Privacy Policy

Effective date: 31 July 2026 · Operator: DigitAI Solutions Ltd. (“Dodolist”, “we”)

1. Who we are

Dodolist (dodolist.mu) is a local online marketplace for Mauritius operated by DigitAI Solutions Ltd. For anything related to your personal data, contact us at support@dodolist.mu.

This policy covers the website dodolist.mu and the Dodolist mobile apps for Android and iOS (published on Google Play and the App Store by Dodolist Mauritius). The apps show the same marketplace as the website and handle your data in exactly the same way; wherever this policy says “Dodolist”, it means both.

2. What data we collect

• Account data — email address, display name, a securely hashed password, your language preference, and optionally an avatar, phone/WhatsApp number and profile details you add yourself.
• Social sign-in — if you sign in with Google, Facebook or X we receive your name, email address and (where provided) profile picture from that provider, with your consent in the provider’s dialog. We never receive your password for those services.
• Listing content — titles, descriptions, prices, photos, location and tags of the ads you publish. Listings are public by design. From the location you enter we derive the district, so buyers can filter by area.
• Languages you speak — up to three, if you choose to state them. They are shown next to your contact details so buyers know whether to call or write. The first one also sets the language Dodolist opens in for you.
• Messages — chats between buyers and sellers on the platform.
• Reviews — ratings and comments you leave for sellers (shown publicly with your display name).
• Favourites & search alerts you save.
• Bookings — if you request or accept an appointment for a service listing we store the requested date and time, an optional note, the booking status and, for providers, the availability hours you configure. Booking details are visible to both parties.
• Google Calendar (optional) — service providers can connect their Google Calendar. We then store an access token, read only your free/busy times to block booked slots, and add or remove events for confirmed bookings. We never read event titles or contents of your other appointments. You can disconnect at any time under Dashboard → My Bookings or revoke access in your Google security settings.
• Reports — if someone reports one of your ads, we store the reason given, the time, and our decision, so that moderation is traceable. The person who reported an ad is never shown to you.
• Moderation records — if content you submit violates our content policy (e.g. weapons or drugs), we record the incident on your account (warning count and any temporary posting suspension).
• Payment & subscription data — if you subscribe to Dodolist Pro, payments are handled by Stripe. We never see or store your card number; we store only your subscription status and Stripe references.
• Identity verification (optional) — the “Verified Seller” check is run by Stripe Identity. Your ID document and selfie are processed by Stripe; we store only the result (verified yes/no) and a Stripe reference — never the documents themselves.
• Technical data — IP address, browser information and server logs needed to run and secure the service, plus the cookies listed below.

3. Permissions the apps ask for

The Dodolist apps ask for as little as possible, and only at the moment you use the feature. You can refuse every one of them and still browse, search, and message sellers.

• Camera and photo library — only when you attach photos to your own listing. We upload exactly the photos you select. We never scan your gallery, and we do not read photos in the background.
• Location — optional, and only if you tap “use my location” while creating a listing, to set the place shown on that ad. You can type the location instead, or leave it at district level. We do not track your movements and we do not collect location in the background.
• Notifications — only if you allow them, to tell you about new messages about your ads.

The apps contain no advertising SDKs and no analytics or tracking SDKs. We do not use Apple’s App Tracking Transparency framework because we do not track you across other companies’ apps or websites, and we do not sell personal data.

Signing in with Google or Apple happens in the operating system’s own dialog. We receive your name and email address (with Apple, a private relay address if you choose to hide it) — nothing else, and no password.

You can delete your account and your ads at any time, in the app under Profile → Account, or on the web at dodolist.mu/delete-account. Details are in section 8 below.

