Privacy Policy

1. Orders, custom designs and support

We process the information needed for your account, orders and support, including contact and delivery details, products, sizes, customization instructions, quotes, approvals, payment evidence and refund records. Custom requests may contain text in different languages, drawings, uploaded artwork and discussions.

The account request records the agreed work. WhatsApp is an additional coordination channel if you choose it, and its own privacy terms apply. Authorized staff and manufacturing providers receive the instructions and artwork needed to fulfill the order. We do not publish private artwork or use it for marketing without separate permission. Never send bank passwords, payment PINs, one-time banking codes or unnecessary sensitive documents.

2. Optional Google Analytics

Where enabled, Google Analytics operates only after your consent. You can reject or withdraw optional analytics through the website settings without losing shopping access. Necessary sign-in and security processing are separate.

Google Analytics receives public-page and product/event information using the browser identifier covered by your consent. Contact details, private artwork, customization briefs, payment evidence and free-text personalization are excluded from analytics events. Advertising features remain disabled under the current configuration.

An order is measured as a purchase only after verified full payment. Withdrawal stops future optional measurement, including queued measurement; it does not automatically erase information already processed. Google may process information outside Egypt. The service-provider and international-processing disclosures below also apply.

3. Who operates this website

CUPRA Tribe EG is an independent owners community administered by Ahmed El-Mansy in Egypt. This policy covers cupratribe-eg.com, its store and membership services. We are not the CUPRA manufacturer, an authorised dealer or an official manufacturer service.

For personal-data questions, access, correction or deletion requests, contact hello@cupratribe-eg.com.

4. Information you provide

Orders may include your name, email, phone, delivery address or pickup choice, order notes, products, sizes, quantities and personalisation details such as a printed name, car model or licence number. We retain order status, payment confirmation and refund records. Please do not put unnecessary sensitive information in free-text fields.

Membership information may include your account identifier, contact details, car details, photo, biography and social links you choose to supply. Support messages, attachments and payment evidence sent through your account, email or WhatsApp are also processed. Ownership checks may involve information you voluntarily send to community administrators; redact information that is not needed.

We do not collect your bank password, card security code or InstaPay PIN. Payments are made outside this website.

5. Sign-in information

When you use a sign-in option available on the website, we receive the account information needed to authenticate you and connect the services you request. The current membership service uses the hosting platform’s sign-in.

When you choose Sign in with Google, we use your Google account identifier, email, verification status and name to create and secure your customer account. We use an essential, secure session cookie that expires after seven days. Signing out revokes that session. Google sign-in does not by itself verify vehicle ownership. You may save a mobile number for manual matching with your existing WhatsApp community membership. This account mobile is private; listing contact numbers are public when the listing is published. Changing your account mobile resets owner approval. New accounts receive one service welcome email. If you choose email signup, we collect your name, email and mobile number and activate the account only after you enter the emailed verification code. Codes expire after ten minutes and are stored only as browser-bound hashes; delivery records omit the code. Email sign-in uses the same secure session cookie. It does not verify mobile or vehicle ownership.

Google sign-in will not request access to your Gmail messages, Google Drive files, contacts or calendar. We never receive your Google password. You can manage Google connections at myaccount.google.com/connections; removing a connection does not by itself delete records already held by us.

6. Browsing, analytics and security

Product and listing view counting is enabled by default for new visitors. Uncheck Count product and listing views in Data collection settings at any time to stop future counting in this browser. Saved opt-outs and browser GPC/DNT signals are respected. This setting does not enable detailed visitor logs or Google Analytics. Counts are approximate browser activity, not an exact count of people.

With view counting enabled, visible product pages send an update once a minute. A product-specific hashed browser identifier supports the public viewer count for the last 24 hours or 7 days; repeat visits and tabs count once per product. Only the latest view per browser/product is kept, for up to 7 days. Older activity is excluded immediately and deleted on the next activity request. Presence records are excluded from backups. Product pages also show aggregate confirmed paid-order counts for the last 24 hours, without customer or order details. Listing views and seller-contact clicks use a daily listing-specific hash of the browser identifier, deduplicating each event type once per browser per UTC day. These deduplication records expire after two days and are cleaned on the next listing metric update; aggregate totals remain. Raw browser identifiers and IP addresses are not saved in listing metric records. Historical listing totals used network-based deduplication.

With optional analytics permission, a visible storefront tab sends a live-activity heartbeat every 30 seconds. The private dashboard counts distinct signed-in accounts and anonymous browsers active in the last two minutes. Repeat tabs count once per browser; an account counts once across devices. We keep only a hashed browser identifier, a reference to the current sign-in session where applicable, and the latest heartbeat time. No page content or contact details are stored in these live-activity records. Expired rows are excluded immediately and removed on the next heartbeat or dashboard refresh; live-activity rows are excluded from backups. Rejecting analytics or sending GPC/DNT prevents this measurement.

With your optional analytics permission, our first-party analytics record page paths, timestamps, clicks on links or buttons, product interactions, cart activity and checkout events, using a randomly generated browser identifier and a session identifier. These identifiers are pseudonymous, not a guarantee of anonymity: they can be associated with an order or a cart reminder when you provide contact details.

