Privacy Policy
Last updated: August 6, 2026
1. Introduction
Qatar Shop ("we", "us", "our") operates a commerce platform that powers independent boutiques in Qatar — their online storefronts, WhatsApp and Instagram ordering, phone ordering, and back-office dashboards. This Privacy Policy explains what personal data we collect, why, who we share it with, where it is stored, and the rights you have over it. It applies to boutique customers (people who browse, message, call, or buy from a boutique powered by Qatar Shop) and to boutique operators (the businesses that subscribe to Qatar Shop).
We process personal data in line with Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016) and, where applicable, the platform policies of the messaging and payment providers we integrate with (Meta, SkipCash).
2. Our Role: Who Controls Your Data
Each boutique on Qatar Shop is an independent business and is the controller of its customers' data: your relationship is with the boutique you buy from, and only that boutique can see your orders, messages, and details. Qatar Shop processes that data on the boutique's behalf to run the storefront, messaging, and order systems. Boutiques are technically isolated from each other — one boutique can never see another boutique's customers.
For boutique operators' own account data (sign-in details, subscription and billing records) and for platform operations data (security logs, service analytics), Qatar Shop is the controller.
3. Information We Collect
From boutique customers:
- Identity and contact details — your name, phone number, and email address (if provided).
- Order and delivery information — items ordered, delivery address and zone, order history, payment method and payment status. Card details themselves are entered on SkipCash's secure pages — we never receive or store your card number.
- Messages — when you message a boutique on WhatsApp or Instagram, we receive the message content, your number or handle, and profile name, to understand and process your order.
- Phone calls — when you call a boutique's ordering line, the call is answered by an automated assistant and processed in real time to take your order. We store the resulting order or reservation details and call metadata (your number, time, duration); we do not keep audio recordings of your call.
- Reviews — review text, star rating, and any photos you choose to submit. Approved reviews (including photos) are displayed publicly on the boutique's product pages.
- Technical data — device and browser information, IP address, and request logs used for security, rate limiting, and troubleshooting.
From boutique operators:
- Account and sign-in data — name, email, phone; if you sign in with Google or Apple, we receive your name and email from them; passkeys are stored as public keys only.
- Business and billing data — store names, commercial details you provide, subscription plan, and payment records.
4. How We Use Your Information
- To process and fulfil your orders with the boutique you contacted, including delivery coordination.
- To send service messages about your order — confirmations, payment links, shipping and delivery updates, and replies to your questions — on WhatsApp, SMS, or email, using the contact details you provide at checkout or in chat.
- AI processing — messages you send a boutique are analysed by artificial-intelligence services to extract order details (products, sizes, address) and draft replies; phone calls are processed in real time by an AI voice assistant. AI output is used to prepare your order for the boutique's confirmation, and to generate service-quality insights for the boutique — such as labelling whether a conversation went well.
- Reminders and review requests — with your prior consent (the marketing checkbox at checkout), the boutique may send you an automated cart reminder or a review request (SMS or email). These are sent only if you agreed to receive them, and you can withdraw that consent at any time (see Section 6).
- Security and service operation — fraud and abuse prevention, rate limiting, debugging, and aggregate analytics to improve the platform.
- Legal compliance — keeping the commercial records Qatari law requires.
5. Legal Bases for Processing
We process personal data where it is necessary to perform the service you asked for (fulfilling an order you placed); where you have consented (messaging a boutique, submitting a review, opting in to marketing messages); where we have a legitimate purpose that does not override your rights (security, service improvement); and where the law requires it (commercial record-keeping). Where processing rests on consent, you may withdraw it at any time without affecting prior processing.
6. Marketing Messages and Opt-Out
The only automated marketing messages the platform sends are cart reminders and review requests on behalf of the boutique you interacted with — and they are sent only with your prior consent, which you give by ticking the marketing checkbox at checkout. Every such message names the boutique it is sent for and includes a way to stop. To withdraw your consent at any time: reply "STOP" (or "إيقاف") to an SMS, use the unsubscribe link in any marketing email, tell the boutique directly, or email us at the address in Section 15. We do not send platform-level advertising to boutique customers.
Order updates (confirmation, dispatch, delivery) are service messages, not marketing, and are sent to the phone number or email you provide with your order — on WhatsApp, SMS, or email. To stop automated WhatsApp order notifications, tell the boutique in the chat or email us and we will stop them for your number.
