Privacy Policy

1. Who we are and what this policy covers

1.1 Storedoor is operated by the company identified in section 19, referred to in this policy as "Storedoor", "we" or "us". Our website is storedoor.ai. Privacy enquiries should be sent to .

1.2 This policy concerns personal data processed in connection with Storedoor's Qatar service, including our public website, merchant accounts, hosted stores, point-of-sale functions and related applications and support where provided. Personal data is information relating to an identified or reasonably identifiable individual.

1.3 A merchant operates its own business and must publish its own privacy policy and other store policies. This policy explains Storedoor's processing; it does not replace the merchant's notice, make us the seller of its products or release either party from its own legal duties.

2. Our roles and the merchant's role

2.1 A controller determines the purposes and means of processing. A processor processes personal data for a controller. Roles are determined by the actual activity, not merely by a contractual label.

2.2 Storedoor acts as a controller for its own merchant account administration, subscription billing, business verification, communications, security, compliance, website administration and handling of claims. This may involve merchant representatives, authorised users, visitors and other persons contacting us.

2.3 A merchant generally acts as controller for Customer, prospect, employee, driver, supplier and other personal data used to operate its business. Storedoor acts as processor when hosting and handling that data on the merchant's lawful instructions to provide the relevant tools. Employment and driver records do not become Storedoor's own employment records merely because they are hosted on the Platform.

2.4 For particular payment, security, abuse-prevention or legal-compliance activities, Storedoor may process relevant Customer or transaction data as a controller for its own disclosed purposes. Payment providers, banks, carriers or other recipients may also act as independent controllers under their applicable arrangements. Not every recipient is our sub-processor.

2.5 For data controlled by a merchant, contact that merchant first. You may also contact if the responsible party is unclear or the request concerns our own processing. We will assess requests according to our role and applicable duties; this referral does not exclude your rights against Storedoor where they apply.

3. Information from merchants and authorised users

3.1 Depending on the service and information provided, we process:

• Names, business roles, email addresses, telephone numbers, preferred language and business contact details.
• Company registration and licensing information, activity details, document numbers, validity dates and supporting verification documents requested for the relevant business type.
• Identity and authority information about representatives or authorised persons where needed for verification, including identity-document images when specifically requested through the designated process.
• Account identifiers, password hashes, authentication and session records, roles, permissions and security settings.
• Plan and subscription history, invoices, payment references, relevant payment-method metadata, payout-bank details and balance or settlement records.
• Staff, driver, supplier and business-contact records submitted by the merchant, according to the functions it uses.
• Support enquiries, replies, attachments, complaints and correspondence.

3.2 Verification documents are collected for verification and related security, compliance or dispute purposes. Supplying a document for this purpose does not authorise its publication as a Store page. Do not place personal identity documents in public content or ordinary support messages when a designated secure submission route is provided.

3.3 If account control or business authority is disputed, we may process relevant authorisation records, business documents, correspondence and competent-authority decisions to verify who may act for the account and protect it from unauthorised changes. Requests are limited to information relevant to the issue; do not submit unrelated personal records.

4. Customer and store-operation information

4.1 When a merchant uses the relevant functions, we process information such as Customer names, contact details, accounts, delivery addresses and address coordinates, order contents and history, amounts, payment status and references, returns and refunds, cart identifiers, reviews, loyalty balances, coupon use and recorded communication preferences or subscriptions.

4.2 Delivery functions may involve recipient details, pickup and delivery addresses, assignment to a driver, status changes, timestamps, cash-collection records, delivery notes and proof-of-delivery photographs. Merchants and drivers must avoid unnecessary images of people, identity documents or private surroundings.

4.3 Information may also be included in product enquiries, store forms, support exchanges, uploaded documents or business records. The merchant must limit collection to what is relevant and lawful and describe its collection accurately to affected individuals.

4.4 Content intentionally published by a merchant, and reviews or other material published under the relevant feature, may be visible to visitors and search engines. Information already copied by independent third parties may not disappear immediately when removed from a Store. This does not remove applicable deletion or other legal duties.

