Privacy Policy

Your privacy is important to us. This Privacy Policy applies to services provided by Carl-labs Ltd. under the product name "Baag" and our website (the Site) and our web application (the App), or other digital products that link to or reference this Policy (collectively, the "Services") and explains what information we collect from users of our Services (a "user" or "you"), including information that may be used to personally identify you ("Personal Information") and how we use it.

Baag does not sell your data or share it with third parties except as described in this policy.

We encourage you to read the details below. This Policy applies to any visitor to or user of our Services, including store owners and their customers.

Information We Collect

We collect information that you provide to us when you use our Services, including when you create a store, list products, process payments, or contact our support team. This may include your name, email address, phone number, payment information, store details, and other information necessary to provide our services.

If you use Baag DMs, we also collect and store Instagram Direct Messages sent to and from your connected Instagram account, as well as your Instagram account credentials (access tokens) obtained through Meta's OAuth process. This data is used solely to power the AI-assisted DM automation feature on your behalf.

How We Use Your Information

We use the information we collect to provide, maintain, and improve our Services, including:

• • Operating online storefronts for Rwandan brands
• • Processing mobile money payments via MTN and Airtel through IntouchPay
• • Sending SMS notifications to store owners and customers via Pindo
• • Sending transactional emails via Resend
• • Powering AI-assisted Instagram DM automation through Baag DMs
• • Communicating with you about your account and our Services
• • Complying with legal obligations and enforcing our Terms of Service

Baag DMs & Instagram Data

Baag DMs is a feature that allows store owners to connect their Instagram Business account to Baag via Meta's official OAuth. Once connected, Baag DMs can read and send Instagram Direct Messages on behalf of the store owner using an AI assistant.

Specifically, by connecting your Instagram account to Baag DMs you authorize us to:

• • Read incoming DMs sent to your Instagram Business account
• • Send replies to customers on your behalf
• • Access your Instagram posts and stories to map them to your product catalog
• • Store conversation history in our database to provide context to the AI

Instagram message data is stored securely in our database and is only accessible to you as the store owner and to our AI system to generate replies. We do not use your Instagram data for advertising or share it with third parties. You can disconnect your Instagram account at any time from your Baag dashboard.

Baag DMs accesses Instagram data through Meta's official APIs and complies with Meta's Platform Terms and Developer Policies.

Payment Processing

Baag facilitates mobile money payments through IntouchPay, which processes MTN Mobile Money and Airtel Money transactions in Rwanda. When a payment is made through our Services, your payment information is processed by IntouchPay in accordance with their privacy practices and applicable financial regulations.

Data Sharing and Disclosure

We do not sell your personal information to third parties. We may share your information with service providers who assist us in operating our Services.

We may also disclose your information if required by law, to protect our rights or the rights of others, or in connection with a business transaction such as a merger or acquisition.

Subprocessors

We work with the following third-party service providers to help us provide our Services:

• • IntouchPay — Mobile money payment processing
• • Neon — Database hosting and storage
• • Vercel — Application hosting and deployment
• • Cloudflare — DNS and network security
• • Pindo — SMS delivery
• • Resend — Transactional email delivery
• • Meta — Instagram API access for Baag DMs

Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes encryption of data in transit and at rest, regular security assessments, and access controls. Instagram access tokens are stored encrypted and are only used to perform actions explicitly authorized by you.

Your Rights

Depending on your location, you may have certain rights regarding your personal information, including:

• • The right to access your personal information
• • The right to correct inaccurate information
• • The right to delete your information
• • The right to disconnect your Instagram account and delete associated data
• • The right to data portability

To exercise these rights, please contact us at elite@carllabs.cc.

Data Deletion

If you wish to delete your Baag account and all associated data, including any stored Instagram messages and access tokens, please contact us at elite@carllabs.cc. We will process your request within 30 days.

International Data Transfers

Baag is operated by Carl-labs Ltd, a software company registered in Rwanda. Your information may be transferred to and processed in Rwanda or other countries where we or our service providers operate. We ensure appropriate safeguards are in place for such transfers.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at: