Privacy Policy
Last updated 28 October 2026. This is a plain-language draft that must be reviewed by a lawyer before launch.
Who is who
When a Customer orders from a Shop, the Shop decides what to do with that Customer's details, and Dukan Xpress processes them for the Shop. For Shops who sign up to Dukan Xpress, Dukan Xpress decides how the Shop owner's details are used.
What we collect
- Shop owners and staff: name, mobile number, shop name and address, and the shop's settings, products and orders.
- Customers: name, mobile number, email (optional), delivery address, order history, loyalty points and reviews, and whether they agreed to receive offers.
- Technical: IP address and device details used for security and to stop abuse, and short-lived sign-in codes (kept only as a one-way hash).
Why we use it
To run the shop and its orders, to sign you in, to send order and sign-in messages by WhatsApp, to keep the service safe, and to meet legal duties. Offers and marketing go only to Customers who agreed.
Payments
Card, UPI and netbanking payments are handled by the Shop's own payment provider (Cashfree). Dukan Xpress never sees card numbers, and we keep a Shop's payment keys encrypted.
Who sees it
Each shop can see only its own data: this is enforced by the database itself, not just by our code. We share data only with the services that run Dukan Xpress for you (hosting, WhatsApp delivery, email, payments) and when the law requires it. We do not sell personal information.
How long we keep it
While a shop is open, and after closure only as long as needed for legal, tax and dispute purposes. Sign-in codes expire in minutes.
Your rights
You can ask to see, correct or delete your personal information, and to stop offers at any time. Customers should ask the Shop first; you can also write to us at [email protected] and we will help.
Cookies
We use only the cookies needed to keep you signed in and to remember your cart. We do not use advertising cookies.
To show a shop owner how many people visit their shop and which pages they look at, we keep a simple count of visits, product views, carts and orders. It does not record your name, phone number or IP address, and it cannot be traced back to you: a visit is tied only to a scrambled code made from your browser session. Search-engine and other robots are not counted. These counts are deleted after about 13 months.
Security
We use encryption in transit, access limits, audit trails and regular backups. No system is perfect: if something goes wrong that affects you, we will tell you.