
- have your data corrected, completed, updated or deleted;
- limit our processing to a specific scope;
- be told about any breach of your personal data;
- object to processing, or to its results, where it conflicts with your fundamental rights and freedoms.
You can also object to direct marketing at any time.
How to make a request
- Email hello@mymayz.com, or message us on WhatsApp at +20 10 2241 5151.
- Tell us which channel you used to contact us. For TikTok, include your @username.
- We will check that the request comes from you, for example by asking you to confirm it from the same WhatsApp number, email address or TikTok account.
We reply within 6 working days (Law 151, Article 32). We do not charge for requests.
Deleting a message or your account on TikTok, Instagram, Facebook or WhatsApp does not delete our copy in myMayz Inbox. To have our copy deleted, ask us.
Complaints
You can complain to Egypt's Personal Data Protection Center (Law 151, Article 33). If GDPR applies to you, you also have the right to data portability, and you can complain to your local supervisory authority.
14. Marketing messages
We send marketing only if you have agreed to receive it (Law 151, Article 17). Every marketing message explains how to unsubscribe, and we keep a record of your consent (Article 18). We do not send marketing through TikTok direct messages.
15. Cookies and similar technologies
mymayz.com uses cookies and similar technologies to:
- keep your cart working;
- remember your preferences;
- measure how the site performs;
- support our advertising, with your consent where it is required.
The website loads the following tools:
- Shopify: cart, checkout and store analytics;
- Google: Google Tag Manager, Google Analytics and Google Ads;
- Meta: Meta Pixel and Meta Conversions API. Store events, which can include contact details you give at checkout, are sent to Meta to measure our ads;
- Judge.me: product reviews;
- Langify: translation;
- GeoJS: uses your IP address to detect your country so the site shows the right prices and formats.
You can control cookies through your browser settings. The store cannot work without its essential cookies.
We never send data from customer-service messages, including TikTok messages, to these advertising tools.
16. Children
Our products and services are for adults. We do not knowingly collect personal data from anyone under 18. Law 151 (Article 1) treats children's data as sensitive data. If you are under 18, please ask a parent or guardian to contact us for you. If we learn that we hold personal data about someone under 18, we delete it.
17. Changes to this policy
We review this policy at least once a year, and whenever our data practices change. The current version and its effective date are always at mymayz.com/pages/privacy-policy. We announce material changes on our website or through our channels. Earlier versions are available on request.
18. Contact and data controller
- Data controller: The MK LLC (ذا ام كي), a limited liability company, Dokki, Giza, Egypt. Commercial Registration No. 14396 (6th of October Investment Commercial Registry Office).
- Data Protection Officer: Ahmed Samir Amin, The MK LLC. Email ahmed@mymayz.com
- Privacy requests and questions: hello@mymayz.com
- Customer support: hello@mymayz.com, or WhatsApp +20 10 2241 5151
An Arabic version of this policy is published at mymayz.com/ar/pages/privacy-policy. If the two versions differ, the Arabic version prevails.