Privacy Policy

Privacy Policy and Data Protection

Last Updated: September 11, 2026

Legal Operating Entity: At Dot Click Company for Data Processing and Web Hosting Services - Country: State of Kuwait - Commercial Registration No.: 553329

1. Who We Are

at.click, referred to in this Privacy Policy as “we,” “us,” or “the Platform,” is an online platform that enables merchants to create and manage online stores, products, services, appointments, bookings, orders, payments, and delivery operations.

This Privacy Policy explains what personal data we collect, why we collect it, how we use, store, and protect it, and the choices available to you, including the data processed when a merchant connects a Gmail account or payment services through application programming interfaces (APIs).

2. Scope of This Policy

This Privacy Policy applies to:

• Store owners, employees, and administrative users.
• Customers who place orders or make bookings through stores using at.click.
• Visitors to our website and Platform.
• Users who connect Gmail or payment services to at.click.

3. Information We Collect

3.1 Account Information

We may collect your name, email address, phone number, login information, and password.

Passwords are stored in hashed and encrypted form and are never stored as plain text.

3.2 Merchant and Store Information

We may collect the store name, products and services, prices, images, branches, working hours, delivery areas, store policies, and employee information.

We may also collect verification information or documents voluntarily submitted by a merchant to verify the merchant’s business.

3.3 Store Customer Information

When a customer places an order, makes a booking, or purchases a product or service from a store using at.click, we may process:

• Name.
• Phone number.
• Email address.
• Delivery address.
• Requested products or services.
• Booking or appointment details.
• Notes or instructions submitted by the customer.

This information is generally processed on behalf of the merchant to operate the merchant’s store, fulfil orders and bookings, and provide customer support.

The merchant is responsible for informing its customers about how their data is collected and used and for obtaining any required consent.

3.4 Technical and Usage Information

We may collect IP address, browser and device type, operating system, login records, pages used, dates and times of activity, security logs, and error information.

This information is used to operate the Platform, improve performance, protect accounts, and prevent fraud and misuse.

3.5 Payment and Transaction Information

We may receive the following information from a payment provider:

• Order number or reference.
• Amount and currency.
• Payment provider transaction ID.
• Payment status.
• Refund or dispute status.
• Information required to update the order status.

at.click does not store full payment card numbers, CVV codes, or card PINs.

3.6 Support and Communication Information

We may retain information you provide when contacting technical support, submitting a complaint, requesting assistance, or providing feedback.

4. How We Use Information

We use information to:

• Operate the Platform and manage user and merchant accounts.
• Create and manage stores, products, and services.
• Process orders, bookings, and appointments.
• Facilitate payment and delivery operations.
• Send transactional messages relating to orders and bookings.
• Provide technical support and customer service.
• Protect the Platform and prevent fraud or misuse.
• Improve and develop at.click services and features.
• Comply with applicable laws and lawful official requests.

We do not sell or rent personal data, and we do not use Google user data for advertising or marketing purposes.

5. Connecting Gmail Through the Gmail API

at.click provides an optional feature that allows a merchant to connect a Gmail account so that order and transactional emails can be sent from the merchant’s own email address.

This feature is entirely optional. A Gmail account is only connected after the merchant selects “Connect Gmail” and provides consent through Google’s official authorization screen.

Requested Scopes

at.click requests only the following two scopes:

Information We Do Not Access

at.click does not read the Gmail mailbox or access:

• Incoming emails.
• Contacts.
• Calendar.
• Google Drive.
• Photos or files.
• Gmail settings.
• Labels or filters.
• Any information other than what is expressly described in this Privacy Policy.

We do not request scopes such as:

• gmail.readonly
• gmail.modify
• gmail.compose
• https://mail.google.com/

Use of Google User Data

Google user data is used only to provide the transactional email feature enabled by the merchant, including:

• Order confirmations.
• Order status updates.
• Invoices and receipts.
• Booking and appointment notifications.
• Operational messages required to operate the store.

The message content is generated from order or booking data available within at.click and is sent through the Gmail API.

We do not use Google user data for:

• Advertising.
• Retargeting.
• Direct marketing.
• Marketing profiling.
• Creditworthiness assessment.
• Lending.
• Selling or renting data.
• Providing data to data brokers or advertising networks.

We do not permit employees or contractors to read Gmail data or email content, except where the user has expressly agreed to the review of specific data, or where access is necessary for security, fraud prevention, or compliance with a lawful request.

at.click uses Google user data in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Gmail Data Storage and Security

Access and refresh tokens issued by Google are encrypted at rest using AES-256-GCM.

We do not:

• Store tokens in plain text.
• Write tokens to system logs.
• Display tokens to at.click employees.
• Use tokens for any purpose other than operating the transactional email feature.

