Introduction
Welcome to the Privacy Policy of Daratan Foods. The grocery business is managed by Individual Entrepreneur Adenife Gabriel Ibiyemi, ID code 302304762, with legal address at 10a Spiridon Kedia, Tbilisi. The published physical address is shown on the Contact page. We are committed to protecting your privacy.
This Privacy Policy explains the information processed through the Daratan Foods website and current storefront account services, why it is used, and the technical boundaries identified in the implemented architecture. It preserves applicable legacy Daratan wording about website visitors, security, cookies, external links, and data-deletion requests, and adds the implemented account, profile, cart, verification, and communication-preference processing described below.
Website visitors
We collect non-personally identifying information typically made available by web browsers and servers, such as browser type, language preference, referring site, and the date and time of each visitor’s request. This helps us understand how visitors use our website.
Occasionally, we may release non-personally identifying information in aggregate, such as usage-trend reports. We may also collect potentially personally identifying information such as IP addresses for logged-in users and users leaving comments on our blog.
Gathering of personally identifiable information
Certain visitors choose to interact with us in ways that require personally identifiable information. The amount and type of information depend on the interaction. The current storefront uses an email address for email-first account authentication and may receive a customer-supplied first name, last name, WhatsApp/mobile number, preferred language, cart information, and communication choices.
Account authentication and sessions
The current storefront uses Supabase Auth for email-first account authentication and email-confirmation state. A confirmed email is required before protected account, profile, and authenticated-cart actions are allowed. Supabase session state is maintained through the browser/server session mechanism used by the storefront, including server-readable authentication cookies.
The storefront customer record mirrors the authenticated email and identity reference in the Railway PostgreSQL customer database so that Daratan’s account, profile, and cart services can be scoped to the signed-in customer.
Customer profiles and WhatsApp/mobile data
The customer profile may contain the first name, last name, preferred language, and WhatsApp/mobile number supplied by the customer. The number is normalized for storage and contact use. A saved number is contact data, not marketing consent.
If the customer requests WhatsApp number ownership verification, the storefront records the normalized number, verification result and timestamp, and verification history described below. Verification does not create marketing consent and does not change the Supabase email identity.
Persistent carts and browser storage
Authenticated carts are persisted in the storefront PostgreSQL database. The implemented cart records product references, quantities, price snapshots, availability state, cart and checkout state, guest-cart information where present, and creation/update/activity timestamps so a signed-in customer’s cart can be restored and revalidated.
The browser also uses local storage for guest/current cart product identifiers and quantities, and for local cart-owner and merge-state markers used to prevent one authenticated customer’s local cart from being carried into another customer’s session. The current implementation does not assign a fixed local-storage lifetime in the policy.
Communication preferences and consent
The storefront keeps communication choices separate from contact details. It can record email and WhatsApp choices independently, distinguish transactional communication about a customer’s own account or order from optional marketing, and store the status, source, policy wording version, and time of a marketing choice or withdrawal.
A phone number, email address, or successful WhatsApp ownership verification is not marketing consent. Marketing consent must be an explicit choice for the relevant channel. The current storefront code records and evaluates these choices but does not enable a marketing or order-update messaging transport.
WhatsApp number verification
When the configured verification capability is available and a signed-in customer requests it, the storefront creates a one-time challenge for the supplied WhatsApp/mobile number. It records the challenge identifier, normalized number, a keyed hash of the code rather than the plaintext code, the configured delivery adapter, expiry, attempt and outcome information, and append-only verification events. When available, the requesting IP is stored only as a keyed hash for abuse throttling.
The verification capability is separate from marketing consent. A staging verification adapter sends nothing. Any external delivery boundary, recipient, processor role, service location, and transfer safeguard must be confirmed before that capability is activated.
Security
The security of your Personal Information is important to us. However, no method of transmission over the Internet or electronic storage is 100% secure. The current storefront uses server-side Supabase session revalidation, customer-scoped database access, private no-store responses for customer APIs, and keyed hashes for verification codes and optional requesting IP addresses. These measures do not guarantee absolute security.
Links to external sites
Our website may contain links to external sites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy and terms and conditions of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of third-party sites, products, or services.
Aggregated statistics and current storefront analytics
The legacy Daratan policy states that DF may collect statistics about visitor behaviour and may disclose aggregate information without disclosing personally identifying information. No analytics or advertising implementation is present in the current storefront source/configuration reviewed for this policy. If that changes, this policy must be reviewed before activation.
Cookies and local storage
The current storefront uses the session cookies required by its Supabase authentication integration and browser local storage for the cart and local account-session safeguards described above. These features may not work properly if the browser blocks the relevant storage. The current storefront source/configuration does not add advertising or analytics cookies.
Implemented services and further information
The implemented storefront uses Supabase Auth for authentication and a Railway PostgreSQL database for storefront customer, profile, cart, communication-preference, and verification records. This policy does not state unverified processor roles, service locations, sub-processors, international-transfer safeguards, legal bases, or fixed storage periods. Information applicable to a particular processing activity may be requested from us using the contact details below.
Your rights under Georgian law
Subject to the Law of Georgia on Personal Data Protection and applicable restrictions, you may request information about processing of your data, access and copies, correction or completion, termination of processing, erasure or destruction, blocking, and transmission of data where the law and technical conditions allow. You may withdraw consent where processing is based on consent, object to direct marketing, and apply to the Personal Data Protection Service or a court where you consider your rights infringed.
When making a request, please provide enough information for us to identify the relevant account or interaction. We will not invent a self-service deletion or export process that is not currently implemented; requests are handled through the contact route while the applicable procedure is confirmed.
Privacy Policy changes
We may change our Privacy Policy when the website, processing activities, or applicable requirements change. We encourage visitors to check this page for updates. The policy should be reviewed before a new analytics, advertising, messaging, payment, or external data-processing capability is activated.
How to contact us
To contact us about this Privacy Policy or a personal-data request, please email support@daratanfood.ge.
Data deletion requests
For a request to delete personal data associated with an interaction through WhatsApp, Facebook, Instagram, the website, or the current storefront account, contact support@daratanfood.ge and include the phone number, email address, or account information associated with the request. Requests remain subject to the applicable Georgian law and information that must be retained for legal, accounting, security, or other lawful purposes. No fixed retention period is stated here because one has not been approved for the current architecture.