Privacy policy

1. Who we are

Dodoce (hereinafter “Dodoce”, “we”) is the controller of the data described in this policy. Contact: suporte@dodoce.com.

2. Data we collect

We collect the following data, depending on your role:

• Registered users (Tenants): email, name and Auth0 identifier (obtained at sign-up). Slug, name, brand, logo, contact details (email, WhatsApp, address), opening hours and product catalogue (name, price, description, photos).
• End customers who place an order: name, phone number, delivery address, personalisation notes, and email if they choose to receive a confirmation (optional field).
• Anonymous visitors: aggregated traffic data via Cloudflare Web Analytics in cookieless mode — no individual identification, no sharing with advertisers.

3. What we use it for

• Providing the service — publishing the shopfront, receiving orders, notifying the Tenant and the customer by email;
• Support and operational communication (replies to messages sent to suporte@dodoce.com, essential technical notices);
• Security — detecting abuse, enforcing traffic limits, providing audit logs in investigations;
• Complying with legal obligations (invoicing, GDPR, requests from authorities).

We do not carry out direct marketing without consent and we do not sell data to third parties.

4. Legal basis (Art. 6 GDPR)

• Performance of a contract (Art. 6(1)(b)) — Tenant and order data;
• Consent (Art. 6(1)(a)) — the end customer’s optional email for order confirmation;
• Legitimate interests (Art. 6(1)(f)) — security logs, fraud prevention, aggregated analytics;
• Legal obligation (Art. 6(1)(c)) — retention of tax documents.

5. Sub-processors

We use the following providers to deliver the service. Some are outside the European Union; in those cases, the transfer relies on the mechanisms provided for in the GDPR, such as the European Commission’s standard contractual clauses or an adequacy decision.

• Auth0 by Okta (United States, tenant in the US region) — user authentication; transfer under the European Commission’s standard contractual clauses signed with Okta;
• Cloudflare, Inc. (data served mostly from European PoPs) — Workers hosting, D1 database, R2 storage (photos), transactional email, WAF, Turnstile protection and cookieless visit statistics (Web Analytics);
• Stripe Payments Europe, Ltd. (Ireland; part of Stripe, Inc., United States) — payment of Dodoce subscriptions: the shop’s billing name or company name, email, address and tax number, and the payment history. Card or IBAN details are collected and stored only by Stripe, never by Dodoce; transfers to the US under the European Commission’s standard contractual clauses and the EU-US Data Privacy Framework;
• Push notification services from Google (Firebase Cloud Messaging), Apple and Mozilla — only for those who turn on notifications in the dashboard; they receive the device identifier and the encrypted content of each notification;
• Unsplash (USA) — some sample images and default banners are loaded from Unsplash’s servers; when they are shown, the visitor’s browser sends them its IP address, as with any external image;
• GitHub (Microsoft, USA) — code repository and CI/CD.

WhatsApp (Meta) is not a Dodoce sub-processor: the order message is sent by the customer themselves, from their own WhatsApp app, and is subject to that app’s privacy policy.

6. Retention

• Active account — for as long as the account exists;
• After voluntary deletion (/definicoes/apagar-conta) — data deleted immediately from the production database. Automatic infrastructure backups may retain data for up to 30 days, after which it is permanently deleted;
• Orders — kept for as long as the account exists and deleted with it. Keeping sales records for tax purposes is each shop’s responsibility; shops can export them as CSV before deleting their account;
• Security and audit logs — 90 days.

7. Your rights

You can exercise the following rights at any time:

• Access and portability — export your data as JSON at /definicoes/exportar-dados;
• Rectification — edit your brand, products and contact details in the dashboard;
• Erasure — /definicoes/apagar-conta;
• Restriction and objection — request it by email at suporte@dodoce.com;
• Withdrawing consent — remove the optional email from the order form at any time.

You can also lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the supervisory authority in Portugal.

8. Cookies

We do not use tracking, advertising or analytics cookies. The only cookies we set are strictly necessary for the service to work:

• Auth0 and Dodoce session — keeping you signed in to the dashboard (admin.dodoce.com) and completing sign-in securely;
• Language preference — remembering your language (NEXT_LOCALE).

Strictly necessary cookies are exempt from consent under Article 5(3) of the ePrivacy Directive.

9. Security

We apply technical and organisational measures in line with Art. 32 GDPR: mandatory HTTPS, isolation of each shop’s data in every database query, strong authentication via Auth0, WAF and rate limiting via Cloudflare, credential rotation, and audit logs of critical actions.

10. Data subjects in Brazil (LGPD)

If you are in Brazil, this policy also applies under the Brazilian General Data Protection Law (Law No. 13,709/2018 — LGPD).

• Legal bases (Art. 7 LGPD) — performance of a contract (item V), consent (item I) for the end customer’s optional email, legitimate interest (item IX) for security and fraud prevention, and compliance with a legal obligation (item II);
• Your rights (Art. 18) — confirmation and access, correction, anonymisation, blocking or deletion, portability, information about who we share data with, and withdrawal of consent. Use the dashboard tools described in section 7 or write to us;
• International transfer (Art. 33) — data is processed outside Brazil (European Union and United States) by the providers in section 5, to the extent needed to deliver the service;
• Contact channel — to exercise your rights or ask about how your data is processed, write to suporte@dodoce.com.

You can also lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), Brazil’s data protection authority.

11. Changes

Material changes to this policy will be communicated by email to registered users with at least 30 days’ notice.