Privacy policy

1. Who is responsible

iMara is a brand operated by iMara Buyback, a business registered in New Brunswick, Canada. It is responsible for the personal information described below.

2. Information we collect

Depending on how you use the website and the app, we collect:

• Account: email, password (stored only in irreversibly hashed form) or Google sign-in identifier if you choose that option, full name, WhatsApp number, preferred pickup city, profile photo (optional).
• Orders: devices ordered, pickup city, amounts, payment method and currency, order status and history, reason for any cancellation, affiliate code if any, cart and favourites.
• Reviews: the rating, comment and photos you choose to publish.
• Notifications: messages about your orders and, if you accept them in the mobile app, a device identifier for push notifications (Firebase).
• Payment: card payments are processed by Stripe. Your card details are entered with Stripe; iMara neither receives nor stores them. We only keep the transaction identifier and outcome.
• Technical data: language and currency preferences (cookies), a session token, and internal usage statistics (pages and actions used) to improve the service.

3. Purposes

• Create and manage your account, process your orders, organise pickup and contact you about it (WhatsApp, email, notifications).
• Process payments and refunds.
• Provide the warranty, after-sales service and fraud prevention.
• Publish your reviews, if you post any.
• Meet our accounting and legal obligations, and improve the service.

4. Who receives it

We do not sell your information. It is shared only with:

• Stripe, for card payments and refunds: we neither see nor store your card number.
• Resend, to send transactional emails (email confirmation, orders, password reset, back-in-stock alerts): your email address and the message content are passed to it.
• Firebase / Google: Cloud Messaging for the mobile app’s push notifications, Crashlytics for the app’s crash reports (technical information about the device and the error, unrelated to the content of your orders) and, if you use it, Google sign-in.
• The carrier (cargo) in charge of delivery, to hand over your order: name, WhatsApp number and pickup city.
• Cloudflare, which relays the site’s traffic (security and performance).

5. Hosting and security

Data is hosted on a virtual private server (VPS) operated by iMara. Communications are encrypted (HTTPS), passwords are irreversibly hashed, and access is controlled on the server: each customer sees only their own information, and administration is restricted to authorised people.

6. Retention

We keep your information while your account is active. Order and payment records are kept as long as needed for our accounting and tax obligations, then deleted or anonymised. Account information is deleted on request (see below).

7. Your rights

You can ask to access or correct your information, or to delete your account and data, by writing to the address below. We reply within 30 days. Some transaction records may be kept where the law requires it.

Account deletion: in the app (Profile, Account section, “Delete my account”) or by email. The detailed steps, what is deleted and what is kept are described on the /suppression-compte page.

You can also withdraw your consent to push notifications in your device settings.

8. Contact

iMara Buyback — New Brunswick, Canada · info@imarashop.ca · +1 (506) 724-0776 (WhatsApp).