This policy covers anyone who uses the Dukkan platform — store owners and staff who sign up for the dashboard, and customers who place orders through the WhatsApp webview.

Dukkan is operated by Verstack For Marketing and PR L.L.C S.O.C (Dubai DET License No. 1516468, TRN 105139750100003), registered address Office 101, Zalfa Building, Al Garhoud, Dubai, UAE. That entity is the data controller for the information described below.

For store accounts:

• Owner / staff name, email address, phone number
• Store name, address, area, operating hours
• Hashed password (never stored or transmitted in clear)
• Catalog content you create or edit
• Which version of the Terms each owner accepted, and when
• Your plan, your billing status and Stripe's ids for your account. Card details go to Stripe, never to us.

For customers:

• Phone number (from WhatsApp), stored in full so the store and Dukkan can contact you about your orders. We also keep a hashed copy to find your account.
• Your name: the one on your WhatsApp profile, or the one you give the bot when it asks
• Delivery addresses you save, including map location (GPS coordinates) and any delivery notes you add
• Order history (items, prices, payment method, delivery status, scheduled time, and any order notes or driver instructions you add)
• Your current cart contents, per store
• What you type into the address search, so we can turn it into a location on the map. See “Who we share it with” — this text goes to a mapping service. We also keep a copy of each search in the record below.
• A record of what happened in the app — orders placed, addresses saved, address searches, catalogs opened — so we can tell a quiet shop from a broken one. It is tied to your account.
• Every WhatsApp message between you and the Dukkan number: what you type, location pins you share, buttons you tap, the name on your WhatsApp profile, and every message we send you. The store you are talking to can read that conversation in its dashboard. The same goes for a store's own WhatsApp number, when the store has connected one (see below), together with the replies the store sends you from its own WhatsApp Business app.
• Reports you send us about a store (“Report a problem”), including the report text and how it was resolved. Each report is also emailed to the Dukkan team with your name.
• If a store blocks your number from ordering with it: that fact, when, and any short note the store wrote for its own records. Only that store and the Dukkan team see it.
• If you stop announcements on WhatsApp (by replying STOP, or with the switch in Settings): when you did, so those announcements skip you.

Nothing here is deleted on a timer. Everything listed above is kept for as long as your account exists, however old it is. When you delete your account it is deleted or erased, with two exceptions, neither of which keeps your name or number: past orders, which stay for the store's records, and a note of each time you opened a store's catalog, which stays so the store's visit counts do not change (see “How long we keep it”). Two kinds of copy are out of our reach by then and stay where they were sent: the email the store gets about a new order, which carries your first name and the order but never your phone number or address, and the email our team gets for each report.

We never see your card details. You pay the store directly: cash or card at the door, or through a payment link from the store's own payment provider.

A store's own WhatsApp number. A store can connect its own WhatsApp Business number, so the bot answers on that number instead of Dukkan's. The store's owner does this with their own Facebook login, in Meta's sign-up window. For that number we keep: an access token Meta issues to Dukkan for it (encrypted, with a key that is not in our database), the number itself, the business name WhatsApp shows for it, and Meta's ids for the number, its WhatsApp Business account and the business. We do not receive the owner's Facebook profile. If the store keeps using the WhatsApp Business app on its phone, the store sees your chat there too, and the replies it sends you from the app are kept with the conversation above. While the store is replying itself, the bot stays quiet for a while. The store's other chats (friends, suppliers, people who never ordered through Dukkan) are not stored. Meta's setup also requires us to ask Meta, once, for the store's WhatsApp Business contacts and, if the store agrees in the app, its chat history: we count what arrives and throw it away, without storing it. When the store disconnects the number, we delete the token; the messages already exchanged stay with the conversation, as above.

Everything we collect is to provide the ordering service: route your message to the right store, show you their catalog, place and track your order, send you updates about it, and let the store fulfill it. Order updates reach you on WhatsApp, from the Dukkan number on the store's behalf, or from the store's own number when it has connected one. We also review problem reports you send us so we can hold stores to a quality standard, and, to protect stores from spam, we limit how many orders one customer can have waiting at a store and let a store block a customer.

Announcements. We may send you announcements from Dukkan, and from a store you have ordered from, on WhatsApp and on the ordering page. Each WhatsApp announcement ends with “Reply STOP to stop these messages.” Reply STOP, or turn off Announcements on WhatsApp in Settings, and we stop sending you announcements on WhatsApp; updates about your orders still come. Reply START to get them again.

Apart from these, we do not let anyone advertise to you through Dukkan. We do not sell your data or share it with advertisers, and we use no advertising trackers.

We use the companies below to run Dukkan. Each one gets only what its part needs. Where each one processes data is given as the company describes it, or as we have set it up.

