1. Who we are
Dokkani (دكّاني) is an online store platform run by Ayman Attili, a sole proprietor based in Ramallah, Palestine (“Dokkani”, “we” or “us” in this policy). We give shop owners (“merchants” or “stores”) an online store at its own address, an admin panel to manage products and orders, and tools for delivery, payment and notifications.
This policy explains how we handle personal data when you visit our website dokkani.ps, request a store, buy from a store built on Dokkani, or work in a store’s admin panel.
2. Our role and the store’s role
When you order from a store on Dokkani, the store is the seller and is responsible for your data: it decides how the data is used to prepare and deliver your order (it is the “controller”). Dokkani processes that data on the store’s behalf and on its instructions, to run the store and send order messages (a “processor”). A store may have its own privacy policy; for questions about a specific order, contact the store first.
Dokkani is the controller for: merchant and staff account data, store requests sent through our website, and the technical data we need to secure and operate the platform.
3. Data we collect
Shoppers (on behalf of the store)
- Mobile number: to sign in and verify your order with a one-time code sent on WhatsApp (or by SMS where enabled), and to send order updates.
- Your name, and your email address if you give it.
- Delivery address: city, area, a landmark description, and an optional map pin (only if you tap “use my location” and allow it in your browser).
- Order details: products, quantities, prices, discounts, delivery fee, notes and order status.
- Payment method: cash on delivery or bank transfer. For bank transfers, the receipt image you upload. We don’t collect card numbers.
- The language of the page you ordered from, so we message you in it.
Store owners and staff
- Name, email, mobile number, password (stored as a one-way hash), two-factor authentication settings and recovery codes.
- Store data: name, address, settings, products, images and content, and a log of important actions in the admin panel (such as publishing and settings changes).
- Plan, subscription and billing details.
- If a store connects its own WhatsApp Business number (through Meta’s sign-up window): the WhatsApp Business Account (WABA) ID, phone number ID, display number, verified name, the number’s quality rating, message template statuses, and the access token Meta gives us (stored encrypted). We don’t read the store’s chats or contacts.
Store requests on our website
When you fill in the store request form: your name, WhatsApp number, store name, city, what you sell, where you sell today, a rough product count, any note you write, the page language, and the IP address the request came from.
Technical data
IP address, browser type and the requested page appear in our server logs. We use them for security, to limit attempts (for example the number of verification codes per number and per IP address) and to fix problems. We also keep the status of WhatsApp messages (sent, delivered, read, failed) with the phone number mostly masked.
5. How we use data
- Fulfilling orders on the store’s behalf: showing the order to the store, delivery and the order tracking page.
- Verifying your mobile number with one-time codes.
- Sending order notifications on WhatsApp through Meta’s WhatsApp Cloud API: order received, confirmed, out for delivery and delivered, bank-transfer reminders and receipt issues, and new-order alerts to the store owner. Messages are sent from Dokkani’s WhatsApp number on behalf of the store and in its name, or from the store’s own number if it connected one. We only send messages about your orders and account, never marketing.
- Managing a store’s connected WhatsApp number only as far as order messages need: adding our order-message templates to the store’s account and tracking Meta’s approval, subscribing to message-status notifications, and showing the number and its quality in the admin panel. The store owner can disconnect the number at any time.
- Account security: sign-in, two-factor authentication, and password reset by email or WhatsApp.
- Answering store requests and setting up new stores.
- Preventing fraud and abuse, such as limiting attempts and blocking spam requests.
- Operating and maintaining the platform, making backups and fixing faults.
- Complying with the law and binding official requests.
We don’t sell personal data, we don’t use stores’ customer data to market our own services, and we don’t share it between stores: each store has its own separate database.
Where laws such as the EU General Data Protection Regulation (GDPR) apply, we rely on: performing a contract (orders and accounts), legitimate interests (security, fraud prevention and improving the service), legal obligations, and your consent where we ask for it (such as the map pin).
7. International transfers
Our servers are in Germany (European Union), and some of the providers above (such as Cloudflare and Meta) process data in other countries, including the United States. Your data may therefore be transferred outside Palestine. We choose providers that commit to contractual protections for personal data (such as standard contractual clauses where applicable), and we send them only what is needed.
8. How long we keep data
- Orders and invoices: while the store runs on Dokkani, and after that as long as the store needs them for its accounts and legal obligations. When a customer’s data is deleted, their orders stay in the store’s records but without their name, number, landmark, map pin or notes.
- Customer profile and saved addresses: until you or the store ask for deletion, or the store closes.
- Transfer receipt images: with the order in private storage; deleted when the customer’s or the store’s data is deleted.
- Verification codes: expire after 5 minutes and work only once.
- Server logs: rotated automatically and normally kept no longer than 30 days.
- Store requests from our website: as long as needed to follow up with you. If no store is created, we delete them within 12 months, or sooner if you ask.
- A store’s connected WhatsApp number: while it stays connected. When it is disconnected we delete the access token immediately and unsubscribe from the store’s WhatsApp account; the number and name stay in the store’s records until the store’s data is deleted.
- Merchant accounts: while the account is active, then as described in the Data Deletion Instructions.
- Backups: a daily copy kept for 15 days and a weekly copy kept for about 8 weeks, then deleted automatically. Deleted data may remain in backups until they expire.
9. Your rights
You can ask to: see your data and get a copy of it, correct it, delete it, and object to or restrict a particular use of it. We offer these rights to all users, including where laws such as the GDPR apply.
- Store customers: contact the store directly; the store owner can export or delete your data from the admin panel. Or email us at help@dokkani.ps with the mobile number you used and the store’s name; we’ll confirm the number is yours with a one-time code, then coordinate with the store.
- Store owners and staff: update your details in the admin panel, or email us at help@dokkani.ps.
We answer requests within 30 days. Detailed deletion steps are in the Data Deletion Instructions. You can also complain to the data protection authority in your country, where there is one.
10. How we protect data
- Encrypted connections (HTTPS) on every store and admin panel.
- A separate database for each store, its own file space, and tests that stop any store from reaching another store’s data.
- Transfer receipts in private storage with no public link, visible only to the store’s authorised staff.
- Two-factor authentication for store staff and the Dokkani team, hashed passwords, and a temporary lock after repeated wrong attempts.
- Verification codes stored hashed, expiring in 5 minutes, with limits per number and per IP address.
- A strict content security policy on stores, restricted server access, and a log of important admin actions.
No system is completely secure. If a breach affects your data, we will tell the affected stores and people without undue delay, and as the law requires.
11. Children
Dokkani is not directed at people under 18, and we don’t knowingly collect their data. If you know a child has given us their data, email us at help@dokkani.ps and we will delete it.
12. Changes to this policy
We may update this policy when the service or the law changes. We publish the new version here with its update date, and for important changes we tell store owners by email or WhatsApp before they take effect.
13. Contact us
Dokkani — Ayman Attili, Ramallah, Palestine. For any privacy question or request about your data: help@dokkani.ps.