5. Technical data and sources

5.1 Service operation may generate IP addresses, browser and device information, session identifiers, access and security logs, relevant activity events, error records, communication-delivery results and AI or SMS usage records. Mobile notification functions may use a device notification token and delivery status.

5.2 We receive data from you, authorised users, Customers, the merchant and service providers. Examples include payment outcomes and references, delivery updates and message-delivery results. If a third-party sign-in feature is used, the relevant identity provider supplies the account information authorised in that flow.

5.3 Payment-card entry is handled through the relevant provider's payment flow. Storedoor uses payment references, tokens or limited metadata needed for billing and reconciliation; it does not require full card numbers or card security codes in Store forms, uploads or support correspondence. Never submit them through those channels.

5.4 Device permissions, such as camera access for delivery proof or notification permission, relate to the feature requesting them. You can manage them through the device's settings; disabling a permission may prevent the relevant function from operating.

6. Purposes and lawful processing

6.1 We process relevant data to create and administer accounts, provide the selected services, host Stores, verify businesses, authenticate users, administer subscriptions and credits, collect payments, reconcile and settle amounts, provide support and deliver service communications.

6.2 We also process proportionate information to maintain and secure the service, diagnose faults, understand service usage, prevent or investigate misuse, manage complaints and payment disputes, maintain required records, comply with lawful requests and establish or defend legal claims.

6.3 Processing is based on consent where required, or on necessity for a legitimate purpose recognised under applicable Qatari law, such as providing the requested service or meeting a legal obligation. We assess the purpose and applicable requirements for each activity. Contract acceptance is not blanket consent to unrelated processing or marketing.

6.4 Data handled for a merchant is processed under its documented lawful instructions and our processing terms, except where a legal requirement applies. For our separate controller activities, we use only information relevant to the purposes described here. We do not sell personal data or disclose it to third parties for their unrelated direct marketing.

6.5 Optional consent may be withdrawn, subject to any separate lawful reason for continued processing. Withholding information necessary for verification, account operation or a requested transaction may prevent that service from being provided. Withdrawal does not retrospectively invalidate lawful processing already performed.

6.6 For complaints, payment disputes and claims, relevant information may include the Order, invoice, purchase terms, fulfilment evidence and related communications. We use and disclose only information needed for the relevant review, including to the merchant, payment provider or competent authority where lawful. A dispute does not justify collecting unrelated identity documents or disclosing another person's unnecessary personal details.

7. Marketing and service communications

7.1 Storedoor's electronic direct marketing to individuals requires prior consent as required by Qatari law. Marketing identifies the sender and its purpose and provides an accessible way to stop further marketing or withdraw consent. You may also contact .

7.2 Essential account, security, billing or transaction messages are distinct from marketing and may remain necessary after a marketing opt-out. Their content must remain appropriate to their service purpose.

7.3 Merchants are responsible for lawful messaging for their businesses, including notices, consent records and opt-outs. A marketing preference given to one merchant is not permission for unrelated merchants to contact you.

8. Cookies, local storage and similar technologies

8.1 The service uses cookies and similar device storage for functions such as authentication, security, shopping carts and preferences. Some are necessary to deliver a requested function. Device storage can contain identifiers without containing your name.

8.2 We use analytics and advertising technologies to understand how our website is used and to measure our marketing. They may collect device identifiers and interaction information and transmit it to their providers, on the basis permitted by law. Merchants must provide appropriate disclosures and controls for tracking they introduce into their Stores.

8.3 You can manage browser storage through browser settings. Blocking or deleting it may sign you out, remove preferences or affect cart functions. Browser settings alone are not a substitute for any consent mechanism the law requires us or a merchant to provide.

9. AI tools

9.1 When a relevant feature is used, the submitted prompts, text, images or other input are sent to the provider of the AI service. We may retain feature requests, outputs, usage or error information where needed for the requested service, support, security and metering, subject to the retention rules below.

9.2 Do not enter Customer records, identity documents, confidential material or other unnecessary personal data into AI tools. You must have authority for the material you submit. AI outputs require review before publication and may themselves contain inaccurate information about a person.

9.3 Provider processing, location and retention depend on the service and contract in use. No claim that inputs are never retained or never used for provider model improvement should be inferred from this policy.

