Dukaa

Privacy Policy

Last updated: 27 August 2026

This policy applies to the Dukaa mobile application (Android package app.dukaa.mobile) and related websites and services at dukaa.co.za.

1. Who we are

Dukaa ("we", "our", or "us") provides inventory management, point of sale (POS), customer records, invoicing, quotations, expenses, and business reporting for small and medium businesses.

Operator contact details:

2. Scope and roles

This Privacy Policy explains how we collect, use, store, share, and delete information when you use Dukaa.

If you create a Dukaa account, we are the responsible party (controller) for your account details (such as your name, email, and phone number).

If you store customer, supplier, or staff records in Dukaa, your business is the responsible party for that information. We process it on your instructions to provide the Service. You must have a lawful basis (for example, consent or a contract) before entering other people's information into the app.

If you do not agree with this policy, do not use the Service.

3. Information we collect

3.1 Account and profile information

When you register or manage your profile, we collect:

3.2 Business information

You may provide:

3.3 Business operational data

To run inventory, POS, and accounting features, you may enter or generate:

3.4 Payment and subscription information

If you subscribe to a paid plan, billing is processed by a third-party payment provider (currently Paystack). We receive confirmation of payment status. We do not store full card numbers.

If you connect a payment gateway in the app (Paystack, Razorpay, or PayPal) so your customers can pay you, you provide API keys or similar credentials. Card and wallet payments are processed by that provider, not by Dukaa.

3.5 Device, technical, and notification data

When you use the app we may collect:

The Dukaa Android app does not include advertising SDKs and does not sell personal information. We do not use third-party advertising cookies in the mobile app.

3.6 Information you choose to share from the device

Depending on the feature you use, the app may access:

You can refuse or later revoke these permissions in your device settings. Some features (scanning, photo upload, Bluetooth printing) will not work without the related permission.

4. How we use information

We use information to:

We do not use your business or customer data to show third-party ads. We do not sell personal information.

5. Legal bases (South Africa and similar laws)

Where the Protection of Personal Information Act (POPIA) or similar laws apply, we process personal information because:

6. How we share information

We share information only as needed to run the Service:

These providers process data on our behalf or as independent controllers for their own sign-in or payment services. We do not share data with advertising networks.

7. Storage, security, and international transfers

Account and business data are stored on Google Firebase infrastructure. Copies may also be cached on your device for offline use. Sensitive credentials on the device are stored using the platform secure storage APIs.

We use measures such as:

No method of storage or transmission is completely secure. You are responsible for keeping your password and device locked, and for the accuracy of data you enter.

Firebase and other providers may process information in countries other than South Africa, including the United States. Where required, we rely on appropriate safeguards offered by those providers.

8. Retention and account deletion

We keep your information while your account is active and as needed to provide the Service. We may keep certain transaction records for longer where tax or accounting law requires it (often several years).

To request deletion of your account and associated personal information, email privacy@dukaa.co.za from the address on the account. We will delete or anonymise personal information within 30 days, except where we must retain records for law, disputes, or security (for example paid invoices).

After deletion, local caches on a device are removed when you uninstall the app or clear app data.

9. Your rights

Depending on applicable law (including POPIA), you may request to:

Send requests to privacy@dukaa.co.za. You may also lodge a complaint with the Information Regulator (South Africa) if you believe POPIA has been breached.

10. Children

Dukaa is a business tool. It is not directed at children under 18, and we do not knowingly collect personal information from children. If you believe a child has created an account, contact privacy@dukaa.co.za and we will delete it.

11. Website cookies

The dukaa.co.za website may use cookies or similar technologies that are needed for the site to work or to remember preferences. The mobile app does not use advertising cookies. You can control website cookies in your browser settings.

12. Changes to this policy

We may update this policy from time to time. We will post the updated policy at this URL and change the "Last updated" date. Material changes may also be notified in the app or by email. Continued use of the Service after an update means you accept the revised policy.

13. Contact

Questions about this policy or our data practices: