Privacy Policy
Last updated 3 September 2026
Duka ("we", "us") lets small merchants in Uganda create an online shop over WhatsApp and sell from it. This policy explains what we collect, why, and how to get it deleted. It covers both merchants who run a shop and shoppers who buy from one.
What we collect
We collect only what the service needs to work. We do not buy data about you from anyone else.
If you are a merchant
| Data | Why we hold it |
|---|---|
| Your WhatsApp phone number | It identifies your shop. It is how you sign in — we have no passwords. |
| Your shop name, category, chosen look and payment method | To build and display your shop. |
| Your delivery areas and their fees | To show shoppers what delivery costs. |
| Your products: names, descriptions, prices, options and photos | To display your shop. This is content you publish deliberately. |
| The messages you send our WhatsApp number | We store the message as WhatsApp delivers it to us, including your number, your WhatsApp profile name and the text, so that a message is never lost if our system is briefly unavailable. |
If you are a shopper
| Data | Why we hold it |
|---|---|
| Your name, phone number and delivery address | Given by you at checkout so the merchant can deliver your order. |
| What you ordered, and the price at the time | To create the order and keep an accurate record of it for you and the merchant. |
We do not take payments and we never see your card or mobile money details. You pay the merchant directly by the method shown on their shop.
Who can see your data
Each shop is isolated from every other shop. A merchant can only ever see their own shop's data and their own orders. This is enforced by the database itself, not only by our application code.
We share data with these parties, and no others:
- Meta Platforms (WhatsApp). Messages between you and us travel through WhatsApp and are handled under Meta's own privacy policy. We do not control WhatsApp.
- The merchant you ordered from, who receives your order details in order to deliver it.
- Our hosting provider, which stores the data on servers we control.
We do not sell your data, and we do not use it for advertising.
How long we keep it
- Shop and product data is kept while the shop exists, and deleted on request.
- Orders are kept as a commercial record for the merchant.
- Sign-in links expire within an hour of being issued and can be used once. We store only a one-way hash of the link, never the link itself.
- Raw WhatsApp messages are deleted 30 days after we have processed them, automatically.
- Order notifications sent to a merchant are deleted 30 days after sending. The order itself remains as the merchant's commercial record.
How we protect it
- All traffic is encrypted in transit (HTTPS).
- Shop data is separated at the database level, so one merchant's queries cannot return another merchant's rows even if our code has a bug.
- Sign-in links are stored only as a hash, so a copy of our database does not grant access.
- Data sent to and from WhatsApp forms is encrypted end to end with keys we hold privately.
Your rights
You can ask us to:
- tell you what data we hold about you;
- correct anything that is wrong;
- delete your data — see Delete my data;
- send you a copy of the data you gave us.
Write to barbarmawad20@gmail.com from the phone number or email you used, and we will respond within 30 days.
Children
This service is not intended for anyone under 18, and we do not knowingly collect their data. If you believe we have, contact us and we will delete it.
Changes
If we change this policy we will update the date at the top of this page. Significant changes affecting merchants will also be sent over WhatsApp.
Contact
Duka — barbarmawad20@gmail.com
Governed by the laws of Uganda.