Product analytics exclude custom printed names, licence numbers and engraving details. If you accept optional visitor analytics, our owner-only visitor log records public page visits, browser/session IDs, IP address, referrer origin, browser/OS and device category, model when your browser supplies it, language, timezone, screen/viewport dimensions and approximate country, region, city and network provider when the hosting platform supplies them. These signals may be inaccurate or unavailable and do not reliably identify a person. For abuse prevention, we automatically record limited server request information: IP address, user-agent/browser category, time, sanitized route, method, request identifier, final response status, request-guard outcome and country when hosting supplies it. A daily network identifier helps correlate activity but is not proof of personal identity. This security processing is separate from optional analytics and relies on our legitimate interest in protecting the service, subject to applicable law and your rights. We do not collect screen size, device model, precise location or client identifiers for this security log. Hosting and security providers also process network requests. Our rate limiting uses a derived network identifier rather than saving raw IP addresses in the analytics table.

We do not currently request precise GPS location, record sessions, or use device fingerprinting to identify visitors. Optional visitor logging starts only after you accept it and respects browser Global Privacy Control and Do Not Track signals. You can decline or withdraw using Data collection settings in the footer without losing shopping access. Withdrawal stops future optional analytics; necessary security logging remains separate. Contact us to request deletion of existing records.

7. Cookies and browser storage

Browser storage saves your cart, language choice, analytics identifier, session identifier and cart-reminder timing. Sign-in and security services may use cookies or tokens needed to operate securely. Closing a tab normally ends its session storage; persistent local storage remains until cleared by you or your browser.

A session-only display cookie remembers that you have seen the privacy notice, so it does not reappear during page loading. It contains no visitor identifier and never enables analytics by itself. View-counting and additional analytics preferences are saved separately in browser storage.

You can clear or restrict cookies and site storage in your browser. This may empty your cart, reset preferences or sign you out; it does not delete records already stored on our servers. Contact us to request deletion of those records.

8. How and why we use information

We use information to fulfil orders, verify payments, arrange delivery or pickup, administer membership, provide requested profiles, respond to support, improve the website, prevent abuse and maintain business records.

We process data for the services you request, applicable legal obligations and other grounds permitted by applicable law. Where consent is required, we obtain it for the relevant purpose. Optional cart-reminder emails are sent only when you opt in; use the unsubscribe link or contact us to stop them. Necessary order or security messages are separate from optional reminders.

9. Service providers and sharing

Access is limited to administrators and providers who need information to operate the service: the Sites hosting platform and Cloudflare infrastructure; Google for private operational backups and, when enabled, Google sign-in; email providers, including Zoho for our inbox and Amazon SES when used for website delivery; and WhatsApp when you contact us there.

We share the details needed for an order with manufacturing or delivery providers, such as personalisation instructions and delivery contact information. We may also disclose information to meet a lawful request or protect legal rights. We do not sell your personal information or provide it to advertisers for their independent marketing.

Providers may process information outside Egypt. International processing is subject to applicable requirements and provider safeguards; this notice does not replace any legally required consent or transfer authorisation. External platforms apply their own privacy policies to your use of their services.

10. Public card profiles and printed information

A card page publicly displays the member’s name, car model, member number, membership tier, membership status and joining date. These basic verification fields stay public while the page is available, including when active membership ends. Optional contact and profile fields can be shown or hidden using the available profile settings. These controls change public visibility; they do not create separate audiences such as friends or members only.

Anyone with the public link, QR code or NFC card can view published information. Printed cards include the approved name, car model and member ID. Printing a number plate is optional and does not automatically publish it online; the online profile keeps that field private. Account contact details, payment evidence and ownership-verification documents do not become public merely because you have a card.

A Connect profile can remain in use after active community membership ends. We update the membership status without automatically deleting the included profile service. Upgraded and original cards can share the same public destination. Lifetime access does not prevent you from asking us to remove your profile.

You can change optional visibility settings and request access, correction or deletion through account support or hello@cupratribe-eg.com. Removing a public profile is separate from records we may need for payments, disputes or legal recordkeeping; we explain what must be retained and why. Information already copied by another person may remain with that person after you hide it. Keep activation links private and report a lost card so we can review its shared link.

11. Retention and protection

Security request logs are retained for up to 30 days. Optional detailed visitor logs are retained for up to 90 days and their raw IP addresses for up to 30 days. Cleanup runs during visitor ingestion, owner log access and scheduled operations; expired data is removed before display. These logs are excluded from private Drive backups and spreadsheet mirrors. Basic optional analytics and inactive unconverted carts expire after 90 days; carts with unresolved email delivery are retained until review. Requested cart reminders are processed separately from optional analytics. Orders, memberships and operational audit records do not have automatic deletion schedules. We assess deletion requests against service needs, fraud prevention, disputes and applicable recordkeeping obligations. We do not claim that every record expires after a fixed number of days.

We use access restrictions, protected administrative access and private backups. Backups may retain older copies until replaced or deleted; a deletion request includes review of relevant backup copies where practicable. No internet service can guarantee absolute security.

12. Your choices and requests

You may open an account support request or contact hello@cupratribe-eg.com to ask what personal information we hold about you, request a copy, correct it, request deletion, withdraw consent or object to or restrict processing where applicable. Include enough information to locate your records; do not email passwords, one-time codes or unnecessary identity documents. We may ask for proportionate verification before disclosing or changing records.

We will explain any information we must retain and the reason. Withdrawing consent does not undo earlier lawful processing. You may raise concerns with the competent data-protection authority, including Egypt’s Personal Data Protection Center.

13. Children and policy updates

This service is intended for adult vehicle owners and customers. We do not knowingly seek personal data from children. Contact us if you believe a child has supplied personal information.

We will update this page when practices change and revise its date. Material changes will be communicated through the website or appropriate contact channels; new purposes requiring consent will not rely merely on this notice.