Privacy policy

Last updated: 6 October 2026

Rashih is a Salla app by Pentaclay. It runs a refer-a-friend program in a store: a personal code for each shopper, a first-order discount for their friend, and a reward for the shopper once the friend's order is delivered. This policy explains what data we process and why.

Data we receive from the store

• Store data: store ID, name, URL, email, currency, and the access token Salla sends at install (stored encrypted).
• Participating customers: customer ID, first name, email and mobile number.
• Orders that used a referral code: order ID, total, code and status.
• IDs of customers who bought before, so the friend discount only goes to new customers.

Why we use it

• To create referral and reward codes as coupons in your store through Salla's API.
• To link a friend's order to the shopper who invited them, pay the reward after delivery, and void it on cancellation or return.
• To prevent abuse, such as a shopper using their own code with the same mobile or email.
• To email rewards to shoppers and show statistics to the merchant in the app dashboard.

We don't sell data or use it for advertising. We share it only with the providers needed to run the app:

• Vercel: hosts and runs the app.
• Neon: the database where store and referral data is kept.
• Resend: sends reward emails to shoppers.

Security and retention

• Access tokens are encrypted (AES-256), all traffic uses HTTPS, and Salla's webhooks are signature-checked.
• When the app is uninstalled we delete the access token right away, and the referral codes and customer group we created in your store; reward codes already sent to your customers stay valid until they expire. All store data is deleted from our systems within 30 days.

Your rights

Merchants and shoppers can ask to see or delete their data by emailing contact@pentaclay.com. We reply within 7 working days.