This policy covers anyone who uses the Dukkan platform — store owners and staff who sign up for the dashboard, and customers who place orders through the WhatsApp webview.

Dukkan is operated by Verstack For Marketing and PR L.L.C S.O.C (Dubai DET License No. 1516468, TRN 105139750100003), registered address Office 101, Zalfa Building, Al Garhoud, Dubai, UAE. That entity is the data controller for the information described below.

For store accounts:

• Owner / staff name, email address, phone number
• Store name, address, area, operating hours
• Hashed password (never stored or transmitted in clear)
• Catalog content you create or edit

For customers:

• Phone number (from WhatsApp, hashed for lookup)
• Name (when you first message a store)
• Delivery addresses you save, including map location (GPS coordinates) and any delivery notes you add
• Order history (items, prices, payment method, delivery status, scheduled time, and any order notes or driver instructions you add)
• Your current cart contents, per store
• What you type into the address search, so we can turn it into a location on the map. See “Who we share it with” — this text goes to a mapping service.
• A record of what happened in the app — orders placed, addresses saved, catalogs opened — so we can tell a quiet shop from a broken one. It is tied to your account, and it is deleted with it.
• The contents of your WhatsApp conversation with the Dukkan bot, for as long as the conversation state requires it
• Reports you send us about a store (“Report a problem”), including the report text and how it was resolved

We do not collect payment card numbers — all transactions happen offline between you and the store at delivery time.

Everything we collect is to provide the ordering service: route your message to the right store, show you their catalog, place and track your order, and let the store fulfill it. We also review problem reports you send us so we can hold stores to a quality standard.

We do not sell your data, and we do not use it for advertising.

• The store you order from sees your name, phone number, delivery address, and order details — they need all of this to pack and deliver. They do not see your activity with other stores.
• WhatsApp / Meta handle the message transport. Meta's own privacy policy applies to what they see; we recommend reading it.
• Supabase is our database and storage provider. They host our infrastructure and process data on our behalf under a data-processing agreement. We use their cloud regions configured for compliance with applicable UAE regulations.
• 360dialog is our WhatsApp Business API provider, also acting as a processor on our behalf.
• OpenStreetMap turns the address you type into map coordinates. The text you type in that box is sent to them to do it. We send nothing else — not your name, your number, or your order.
• OpenFreeMap serves the map images themselves. Loading a map tells them your device's IP address and roughly which part of the map you are looking at, as any map on any website would.
• Stripe processes store subscription payments. Stores' billing details go to Stripe directly; Dukkan never sees a card number. Stripe is not involved in what a customer pays a store.
• Resend delivers our email — sign-in links, receipts and account notices.
• Umami counts visits to our public pages, as described under Cookies. Not on the shopping webview.
• Sentry receives error reports when something breaks, so we can fix it. It is only enabled when an error actually occurs and carries technical detail, not your order history.
• If you report a problem, the Dukkan team reviews it and may share the substance of your report with the store concerned in order to resolve it. We do not share it beyond that.

We do not share your data with anyone else without your consent, except where required by UAE law.

We use a single essential cookie on the store dashboard (/d/*) and admin pages (/a/*) to keep you signed in. We use no advertising cookies and no advertising trackers anywhere.

Our public pages — the home page, these policies, and the store sign-in and sign-up screens — load Umami, a privacy-focused analytics tool, to count visits. It sets no cookies and does not follow you between sites. It does not run on the ordering webview where customers shop, or on our admin pages. Your phone's WhatsApp client manages your identity there, and the catalog uses a signed token in the URL instead of cookies.

Separately, we keep our own record of what happened in the app (see “What we collect”), in our own database. It is never sold, never shared for advertising, and goes when your account goes.

Catalog and order history are kept as long as your account is active. Stores need order records for tax and bookkeeping purposes, typically five years under UAE rules.

If you delete your customer account (/c/settings), we remove your personal information immediately: name, phone number, addresses, cart, and conversation state. Past orders are retained for the store's records but the personal details on them are scrubbed.

Settings open from your shop's page in WhatsApp — tap the settings icon, or open the link the bot sent you and tap it there. Opening the address below on its own won't work: the page needs the link from WhatsApp to know who you are. From there you can:

• Export your data as JSON from /c/settings.
• Delete your account from the same page. The effect is described in the "How long we keep it" section above.
• Correct your information — your name and your saved addresses — on the same Settings screen. Details already printed on a past order are part of the store's records; ask the store to change those.

Dukkan is not intended for people under 18. If you become aware that a minor has registered, please contact us and we will remove the account.

We use industry-standard precautions: HTTPS in transit, hashed passwords for staff accounts, signed short-lived tokens for the customer webview, and database-level isolation per environment. No system is perfectly secure; please use a unique password and tell us right away if you suspect your account has been compromised.

When we change this policy we bump the version string and date at the top of the page. For material changes affecting stores, we will notify stores by email or a dashboard notice; continued use of the platform after the stated effective date constitutes acceptance of the updated policy.

Privacy questions can be sent to info@dukkan.market. Postal mail can be addressed to Verstack For Marketing and PR L.L.C S.O.C, Office 101, Zalfa Building, Al Garhoud, Dubai, UAE.