7. Who We Share Data With
We never sell personal data. Your information is shared with the specific boutique you interact with, and with the service providers below, who process data on our behalf under confidentiality and data-protection obligations, each only for its stated purpose:
- Supabase (database and file storage; hosted on AWS in Tokyo, Japan) — all platform data, including customer and order records.
- Vercel (website hosting and delivery; United States) — serves the storefronts and dashboards.
- Meta Platforms (WhatsApp Business API and Instagram messaging) — carries the messages between you and the boutique.
- SkipCash (payment processing; Qatar) — processes card payments; receives your name, contact details, and order amount.
- Twilio (SMS and telephony; United States) — delivers SMS and connects phone-ordering calls; receives phone numbers and message/call content.
- Anthropic (AI processing; United States) — analyses order messages to extract order details and to assess conversation quality for the boutique's dashboard.
- OpenAI (AI voice processing; United States) — powers the real-time voice ordering assistant.
- Resend (transactional email; United States) — sends order and account emails.
- Sentry (error monitoring; United States) and PostHog (service analytics; United States) — receive technical logs and usage events so we can fix problems and improve the service.
- Upstash and Inngest (infrastructure: rate limiting and background jobs; United States) — process request identifiers and job payloads needed to run the service.
- Google and Apple (operator sign-in only) — if a boutique operator signs in with them.
We may also disclose data where Qatari law or a competent authority requires it, or to protect the rights, safety, or property of Qatar Shop, boutiques, or users.
8. International Data Transfers
Our infrastructure providers store and process data outside Qatar — primarily in Japan (database and files) and the United States (hosting, AI, communications, monitoring), as listed in Section 7. Wherever data travels, it is protected by encryption in transit, strict access controls, per-boutique isolation, and contractual confidentiality and data-protection commitments from each provider. By using the service you acknowledge these transfers; they are necessary to provide the service described in this policy.
9. Cookies and Local Storage
We use a small set of functional cookies only — no advertising or cross-site tracking cookies:
- qshop-lang — remembers your language choice (English/Arabic).
- qshop-cart-session — keeps your shopping cart while you browse.
- qshop-customer-session — keeps you signed in to your customer account (if you create one).
- qsc — remembers your preferred display currency on a boutique's storefront (for example QAR or USD).
- Operator sign-in cookies — keep boutique operators signed in to their dashboard.
The dashboard also stores interface preferences (sidebar state, dark mode) in your browser's local storage. Blocking cookies may prevent the cart and sign-in from working.
10. Security
We protect data with encryption in transit (HTTPS everywhere), database-level row isolation between boutiques enforced on every query, role-based access controls, verified payment webhooks, rate limiting, and audit logging of sensitive operations. No system is perfectly secure, but security is engineered into the platform and reviewed continuously; if a breach affecting your personal data occurs, we will notify affected users and the competent authority as required by Qatari law.
11. Data Retention
We keep personal data while it is needed to serve you: your cart while it is active, your account while it exists, and your order history so the boutique can support you. On a verified deletion request we delete or pseudonymise your data as described on our Data Deletion page. Records of completed purchases are retained for the period Qatari commercial and tax law requires (currently up to ten years for commercial books under Commercial Law No. 27 of 2006) — those records are pseudonymised on deletion so they no longer identify you. When a boutique cancels its subscription, its data remains exportable for 30 days and is then scheduled for deletion.
12. Your Rights
Under Qatari data-protection law you have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct inaccurate or incomplete data.
- Delete your data (see our Data Deletion page for the exact process and what must be retained).
- Object to or restrict certain processing, and withdraw consent where processing rests on it.
- Opt out of automated reminder and review messages (Section 6).
To exercise any right, contact us at the email in Section 15 (or ask your boutique, who can raise it with us). We will verify your identity and respond within 30 days. You also have the right to lodge a complaint with the competent data-protection authority in Qatar.
13. Children
The service is intended for adults (18+). Minors may use it only with a parent's or guardian's consent, and that parent or guardian is responsible for the account, its orders and messaging, and the data provided. Boutiques may sell products for children, but the buying relationship must be operated by the responsible adult. We do not knowingly collect personal data from children without such consent; if you believe a child has provided us data without it, contact us and we will delete it.
14. Changes to This Policy
We may update this policy as the service evolves. The "Last updated" date at the top always reflects the current version, and material changes will be announced on the platform before they take effect.
15. Contact
For any privacy question or request, contact our privacy team at the address below. Please write from the email or phone number linked to your account so we can verify you.