4. How we use your data

• To run the marketplace: publish your listings, show your public seller page (you can switch it off under Privacy Settings), deliver chat messages and notify you by email about new enquiries.
• AI features: when you use the AI listing assistant or the bulk import, the photos and text you provide are sent to Google (Gemini) to draft the listing, estimate a price and check for prohibited content. Listing texts and your boutique description are also machine-translated into English, French and Creole via the same service.
• Maps & location: to show a listing’s location and let you pick a spot, we use Google Maps or OpenStreetMap/Nominatim; your place search may be sent to those services.
• Payments & verification via Stripe (see above).
• Safety: spam filtering, rate limiting, Cloudflare Turnstile bot checks on registration, and automated content moderation: every uploaded photo is screened by Google image analysis (SafeSearch and object labels) and AI-assisted listings are checked for prohibited items. Violations can lead to a recorded warning and a temporary posting suspension on your account (see our Terms of Use).

5. Who we share data with

We do not sell your data. We share data only with the processors needed to run Dodolist:

• Google — Sign-In, Maps, Calendar (only if you connect it), image safety checks and AI (Gemini) processing of listing photos/text.
• X — only if you choose it for sign-in.
• Meta (Facebook) — sign-in, if you choose it. In addition we use the Meta Pixel: when you browse Dodolist, your browser tells Meta which pages you looked at, so that we can measure our adverts on Facebook and Instagram and show them to people who have already visited Dodolist. Meta may link this to your Facebook or Instagram account.
  In addition our server reports three of these events directly to Meta (Conversions API): creating an account, publishing a listing, and revealing a seller's contact details. This second path exists because ad blockers and browser settings stop a large share of the browser-side reports. What we send is your IP address, your browser identification and the two Meta cookies — the same event carries an identifier so it is counted once, not twice. We do not send Meta your name, e-mail address or phone number, neither in plain text nor hashed.
• Google Analytics 4 — aggregated statistics on how Dodolist is used (pages, devices, countries), so we can see what works and what does not.
• Stripe — payments, subscriptions and identity verification.
• OpenStreetMap / Nominatim — map tiles and place search (as fallback).
• Our hosting provider — servers located in the European Union (Germany).
• Authorities, if we are legally required to disclose data.

6. What is public

• Your listings (including machine translations), your display name or store name and avatar/logo.
• Your seller page (profile or Pro boutique) with your active listings and received reviews — you can hide it under Dashboard → Privacy Settings.
• Reviews you write, with your display name.
• Your phone number is shown masked and revealed only when a visitor actively taps “Show”.
• The languages you state that you speak, if you fill them in.

7. Cookies and measurement

• Session cookie (dodolist_session) — keeps you logged in, for up to 30 days.
• Language cookie (dodolist_lang) — remembers your chosen language for one year.
• Meta Pixel (_fbp and related identifiers) — measures our adverts and lets us show them to people who have visited Dodolist before. This is advertising technology and it works across websites.
• Google Analytics 4 (_ga, _ga_*) — aggregated usage statistics.
• Our own visitor counter — counts page views without setting any cookie. It stores a daily one-way hash of your IP address and browser, which cannot be turned back into a person, and deletes it after two days.

You can block the two third-party tools with any common content blocker or with your browser's tracking protection. Dodolist works exactly the same without them.

8. Retention & deletion

• Account data is kept for as long as your account exists. You can delete your account yourself — in the app or on the web under Dashboard → Account Details, or at dodolist.mu/delete-account; this removes your account and takes all your listings offline.
• Chat messages remain visible to the other participant, as with any messaging service.
• Server logs are kept for a short period for security purposes.
• You can also request deletion or a copy of your data at any time via support@dodolist.mu.

9. Your rights

Under the Mauritius Data Protection Act 2017 — and, where applicable, the EU GDPR — you have the right to access, correct, delete and receive a copy of your personal data, to object to certain processing, and to lodge a complaint with the Data Protection Office. Just write to support@dodolist.mu and we will help.

10. Children

Dodolist is not directed at children. You must be at least 16 years old (or the age of digital consent in your country) to create an account.

11. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced on the site; the effective date above always shows the current version.

12. Contact

DigitAI Solutions Ltd.
support@dodolist.mu