We may retain the connected email address and limited technical records, such as delivery status, delivery time, and message ID, for operational, security, and support purposes.

We do not store the Gmail mailbox or incoming email content.

Disconnecting Gmail and Deleting Data

A merchant may disconnect Gmail at any time through the dashboard:

Settings → Email → Disconnect Gmail

When Gmail is disconnected:

• at.click stops using the Gmail account.
• Stored access and refresh tokens are deleted from active systems.
• No new emails are sent from the connected account.
• The merchant may also revoke access directly through the Google Account settings.

If an at.click account is deleted, Gmail connection data is deleted in accordance with our data retention and deletion procedures. Limited technical records may be retained where necessary for security or legal obligations.

If the way we use Google data changes or new scopes are added, we will update this Privacy Policy and obtain the required user consent before using the data for the new purpose.

6. Payment Services Connected Through APIs

at.click may allow merchants to connect their stores to payment providers through APIs.

Data Used for Payment Integration

at.click may send the payment provider information necessary to create a payment transaction, including:

• Order number or reference.
• Amount and currency.
• Store name and merchant account information.
• Customer name, phone number, and email address where required.
• Billing or delivery information where required to complete the transaction.

at.click may receive the transaction status, transaction ID, payment result, refund status, or dispute status from the payment provider.

Payment Data Protection

at.click does not require customers to enter full card details or CVV codes into at.click databases and does not store such information.

Card data is processed directly by the payment provider or through secure tokenization, depending on the approved integration method.

API Credentials

Merchant API keys are used only to connect the merchant’s store to the payment provider selected by that merchant.

These keys are stored in encrypted form and are not displayed in system logs or shared with other merchants.

Payment Provider Responsibility

Payment card processing and financial transactions are subject to the payment provider’s own terms and privacy policy.

The payment provider is responsible for processing card data and transactions through its systems, while at.click updates the order status based on information received from the payment provider.

Gmail data and Google user data are not shared with payment providers.

7. Sharing Information with Service Providers

We may share the minimum information necessary with trusted service providers that help us operate at.click, including:

• Payment providers.
• Delivery and shipping companies.
• Hosting and technical infrastructure providers.
• Security and fraud-prevention providers.
• Technical support and maintenance providers.

Information is shared only to the extent necessary to provide the relevant service. We do not sell or rent personal data for marketing purposes.

We may also disclose information to government authorities where required by law, court order, or to protect the rights of at.click and its users.

8. Data Security

We use appropriate technical and organizational safeguards to protect data, including:

• HTTPS/TLS for data transmission.
• Encryption of sensitive data at rest.
• Password hashing.
• Encryption of Gmail tokens and API keys.
• Restricted access to systems by authorized people and services.
• Separation of data between stores.
• Security monitoring and logging.
• Measures to prevent unauthorized access.

However, no electronic system can be guaranteed to be completely secure. If a security incident occurs, we will take appropriate action in accordance with applicable laws.

9. Data Retention and Deletion

We retain data for as long as necessary to provide the service, manage accounts, process orders and transactions, meet legal and accounting obligations, resolve disputes, and prevent fraud.

When an account deletion request is received, we delete or anonymize information that is no longer required for operational or legal purposes.

Limited transaction, security, or legal records may be retained for the period required for those purposes.

10. Your Rights and Choices

Depending on the nature of your account, you may request to:

• Access your data.
• Correct or update your data.
• Delete your account or data.
• Receive a copy of your data where available.
• Withdraw consent for an optional integration.
• Disconnect Gmail or payment services.
• Object to certain uses of your data where permitted by law.

Privacy and data deletion requests may be sent to:

support@at.click

We may request additional information to verify your identity and protect your account before processing a request.

If you are a customer of a store using at.click, you should generally contact the store first regarding your order or booking data, as the merchant usually determines how that information is used.

11. Cookies

We use essential cookies to maintain login sessions, protect accounts, and remember preferences such as language and display settings.

We do not use third-party advertising trackers.

12. Processing Outside Kuwait

Some information may be processed or stored by technical service providers operating outside the State of Kuwait.

We select appropriate service providers and apply reasonable safeguards to protect the data in accordance with applicable requirements.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to at.click services, laws, or integrations.

If our use of Google data changes, or if we add new scopes or a new purpose for processing data, we will update this Privacy Policy and obtain the required consent before using the data for the new purpose.

Continued use of the Platform after changes are published constitutes acceptance of the updated Privacy Policy unless separate consent is required.

14. Contact Us

For questions about this Privacy Policy or your personal data, please contact us at:

Email: support@at.click Website: https://at.click