9.4 By using AI tools or any AI-powered feature, you agree that the content you submit is sent for automated processing for that purpose. AI can make mistakes: its output may be inaccurate, incomplete or unsuitable, so review it before you use or publish it.

10. Recipients and service providers

10.1 Information is shared as needed for the relevant feature and purpose. Access is limited by role and legitimate need. Recipients may include providers of payment processing, text messaging, AI services, network security and content delivery, mobile notifications and order delivery, each receiving only the information needed for its service.

10.2 Providers acting on our behalf are subject to obligations appropriate to their role and applicable law. Where a recipient acts as an independent controller, its own privacy notice also applies to that processing. The merchant may authorise its staff and integrations to access data within the permissions granted; it is responsible for the lawfulness of that access.

10.3 We may disclose relevant information to professional advisers under appropriate confidentiality, to competent authorities where legally required or otherwise lawfully justified, and when necessary and proportionate to investigate fraud, protect rights or handle claims. A request alone does not authorise unlimited disclosure.

10.4 A merger, restructuring or transfer of the business may involve proportionate disclosure to a prospective or actual successor, subject to confidentiality, an appropriate legal basis and applicable notice requirements. Personal data does not become available for unrestricted use because the business changes hands.

10.5 Material changes to relevant processing or providers will be reflected in notices and processing arrangements as required by law. Any legally required sub-processor notice or objection procedure is preserved.

11. Processing locations and international transfers

11.1 A Qatar account or regional service label does not by itself mean that all data processing occurs within Qatar. Information about processing recipients, purposes and applicable transfer safeguards is provided to the extent required by applicable law; disclosure does not extend to confidential infrastructure or security details that are unnecessary for that purpose.

11.2 Some providers operate internationally, and processing or support access may occur outside Qatar. Transfers remain subject to applicable Qatari requirements, assessment of the relevant processing and suitable contractual, technical and organisational safeguards. We do not rely solely on a merchant's acceptance of these Terms to waive those requirements.

11.3 You may ask about relevant locations, recipients and safeguards. Special-nature data and other regulated processing may require additional permissions or restrictions; an ordinary service subscription does not satisfy those requirements by itself.

12. Data retention and deletion

12.1 We retain personal data for the period necessary for its identified lawful purpose, taking account of the service relationship, legal recordkeeping, payment disputes, complaints, security needs and applicable limitation periods. Account closure does not necessarily require immediate deletion of every record, and does not justify indefinite retention.

12.2 The following distinctions apply:

• Account and merchant business data: Service provision and any defined post-closure arrangements, subject to lawful retention needs
• Verification documents and review records: Verification, relevant compliance and justified dispute or audit needs; unnecessary copies should be removed
• Financial and transaction records: Applicable accounting, tax, payment and dispute requirements
• Customer and staff records handled for a merchant: Its lawful instructions and service arrangements, subject to mandatory retention
• Support correspondence and incident records: Resolving the matter and a justified period for follow-up or claims
• Access, security and usage records: A defined period proportionate to the relevant operational or security purpose
• Marketing contacts and preferences: While authorised; minimum suppression records may remain to honour an opt-out
• Backups: A defined rotation period with restricted use; valid legal holds may affect deletion

12.3 Where data must remain for a legal hold or another justified purpose, access and use should be limited to that purpose. Where data is restored from backup, applicable deletion requirements must be addressed. Properly anonymised data that no longer identifies an individual may be retained for statistical purposes.

13. Security and access

13.1 We apply technical, organisational and administrative measures appropriate to the nature of the data and processing risks. Relevant measures include access permissions, protected connections, password hashing, controls separating merchant records and logging of relevant activity. These measures reduce risk; they are not a guarantee against every unauthorised access, loss or incident.

13.2 Authorised personnel and service providers may access information for support, operation, verification, security or compliance where necessary for their role. Access is subject to appropriate restrictions and confidentiality. A merchant's authorised users may access information according to the permissions it grants.

13.3 Users must protect credentials, manage account permissions and report suspected compromise. These responsibilities do not remove Storedoor's statutory security obligations. Do not send passwords, card security codes or unnecessary identity documents in ordinary correspondence.