• The store you order from sees your name, phone number, delivery address, and order details — they need all of this to pack and deliver. They do not see your activity with other stores. When its staff tap Directions on an order, the address opens in Google Maps on their phone.
• WhatsApp / Meta handle the message transport. Meta's own privacy policy applies to what they see; we recommend reading it. On a store's own number, messages go between Meta and us directly, through Meta's Cloud API, without 360dialog. When a store owner connects a number, the dashboard's Settings, WhatsApp screen loads Facebook's script to run Meta's sign-up window (see Cookies). Where: Meta's data centres, in several countries including the United States.
• 360dialog is the WhatsApp Business API provider for the Dukkan number, and passes its messages between Meta and us. Where: Germany.
• Supabase is our database, sign-in and file storage provider: everything listed in section 2 is kept there. Where: Frankfurt, Germany.
• Railway runs our web app and our WhatsApp bot. Every page you open and every message the bot handles passes through it, and our server logs are kept there. Where: the Netherlands.
• Cloudflare sits in front of dukkan.market: every page request, including the ordering page, passes through it. It keeps copies of product photos and turns away abusive traffic. Where: its data centres worldwide, usually the one nearest you.
• Resend delivers our email — sign-in links and codes, receipts and account notices, the new-order email to a store (with your first name) and the report email to our team. Where: our email goes out through its Tokyo region, in Japan.
• Google runs Dukkan's own mailbox (info@dukkan.market), so emails you send us and the report emails our team receives are kept there. Where: several countries, including the United States.
• Stripe processes store subscription payments. Stores' billing details go to Stripe directly; Dukkan never sees a card number. Stripe is not involved in what a customer pays a store. Where: several countries, including the United States.
• Umami counts visits to our public pages, without cookies, as described under Cookies. Not on the shopping webview. Its script loads from cloud.umami.is. Where: Umami says its servers are in the United States and the European Union.
• OpenStreetMap turns the address you type into map coordinates. The text you type in that box is sent to them to do it, by our server, not your phone. We send nothing else — not your name, your number, or your order. Where: the OpenStreetMap Foundation keeps its data in the United Kingdom and the Netherlands.
• OpenFreeMap serves the map images themselves. Loading a map tells them your device's IP address and roughly which part of the map you are looking at, as any map on any website would. Where: a service run from Hungary.
• If you report a problem, the Dukkan team reviews it and may share the substance of your report with the store concerned in order to resolve it. We do not share it beyond that.

Your data leaves the UAE. Dukkan has no servers in the UAE: the services that run it are hosted abroad. Our database is in Germany, our apps run in the Netherlands, our email goes out from Japan, and the other companies above work in the countries given for each. Most of them are US companies.

We do not share your data with anyone else without your consent, except where required by UAE law.

We use essential sign-in cookies only. They are set when you sign in to the store dashboard or the admin pages, to keep you signed in; your browser sends them to dukkan.market with each request, and we read them only to know who is signed in. We use no advertising cookies and no advertising trackers anywhere.

When Cloudflare checks a visitor it may set its own security cookie. It is needed to reach the site and is not used for advertising.

Our public pages — the home page, these policies, and the store sign-in and sign-up screens — load Umami, a privacy-focused analytics tool, to count visits. It sets no cookies and does not follow you between sites. It does not run on the ordering webview where customers shop, or on our admin pages. Your phone's WhatsApp client manages your identity there, and the catalog uses a signed token in the URL instead of cookies.

On your phone. The ordering page keeps a few things in your phone's browser storage, for your convenience: your checkout choices, the catalog layout you picked, which announcements and price notices you have closed, and, for 30 minutes, a draft of the notes you typed at checkout. They stay on your phone; nothing but the ordering page reads them.

Connecting a WhatsApp number. In the store dashboard, Settings, WhatsApp loads Facebook's script when an owner connects the store's own number, to run Meta's sign-up window. We have turned its automatic event reporting off. Meta's privacy policy covers what Meta collects in its window.

Separately, we keep our own record of what happened in the app (see “What we collect”), in our own database. It is never sold and never shared for advertising. When you delete your account it is unlinked from you and emptied, apart from the note of each catalog you opened (see “How long we keep it”).

Catalog and order history are kept as long as your account is active. Stores need order records for tax and bookkeeping purposes, typically five years under UAE rules.

If you delete your customer account (in Settings: open the Dukkan link from your WhatsApp chat, then Settings), we remove your personal information immediately: name, phone number, addresses, cart, conversation state and your reports. The contents of your WhatsApp messages are erased, and the record of what you did in the app is unlinked from you and emptied. Past orders are retained for the store's records but the personal details on them are scrubbed. A note of each time you opened a store's catalog is kept too, so the store's visit counts do not change: it holds the store, the time and a link to your emptied account, nothing else. A block a store placed on you is deleted with your account, together with any note the store added. Emails already sent are not recalled (see “What we collect”).

Store accounts: see “Shop owners and staff” in the next section.

Customers. Your settings open from the Dukkan link in your WhatsApp chat: open the link, then Settings. Opening dukkan.market on its own won't work: the page needs the link from WhatsApp to know who you are. From Settings you can:

• Export your data as JSON (Download my data).
• Delete your account from the same page. The effect is described in the "How long we keep it" section above.
• Correct your information — your name and your saved addresses — on the same Settings screen. Details already printed on a past order are part of the store's records; ask the store to change those.

To stop announcements on WhatsApp, reply STOP to any of them, or turn off Announcements on WhatsApp in Settings. Reply START to get them again.

Dukkan is not intended for people under 18. If you become aware that a minor has registered, please contact us and we will remove the account.

We use industry-standard precautions: HTTPS in transit, hashed passwords for staff accounts, and signed short-lived tokens for the customer webview. Everything is kept in one database that browsers and apps cannot query: every read and write goes through our own servers. Inside it, phone numbers and messages are stored as they are, not encrypted separately; the access token for a store's own WhatsApp number is. No system is perfectly secure; please use a unique password and tell us right away if you suspect your account has been compromised.

When we change this policy we change the version and the date at the top of the page. For material changes affecting stores, we will notify stores by email or a dashboard notice. The updated policy applies from that date; continued use of the platform after it means you accept it.

Privacy questions can be sent to info@dukkan.market. Postal mail can be addressed to Verstack For Marketing and PR L.L.C S.O.C, Office 101, Zalfa Building, Al Garhoud, Dubai, UAE.