1. Introduction
ThreeU is a business operating system: one platform that gives merchants a website, point of sale, ERP, marketplace presence, delivery tools, AI assistance, and a developer ecosystem. Running those services means handling information — about the businesses that use ThreeU, the people who work in them, and the customers who buy from them.
This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the rights you have over it. We have written it to be read, not just published. If anything is unclear, contact us at [email protected] and we will explain.
All services described in this policy are provided by ThreeU Solutions and Business LLC, registered with the Qatar Financial Centre (QFC), Registration Number 04695. References to "ThreeU", "we", "our", or "us" mean ThreeU Solutions and Business LLC.
Three commitments frame everything below:
- We do not sell personal information.
- We do not monetize customer business data through advertising.
- Your business data remains yours. We process it solely to provide, maintain, secure, support, and improve the services you asked for.
2. Scope
This is the single privacy policy for the ThreeU ecosystem. It applies to:
- The ThreeU web platform and dashboards
- ThreeU ERP
- ThreeU POS (point of sale)
- Storefronts hosted on ThreeU
- The ThreeU Driver application
- The ThreeU Marketplace
- The ThreeU AI Platform
- The ThreeU Developer Platform and APIs
- ThreeU mobile applications
- Future ThreeU services, unless a service states otherwise
Where a specific service handles information differently, this policy says so in a clearly identified section rather than in a separate document.
A note on roles. For information about our direct users (merchants, their staff, developers, drivers), ThreeU decides how and why data is processed — we act as the data controller. For business data that merchants bring onto the platform (their customers, orders, inventory, employees), the merchant decides; ThreeU processes that data on the merchant's behalf and under their instructions. If you are a customer of a store built on ThreeU, that store's own privacy practices apply to your relationship with them, alongside the protections described here.
3. Information We Collect
We collect information in three ways: you provide it, it is generated when you use the services, or it arrives through integrations you connect. We collect only what we need to provide and improve the services you use.
4. Information You Provide
- Account information — name, email address, phone number, password, and preferred language when you create an account.
- Business information — business name, commercial registration details, addresses, tax identifiers, branding, and product catalogs when you set up an organization or storefront.
- Billing information — subscription plan, billing contact, and payment method details. Card numbers are captured and processed by licensed payment providers; ThreeU does not store full card numbers.
- Team information — names, contact details, roles, and permissions for staff you add to your workspace, and employee records you keep in the ERP (such as payroll and attendance data), which we process on your behalf.
- Content — products, pages, images, documents, messages, and any other material you upload or create on the platform.
- Support communications — messages, attachments, and diagnostic details you share when you contact support.
5. Information Generated Through Your Use
- Transaction records — orders, invoices, payments, refunds, deliveries, and inventory movements created as you run your business on ThreeU.
- Usage data — pages viewed, features used, actions taken, and timestamps, which help us understand what works and what fails.
- Device and connection data — IP address, browser or app version, operating system, device identifiers, and approximate location derived from IP.
- Location data (Driver app) — precise location while a driver is on shift or completing a delivery. See Section 13.
- Logs and security events — authentication attempts, API calls, and administrative actions, kept to secure and audit the platform.
6. Information From Integrations
When you connect a third-party service to ThreeU — a payment gateway, a sales channel such as Shopify, a messaging service such as WhatsApp, an advertising account, or a plugin from the Marketplace — we receive the data that integration is designed to exchange (for example, orders from a connected sales channel, or message delivery status from a messaging provider). We request the minimum access scopes the integration needs, and you can disconnect an integration at any time from your dashboard.
7. How We Use Information
We use information to:
- Provide the services — operate your storefront, process orders, sync inventory, run payroll, deliver messages, and everything else you signed up for.
- Process payments and billing — through licensed payment providers.
- Keep the platform secure — detect fraud and abuse, authenticate users, investigate incidents, and enforce access controls.
- Support you — respond to questions, troubleshoot problems, and notify you about issues that affect your account.
- Improve the services — analyze usage in aggregate to fix problems, prioritize features, and measure performance.
- Communicate — send service announcements, security alerts, and (with your consent, where required) product news you can opt out of at any time.
- Comply with law — meet legal, regulatory, tax, and accounting obligations that apply to us.
We do not use your information for purposes incompatible with the ones above without telling you first.
8. Legal Basis for Processing
Where applicable law (including the QFC Data Protection Regulations) requires a legal basis, we rely on:
- Contract — most processing is necessary to deliver the services you or your organization agreed to.
- Legitimate interests — securing the platform, preventing fraud, and improving the services, balanced against your rights.
- Legal obligation — retaining records required by tax, accounting, or regulatory rules.
- Consent — for optional processing such as marketing communications, which you may withdraw at any time.
