Privacy Policy

1. Who we are and what this covers

Doline Store is made by Doline Systems of Kampala, Uganda ("we", "us"). This policy covers the Doline Store app on Android and Windows, the cloud service it syncs with, and Lilli, its built-in assistant. DolineMarket, our app for shoppers, has its own privacy policy.

Using Doline Store is also governed by our Terms of Service.

2. Two kinds of data, two roles

Your own data. The details of the people who sign in and run a store, the store itself, and how the app is used. For this we decide what is collected and why, so we are responsible for it as the data controller.

Data your business records about other people. Your customers, staff and suppliers. Your business decides what to record and why, so your business is the data controller and we process that data on its behalf, only to run Doline Store for you.

If you are a customer, staff member or supplier of a shop that uses Doline Store, contact that shop first about your information. We will help the shop answer you.

3. What we collect

We collect what you and your staff enter, what DolineMarket shoppers send with their orders, and a small amount of technical data the app needs to sync and send notifications.

We do not collect bank card or mobile-money credentials (the app records payments but does not process them), your phone's contacts, your device's location, advertising identifiers, or usage analytics. Camera images used to scan barcodes are processed on the device and not uploaded.

4. How we use it

We use personal data to run Doline Store and keep it safe, and for nothing else:

• Run the service: sign you in, keep your store's records, and sync them between your devices.
• DolineMarket: publish the store details and products you list, and pass shoppers' orders to your store.
• Notifications: tell you about new orders, reviews and stock, on your phones and computers.
• Lilli: answer your questions about your store and the app.
• Support: answer your messages and feedback, and fix problems you report.
• Security: detect and stop misuse, protect accounts, and keep the activity log of who did what.
• The law: meet legal obligations and respond to lawful requests from authorities.

We do not sell personal data, show advertising, or build profiles of you or your customers. We do not use your store's data to train AI models.

5. Our lawful bases

Under Uganda's Data Protection and Privacy Act, 2019, we rely on:

• Contract: to provide Doline Store under our Terms of Service, which covers most of section 4;
• Consent: for Google sign-in and push notifications. You can withdraw it in your Google account or your device's settings;
• Legitimate interests: keeping the service secure and preventing misuse, where those interests are not outweighed by yours;
• Legal obligation: where the law requires us to keep or disclose data.

For data your business records about other people, your business is responsible for having its own lawful basis (see our Terms of Service, section 5).

6. Who we share it with

We share personal data only with the service providers below, who process it for us to run Doline Store; with DolineMarket shoppers, for what you list; and where the law requires it.

Each provider handles the data under its own terms and privacy policy, linked above. We send each one only what it needs.

Lilli is optional. If you would rather your store's records did not go to an AI provider outside Uganda, do not ask Lilli about them. Everything else in Doline Store works without her.

We may also disclose personal data:

• to a court, the police or a regulator, when the law requires it;
• to protect people's safety, or our rights, when that is reasonably necessary;
• to a company that takes over Doline Store, which must then honour this policy. We will tell you first.

7. International transfers

Some of our providers process data outside Uganda, as the table above shows. When we transfer personal data abroad, we do so as the Data Protection and Privacy Act, 2019 allows: to providers bound by their own data-protection commitments, and only as needed to run Doline Store. By using Lilli, you ask for your messages and the records she looks up to be sent to our AI providers to answer you.

8. What stays on your devices

Doline Store keeps a full copy of your store's records on every device it runs on, so it works without an internet connection.

• Android: in the app's private storage, which other apps cannot read. It is not included in Google's device backups. Uninstalling the app deletes it.
• Windows: the database and photos are in a .doline folder in the Windows user's profile, and the sign-in session and app settings are in that user's part of the Windows registry. Uninstalling the app does not delete them. Delete the .doline folder to remove them.

Anyone who can use a device can see what the app shows on it. Lock your devices, give each staff member their own pass key, and use the app's automatic lock on shared tills.

9. How we keep data secure

• Data travels between the app and our cloud over encrypted connections (HTTPS).
• Our database provider encrypts stored data, and access rules in the database let an account reach only the stores it belongs to.
• Staff pass keys are stored only as salted hashes. Repeated wrong guesses lock the pass key for a while.
• Staff permissions control who can see costs, reports and settings. Admin approvals and sensitive actions are recorded in the activity log, which cannot be edited or cleared from the app.
• Only the Doline Systems people who need it for support or maintenance can reach production data.

No system is perfectly secure. If a breach puts your personal data at risk, we will tell you and the Personal Data Protection Office, as the law requires.

10. How long we keep data

We keep your store's data for as long as your account is open, because it is your business record.

• Deleted records: when you delete something, the cloud keeps a short marker that it was deleted, so your other devices remove it too.
• Activity log: kept for the life of the store, as its audit trail.
• Closed accounts: when you ask us to close your account, we delete its stores' data from our live systems within 90 days. Our database backups are overwritten on a rolling schedule after that.
• What we must keep: anything the law requires us to keep longer, or that we need for a legal claim, we keep only for that purpose and only as long as it requires.
• Your devices: data there stays until you delete it (section 8).

11. Your rights

Under Uganda's Data Protection and Privacy Act, 2019, you have the right to:

• know what personal data we hold about you, and get a copy;
• have it corrected if it is wrong or incomplete;
• have it deleted, where we have no lawful reason to keep it;
• object to how we use it, or ask us to stop;
• withdraw consent you gave, without affecting what happened before.

You can change most of your own details in the app, under Edit profile and the store's settings. There is not yet a button to delete an account in the app: email us from the address on the account and we will do it. We may ask you to confirm who you are before acting on a request, and we will answer within the time the law allows.

If you are a shop's customer, staff member or supplier, ask the shop first (section 2).

You can also complain to Uganda's Personal Data Protection Office. We would appreciate the chance to put things right first.

12. Children

Doline Store is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data about children through it. If you think a child's data has been entered, tell us and we will help remove it.

13. Messages we send

We send emails and notifications that the service needs: sign-in codes, order and stock notifications, and important changes to Doline Store, these terms or this policy. You can turn off most notifications in the app's settings or your device's settings. We do not send marketing messages unless you have agreed to receive them, and every one will tell you how to stop.

14. Changes to this policy

We will update this policy when Doline Store or the law changes. The date at the top shows the current version. If a change affects how we use your personal data, we will tell you in the app or by email before it takes effect.

15. Contact us