Privacy policy

1. Who we are

Dripple is a marketplace for pre-loved fashion operating in Qatar. This policy explains what personal data we hold, why, and what you can ask us to do with it. It is written to reflect Qatar's Law No. 13 of 2016 on Personal Data Privacy Protection.

2. What we collect

• Account — email address, password (stored hashed by our authentication provider, never visible to us), username, and optionally your name, location and profile photo.
• Listings — item details and the photos you upload.
• Messages and offers — the content of chats and offers between buyers and sellers.
• Orders and delivery — what was bought, from whom, the delivery area, and timestamps of collection and delivery recorded by the courier.
• Seller bank details — account holder name, IBAN and bank, if you sell. We need these because sales are paid to you by bank transfer. We keep a record of when they are created or changed, with only the last four digits of the IBAN.
• Your agreement to our terms — which version you accepted and when, with the IP address and browser details sent at that moment, so we can show what you agreed to.
• Reports — if you report a listing or person, what you tell us.

We do not collect or store card numbers. Card payments are handled by our payment provider and never reach Dripple's systems.

3. Who can see it

Your username, profile details and active listings are public. Your email address is never shown publicly. Your bank details are visible only to you and to Dripple staff processing a payout — never to buyers or other sellers.

When you buy or sell, the other party sees your username and the delivery information needed to complete the order. A courier assigned to your parcel sees the item name, order reference and delivery area — not your contact details or payment information.

4. Who we share it with

• Our hosting and database providers (Vercel for the website, Supabase for the database and file storage), who store and process the data on our behalf.
• Our payment provider (Tap Payments, when purchasing opens), to take payment from buyers.
• Our email provider (Resend), to send account and order notifications. Account sign-in emails are sent through Supabase.
• The courier company delivering your parcel, limited to what they need to deliver it.
• Authorities, where the law requires it.

We do not sell personal data, and we do not use it for advertising.

4a. Where your data is processed

Our database is hosted in Tokyo, Japan, and our website is served from Vercel's global network, so your data is processed outside Qatar. We choose providers with recognised security practices and contractual commitments to protect personal data. If you do not accept this, please do not use the service.

5. How long we keep it

Account and listing data is kept while your account is open. Order, payment and payout records are kept afterwards where we are required to retain financial records. Deleting your account removes your profile and listings from public view; completed order history is retained for the parties involved and for our accounting obligations.

6. Your rights

You can download a copy of your data and delete your account yourself in Account settings, and change most details there too. Accounts with orders in progress or past orders cannot be deleted automatically because we must keep financial records; contact us and we will close and anonymise them. You can also ask us to correct anything inaccurate or to stop using your data in a way you object to. We respond within 30 days.

7. Security

Data is encrypted in transit. Access is restricted per account at the database level, so one user cannot read another's private data. Bank details are readable only by their owner and by staff processing a payout. No system is perfectly secure, and we will tell you promptly if a breach affects your data.

8. Contact

Questions about this policy or your data: contact Dripple.