9. Data Sharing
We share information only when necessary to operate the services, and never by selling it. Specifically, we share with:
- Service providers — hosting, infrastructure, payment processing, email and SMS delivery, and analytics providers who process data under contracts that restrict use to providing services to us.
- Integrations you connect — data flows to a third-party service only when you or your organization connects it.
- Other users in your workspace — according to the roles and permissions your organization configures.
- Merchants you buy from — if you are a customer of a ThreeU-powered store, your order details go to that merchant.
- Legal and safety recipients — when required by law, regulation, or valid legal process, or when necessary to protect the rights, safety, or integrity of the platform, our users, or the public.
- Corporate transactions — if ThreeU is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy's protections.
10. AI Services
AI features are woven throughout ThreeU — assistants, content generation, analytics, and automation. When you use an AI feature:
- The feature processes the data needed for the request — your prompt and relevant business context (for example, product data when generating a product description).
- Some AI requests are processed by third-party AI providers under contracts that prohibit them from using your data to train their models.
- We do not use your customer business data to train AI models without your explicit agreement.
- Administrators can control which AI features are enabled for their workspace.
A dedicated AI & Data Usage document in the Legal Center provides fuller detail, including current providers and retention specifics, as the AI platform evolves.
11. Developer Platform
If you build on ThreeU as a developer, we collect your developer account details, submissions (plugins, themes, manifests), API usage logs, and payout information. If you install a third-party plugin or theme from the Marketplace, the developer of that item may process data your installation grants it access to; access scopes are shown before installation, and every submission passes ThreeU review before it can be distributed. Developers are contractually bound to handle data obtained through the platform in line with this policy and our developer terms.
12. Marketplace
When merchants sell through the ThreeU Marketplace, buyer information (name, contact details, delivery address, order contents) is shared with the merchant fulfilling the order and, where delivery is arranged through the platform, with the assigned driver — in each case only what is needed to complete the transaction.
13. Driver Platform
The ThreeU Driver app collects precise location only while you are on shift or handling a delivery, to route orders, share delivery progress with merchants and customers, and calculate earnings. Location tracking stops when you go off shift. We also process your identity and vehicle documents where required for onboarding, and your delivery and earnings history to operate payouts.
14. Security
We protect information with technical and organizational safeguards including encryption in transit and at rest, role-based access controls, authentication requirements, audit logging, infrastructure monitoring, and regular security testing. Our practices are described in more detail in the Security & Trust document in the Legal Center.
No system is perfectly secure, and we do not claim ours is. What we commit to is engineering for security continuously, limiting access to those who need it, and responding quickly and transparently if something goes wrong — including notifying affected customers and regulators where required by law.
15. Data Retention
We keep information for as long as needed to provide the services and meet legal obligations:
- Account and business data — for the life of the account, then deleted or anonymized within a reasonable period after closure, except where law requires longer retention.
- Transaction and financial records — retained for the periods required by tax, accounting, and QFC regulatory rules.
- Logs and security data — retained for limited periods proportionate to their security purpose.
- Backups — deleted data may persist in encrypted backups for a limited period before those backups are cycled out.
When you close your account, you may export your business data first; we will tell you how during offboarding.
16. International Transfers
ThreeU operates from Qatar, and our infrastructure and service providers may store or process data in other countries. When information crosses borders, we apply safeguards — contractual protections and provider due diligence — so that it receives protection consistent with this policy and applicable law, including the QFC Data Protection Regulations.
17. Your Rights
Depending on applicable law, you have the right to:
- Access the personal information we hold about you.
- Correct inaccurate or incomplete information.
- Delete your information, subject to legal retention requirements.
- Export your information in a portable format.
- Object to or restrict certain processing.
- Withdraw consent where processing is based on consent.
- Complain to a supervisory authority, including the QFC Data Protection Office.
To exercise any of these rights, contact [email protected]. We respond within the timeframes required by applicable law. If your data is on ThreeU because a merchant you deal with uses our platform, we may refer your request to that merchant, since they control that data — and we will help them fulfil it.
18. Children's Privacy
ThreeU's services are business tools and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact [email protected] and we will delete it.
19. Changes to this Policy
We may update this policy as our services, technology, security practices, and legal obligations evolve. When we make changes, we update the "Last Updated" date above. If a change materially affects your rights or how we process personal data, we will give reasonable advance notice through the services, by email, or by other appropriate means, and obtain consent where the law requires it. Changes are not applied retroactively in a way that unfairly removes rights you already have. Previous versions are available on request.
20. Contact Information
ThreeU Solutions and Business LLC Registered with the Qatar Financial Centre (QFC), Registration No. 04695
- Privacy requests: [email protected]
- General legal: [email protected]
We aim to acknowledge privacy requests within a few business days and resolve them within the periods required by applicable law.