Last updated: October 2, 2026
Privacy policy
Dukanos is operated by DukanOS. This policy explains what personal data we collect when you use Dukanos, why, and the choices you have.
Who this policy covers
It covers merchants who open an account, the staff they invite, and visitors to this website. Shoppers who buy from a merchant's store are customers of that merchant: the merchant decides how their data is used, and we process it on the merchant's behalf.
What we collect
Account data: name, email, phone, password (stored hashed) and language. Business data: business name, country, tax and legal identifiers, products, stock, orders, invoices and the other records you enter. Shopper data entered through a store or WhatsApp: name, phone, address, city and order details. Technical data: IP address, browser, device and pages visited, kept in server logs.
How we use it
To run the service you signed up for: your store, orders, stock, invoices and reports. To send account emails such as verification, password reset and team invitations. To bill your subscription. To keep the platform secure and to fix problems. We do not sell personal data and we do not use your business data to advertise to you or to anyone else.
The WhatsApp assistant and AI
If a merchant turns on the WhatsApp assistant, incoming messages, voice notes and shared locations are sent to Google's Gemini service to understand the request and write a reply. The assistant only sees the merchant's catalog, stock, store details and that contact's recent orders. Messages are stored in the merchant's inbox so staff can read them and take over.
Who we share it with
Only with providers we need to run the service: our hosting provider, our email delivery provider, Google (Gemini) for the WhatsApp assistant, the WhatsApp connection the merchant chooses (Meta's Cloud API or an Evolution API server), Laravel Forge to issue certificates for custom domains, and Paddle.com, which processes subscription payments as our merchant of record. Each receives only what its task requires. We disclose data to authorities only when the law requires it.
Cookies
We use only the cookies the service needs to work: a session cookie to keep you signed in, a security token against forged requests, and your language and cart. We do not use advertising or third-party tracking cookies.
How long we keep it
We keep your data while your account is active. Invoices and accounting records are kept for as long as tax law in your country requires. When an account is closed, we delete or anonymise its data within 90 days, except records we must keep by law. Activity logs are cleaned automatically.
Your rights
You can see and correct most of your data in your account at any time. You can ask us for a copy of your data, to correct it, to delete it, or to stop a use you object to, by writing to the address below. Shoppers should contact the merchant they bought from first; we will help the merchant answer. You may also complain to the data protection authority in your country.
Security
Connections are encrypted with HTTPS, passwords are hashed, two-factor authentication is available for every account, and each business can only see its own data. Staff see only what their role allows. No system is perfectly secure; if a breach affects your data we will tell you without undue delay.
Changes to this policy
We will update this page when our practices change and change the date at the top. If a change is significant we will also tell account holders by email or in the app.
Questions about this page: hello@dukanos.com