Privacy Policy

Mela ("Mela", "we", "us", or "our") operates a creator-commerce platform that lets creators build storefronts and sell digital products, tips, memberships, events, services, and brand collaborations, and lets buyers discover and purchase from them. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the choices and rights you have.

It applies to our websites, applications, and services (together, the "Services"). By using Mela, you agree to the practices described here. If you do not agree, please do not use the Services.

A note on roles. When you buy from a creator, that creator is an independent business. For personal data a creator collects about their own customers, the creator acts as the data controller and Mela acts as their processor. Mela is the controller for the platform data described in this policy.

We collect the following categories of information:

• Account information. Name, email address, password (stored only as a secure hash), and profile details such as your username, display name, bio, avatar, banner, location, website, and social links.
• Transaction information. Records of purchases, tips, subscriptions, tickets, bookings, order totals, currency, coupons, and payout requests. We do not store full card numbers — payments are handled by our payment processors.
• Content you provide. Products, files, descriptions, images, reviews, messages, support tickets, and any other content you submit.
• Verification data. If you request creator verification, we collect identity and business details (for example, a government ID, trade licence, or TIN). These documents are stored in restricted, access-controlled storage.
• Usage and device data. Pages viewed, referring pages, approximate location derived from your IP address, device and browser type, and an anonymous session identifier used for analytics such as unique-visitor counts.
• Referral and campaign data. When you arrive on one of our public pages, we record which site or campaign sent you — the referring website and any campaign tags in the link you followed (for example utm_source or utm_campaign), together with the page you landed on. If you then create an account, we save that first referral to your account so we can understand which channels bring people to Mela. This tells us how you found us; it is not used to build an advertising profile of you, and we do not sell it or share it with advertisers.
• Cookies and similar technologies. Small files used to keep you signed in, remember preferences (such as light or dark theme), measure product performance, and remember how you first found Mela.
• Communications. Messages you send us, replies to transactional emails, and correspondence with support.

We use personal information to:

• Provide, operate, secure, and improve the Services;
• Process orders, tips, subscriptions, tickets, and payouts, and deliver purchases;
• Send transactional messages such as receipts, delivery links, ticket QR codes, booking confirmations, and membership notices;
• Personalise your experience, including recommendations and analytics shown to creators about their own storefronts;
• Measure how well our own marketing works — for example, how many people a given campaign or social channel brought to Mela — so we invest in the channels that genuinely help creators find us;
• Prevent fraud, abuse, and violations of our Terms, and enforce our policies;
• Verify creator identities where verification is requested;
• Respond to your questions and provide customer support;
• Comply with legal obligations and respond to lawful requests.

Where required by law, we rely on these legal bases: performance of a contract with you, our legitimate interests in operating and securing the Services, your consent (which you may withdraw), and compliance with legal obligations.

Payments on Mela are processed by third-party payment providers (such as Chapa and mobile-money services like telebirr). When you pay, your payment details are submitted directly to the provider under their terms and privacy policy. Mela receives a confirmation and a limited transaction reference — we never receive or store your full card number, CVV, or banking credentials.

We retain transaction metadata (amounts, currency, dates, provider references, and the product or creator involved) to fulfil orders, issue receipts and refunds, calculate payouts and fees, and meet tax and accounting requirements.

We do not sell your personal information. We share it only as follows:

• Between creators and buyers. To complete a purchase, a creator receives the information needed to fulfil and support the order (such as your name, email, and what you bought). Creators must handle this data responsibly and only for fulfilment and customer service.
• Service providers. We use vetted vendors for payments, email delivery, file storage, hosting, and analytics. They may process data only on our instructions and under confidentiality obligations.
• Legal and safety. We may disclose information to comply with the law, respond to valid legal process, protect the rights, safety, and property of Mela, our users, and the public, or investigate fraud and abuse.
• Business transfers. If Mela is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• With your direction. When you choose to connect a service or make information public (for example, your public storefront or supporter wall).

We use strictly necessary cookies to keep you signed in and secure your session, and functional cookies to remember preferences. We use privacy-respecting analytics to understand aggregate usage and improve the product. You can control cookies through your browser settings; disabling strictly necessary cookies may break sign-in and checkout.

All of our cookies are first-party. We do not use third-party advertising or cross-site tracking cookies, and we do not allow advertising networks to track you across other websites through Mela.

Two analytics cookies are worth calling out specifically:

• Session cookie (30 minutes). A random identifier that lets us count one person visiting five pages as one visitor rather than five. It expires after 30 minutes of inactivity and is not linked to your identity.
• Referral cookie (90 days). Records the site or campaign that first brought you to Mela and the page you landed on. It is written only once — your first visit — so returning later does not overwrite it. If you create an account within 90 days, that referral is saved to your account; otherwise the cookie simply expires. We use this in aggregate to see which channels work, not to profile you individually.

If you would rather we did not associate a referral with your account, you can clear your browser cookies before signing up, or email us at privacy@mela.dev and we will remove it from your account.

We keep personal information for as long as your account is active or as needed to provide the Services. We retain certain records after account closure where necessary to comply with legal, tax, accounting, or reporting obligations, resolve disputes, prevent fraud, and enforce our agreements. Verification documents are retained only as long as needed for their purpose and applicable record-keeping rules, then deleted or anonymised.

We use technical and organisational measures designed to protect your information, including encryption in transit, hashed passwords, access controls, gated download links for paid and private files, and restricted storage for sensitive documents. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify you and the relevant authorities as required by law.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can:

• Update most profile information directly in your dashboard settings;
• Export your data or request deletion of your account;
• Opt out of non-essential and marketing emails via the unsubscribe link;
• Contact us at privacy@mela.dev to exercise any right.

We will respond within the timeframe required by applicable law. We may need to verify your identity before acting on a request.

Mela is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will take steps to delete it.

We are based in Ethiopia and may process and store information in Ethiopia and in other countries where we or our service providers operate. Where we transfer data across borders, we take steps to ensure it receives an adequate level of protection consistent with this policy and applicable law.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you by email or through the Services. Your continued use of Mela after an update means you accept the revised policy.

For privacy questions or requests, email privacy@mela.dev or use our contact page. We aim to respond to every request promptly and in good faith.