Privacy Policy

What we collect

If you shop on Qoffa

• Your name and phone number, and an email address if you add one. You sign in with a one-time code sent by SMS to your phone — we store only a scrambled (hashed) copy of that code, never the code itself.
• Delivery addresses you save: recipient name, phone number, governorate, town, street address and postal code.
• Your orders, delivery history and the claims (support requests) you open about them.
• Reviews and ratings you write about products you bought.

If you sell on Qoffa

• Account details: your name, email address and phone number, protected by a password that is stored hashed.
• Application details: whether you sell as an individual or a company, your national ID number (CIN) if you are an individual or your tax ID (matricule fiscal) if you are a company, your business address, and your estimated number of parcels per month. Our team checks these details before your account can sell.
• Store details: your store name, description, logo and images, your products, prices and stock.
• The orders you receive, the shipments you create, and the delivery information of the buyers who ordered from you.
• Your payout method and the payout details you give us (for example bank details for transfers, or cash pickup).
• Your rate card — the fees Qoffa sets for your account — and your earnings and payout records.

Connecting Facebook and Instagram

In My Store you can connect your Facebook Page instead of typing a link. When you connect, Facebook sends us your Page’s name, ID, profile picture and public link — and, if that Page is linked to an Instagram business account, that account’s username, ID, profile picture and link too. We use these details only to show your social buttons on your public store page and to show you, in My Store, what is connected. We never post or message on your behalf, and we do not read your personal profile, your friends or any private content. The access token Facebook issues during sign-in is used once, to complete the connection, and is never stored. You can disconnect at any time in My Store → Contact & social: disconnecting deletes the stored connection details and removes that network’s link from your store.

How we use your data

• To run your account and your store, and to show your products to buyers.
• To take orders, arrange pickup and delivery, and keep buyers and sellers informed about each order.
• To handle cash-on-delivery money: recording what was collected, reconciling it, and paying sellers their proceeds after Qoffa’s fees.
• To answer support requests and claims about orders.
• To keep accounts secure, prevent fraud and abuse, and enforce our rules.
• To meet our legal and accounting obligations.

Who we share data with

When you order, the seller who fulfils your order receives the delivery name, phone number and address for that order — the seller needs them to prepare and hand over your parcel. Our delivery drivers see the name, address and phone number of the stops on their route. Companies that provide our hosting and technical infrastructure process data on our behalf, only to run the service. We do not sell personal data to anyone. We may disclose data if the law requires it, or to protect the rights and safety of our users.

Cookies and browser storage

Qoffa uses one cookie, to remember the language you picked (English, French or Arabic). To keep you signed in, the site stores a session token in your browser’s local storage instead of a cookie. We do not use advertising cookies, analytics trackers or social-media pixels. If we ever add any, we will update this policy first.

How long we keep your data

We keep account data for as long as your account is active. Order, payment and accounting records are kept for as long as the service needs them and as required by Tunisian law, including after an account is closed. When personal data is no longer needed, we delete it or anonymise it.

How we protect your data

Passwords are stored hashed with bcrypt and are never kept in plain text. Sign-in codes are sent by SMS, expire after a short time, and only a hash of each code is stored. The site is served over HTTPS. Inside Qoffa, personal data is accessible only to team members whose job needs it, under role-based permissions. Access tokens from social-media connections are never stored (see above).

Your rights

You can view and update most of your information yourself: buyers in Account, sellers in My Store and their account settings. You can also ask us for a copy of your personal data, ask us to correct anything that is wrong, or ask us to delete your data — the next section explains how. We handle every request and reply within a reasonable time.

Deleting your data

1. Facebook and Instagram connection data: disconnect the network in My Store → Contact & social. This immediately deletes the stored connection details for that network.
2. All other personal data: sign in to your Qoffa account, open “Orders & support” (linked in the footer of every page) and send us a request from there asking for your data to be deleted.

When you ask for deletion, we delete or anonymise your personal data, except for records we are required to keep by law — for example accounting records of completed orders and deliveries. If you only connected Facebook or Instagram by mistake, disconnecting (step 1) is enough; no request is needed.

Changes to this policy

We may update this policy as Qoffa changes. The current version always lives at this address, qoffa.tn/privacy, with its last-updated date at the top.