14. Personal-data incidents

14.1 If an incident affects personal data, we assess the circumstances and take appropriate containment, investigation and remedial steps. We notify affected controllers, individuals and competent authorities as required by our role, applicable law and relevant processing arrangements, within the required timeframes.

14.2 Merchants must promptly report suspected incidents involving Platform data to , preserve relevant information and cooperate. Merchants remain responsible for notifications required of them as controllers. Not every technical interruption is a personal-data breach, and a notification will reflect the information reasonably available at that stage.

15. Individual rights and requests

15.1 Subject to applicable Qatari law and its conditions or exceptions, you may request information about processing and recipients, access to and a copy of your personal data, correction of inaccurate data, deletion where no lawful purpose remains, withdrawal of consent, and objection in the circumstances recognised by law. You may stop electronic direct marketing as described in section 7.

15.2 Send requests concerning Storedoor's controller activities to , stating the relevant account or interaction and the action requested. We may ask for proportionate identity or authority evidence to protect the data. Do not send excessive identification information before it is requested.

15.3 For merchant-controlled data, contact the merchant or ask us to clarify the appropriate route. Where acting as processor, we assist and refer requests in accordance with lawful instructions and our legal obligations. This does not allow us to ignore a request concerning our own processing.

15.4 We respond within the period applicable under law. A request may be limited by lawful retention, another person's rights or a statutory exception. Where permitted and required, we explain the basis for a refusal or limitation. Account deletion and deletion of all related financial or legal records are not necessarily the same action.

16. Children and data of a special nature

16.1 Merchant subscriptions are intended for adults with legal capacity. That does not mean that a merchant's Customers or records can never concern a child. Merchants must assess their audience and the data they collect and comply with applicable requirements concerning children and guardian consent.

16.2 Do not use the service to collect or process special-nature personal data unless the relevant use has been expressly agreed with Storedoor and all legally required permissions and safeguards are in place. Under Qatari law this may include data concerning children, ethnic origin, health or physical or psychological condition, religious beliefs, marital relations or criminal offences.

16.3 Ordinary business verification does not authorise collecting unrelated special-nature data. If you believe such information or a child's data has been collected unlawfully, contact . We will assess our role and applicable requirements, including restriction, deletion or lawful retention where appropriate; we do not promise automatic deletion of every record regardless of legal obligations.

17. Merchant policies and external websites

17.1 Each merchant must publish and maintain its own privacy policy and explain its collection, purposes, sharing, retention, marketing and rights-handling arrangements. It is responsible for the lawfulness and accuracy of that policy and for implementing it. A template or default page supplied by Storedoor does not transfer that responsibility.

17.2 Links, merchant-added content and external services may lead to processing governed by another party's notice. Review that notice before providing information. We do not endorse a third party's practices merely by providing a technical link, but remain accountable for our own processing and legally required provider oversight.

17.3 Merchants are responsible for lawful access to, use of and protection of personal data they download, export or share outside the Platform, including staff permissions and their choice of recipients. Availability of an export or integration tool does not itself authorise a new use or disclosure. This does not remove Storedoor's responsibility for its own processing.

18. Complaints, updates and language

18.1 Contact with privacy concerns. You may also complain to the competent Qatari data protection authority, currently the National Cyber Security Agency, National Data Privacy Office, through its published channels. Contacting us first does not remove any right to approach the authority directly.

18.2 We may update this policy and identify its effective date. Material changes will be communicated through an appropriate channel, such as the website, account email or dashboard. Where a new purpose requires consent or another legal step, publication of an updated policy alone does not satisfy that requirement.

18.3 This Qatar policy is interpreted under applicable Qatari law. It does not limit statutory rights or regulatory jurisdiction. It is issued in English and Arabic, and the Arabic text prevails in the event of conflict or a difference in interpretation.

19. Contact details

19.1 Email: . Telephone: +97430503010. Website: storedoor.ai.

19.2 Company: Store Door for Custom Software Programming, W.L.L., commercial registration 250827, State of Qatar. Registered address: Rafale Tower, Office 9, Floor 9, Building 12, Street 325, Zone 69, Lusail, State of Qatar.