Privacy Policy

1. Who we are

Daftar (registered in the Kingdom of Bahrain) is the company behind daftar.bh. When you sign up to run a business on Daftar, the data your own customers share with you sits on our servers, and you decide what's collected and how it's used, and we hold it safely on your behalf.

2. Our role, and yours

Two kinds of personal data live on Daftar, and they work differently:

• Your own account and business data. You are our customer, and we are responsible for this data as its controller.
• Your customers' and staff data · the names, orders and addresses your buyers share with you, and any employee records you keep in payroll. Here you are the controller and Daftar is only the processor: we hold and process it on your instructions, to run the tools you use. You decide what to collect and why, and you answer the privacy requests of your customers and staff · we help you meet them.

3. What data we collect

We collect only what we need to run the service:

• Account · your name, email, phone and login details.
• Business · your shop name, logo, products, prices, invoices and tax records.
• Identity and verification · to open an account we ask you to upload your ID (CPR) and passport, and your commercial registration (CR) where you have one, so we can confirm who you are and meet our legal and payment obligations. These are stored privately and used only for verification, fraud prevention and compliance.
• Customer and staff data you enter or your storefront collects · buyer names, contact details, orders and addresses, and, if you use payroll, your employees' records and documents (such as CPR, passport and contracts). This is your data · you decide what to store (see section 2).
• Payments · taken by our payment provider. We store the result of a payment (amount, status, a masked reference), never full card numbers.
• Technical · basic logs and device information we need to keep the service secure and working.

We do not run advertising trackers, and we do not build profiles of your customers.

4. Why we use your data

We use the data you give us to:

• Run your account and host your storefront.
• Create the invoices and tax records Bahrain law requires.
• Keep the platform secure and stop abuse.
• Reply to your support questions.

We don't sell your data, we don't share it with advertisers, and we don't use your customers' information to market anything to them on our own.

5. Who we share it with

We share data only with the service providers we need to run Daftar, under contract and only for that purpose:

• Payments · TAP, to take and settle payments.
• Hosting, database and content delivery · our cloud infrastructure providers, to store your data and serve the app.
• Email · our email delivery provider, to send receipts, reminders and support replies.
• Daftar AI · Anthropic, only when you turn AI on (see section 6).

Some of these providers are outside Bahrain, including in the United States. Where data crosses a border we rely on the transfer routes permitted under Bahrain's Personal Data Protection Law. A current list of our providers is available on request.

6. Daftar AI (optional)

Daftar AI is an optional assistant you can switch on to help run your back office · adding products, organizing categories, updating prices, writing descriptions, and reading back your own sales figures.

• It is off by default. Nothing is sent to any AI provider unless you turn it on, and you can turn it off again at any time in your settings.
• When it is on, the text of the request you type · together with the business data needed to answer it, such as your product list or sales totals · is sent to our AI provider, Anthropic, in the United States, to generate the reply. This is a cross-border transfer permitted under Bahrain's Personal Data Protection Law.
• Anthropic does not use your requests to train its models, and the chat is session-only · the conversation is not stored after you close it.
• Please avoid typing sensitive personal information · for example ID or card numbers · into the assistant.

7. How long we keep it

• Invoices and tax records · kept for at least 5 years, as Bahrain law requires, even after you delete a product or a customer.
• Identity and verification documents · kept while your account is open and for as long as the law requires us to, then deleted.
• Other account and business data · kept while your account is open, and deleted or anonymized within a reasonable period after you close it, unless the law requires us to keep it longer.
• Daftar AI chats · not stored · they are session-only.

8. Security

All data is encrypted in transit and at rest. Payment-gateway secrets are held under an extra encryption layer. We enforce per-account access control so one merchant can never see another merchant's data, and every sensitive change is recorded in an audit log.

9. Your rights

Under Bahrain's Personal Data Protection Law you can:

• ask for a copy of the personal data we hold about you,
• have it corrected if it is wrong,
• ask us to delete it, where we are not required to keep it (for example tax records),
• withdraw a consent you gave · such as turning Daftar AI off,
• ask for your data in a portable form,
• object to certain uses.

To exercise any of these, contact us and we will respond within the time the law allows. If you are a customer of a shop that runs on Daftar, please contact that shop first · they control their store's data, and we help them respond.

10. Complaints

If you think we have mishandled your data, please contact us first so we can put it right. You also have the right to complain to Bahrain's Personal Data Protection Authority.

11. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top tells you which version is current. Material changes are announced inside your dashboard before they take effect.

12. Contact

Privacy questions: contact us.