Privacy

The principle

Dibs collects strictly what a shop needs to prepare your order and hand it over. Nothing more, and certainly nothing to resell you elsewhere.

What we collect

Your first name, one way to reach you (email or phone number), the contents of your orders and the slot you chose. The site uses browser local storage to remember your language: that is not an advertising cookie.

Purposes and legal bases

Two legal bases, and nothing else. Performance of the contract (article 6.1.b GDPR) covers the heart of the service: recording your order, passing it to the shop you picked, telling you when it is ready, and keeping your account and its history. Without that data there is simply no order to place. Legitimate interest (article 6.1.f GDPR) covers the security and continuity of the service: stopping fraudulent account creation and abuse, letting a shop protect itself against orders that are never collected, and diagnosing faults. No processing rests on your consent, precisely because no processing goes beyond what the service needs in order to work. You may object to any processing based on legitimate interest.

What we don't collect

No card details whatsoever: you pay at the counter, Dibs never sees your payment method. No third-party ad trackers, no reselling of customer lists.

Cookies and trackers

This site sets no cookies at all. It uses only your browser's local storage: the language you chose (dibs-lang), your order in progress and your customer-side preferences (dibs-client-v2), the origin of the QR code you may have arrived through (dibs-src, which stays on your device and is never transmitted), and, on the merchant side only, the sign-in token that keeps you authenticated on your dashboard. These are strictly necessary for the service you asked for, and therefore exempt from prior consent under article 5.3 of Directive 2002/58/EC (ePrivacy) and its Belgian transposition (article 129 of the Act of 13 June 2005 on electronic communications). That is why you see no cookie banner on this site: there would be nothing to accept or refuse. No audience measurement, no advertising tracker, no social network pixel, on any page.

Who has access

The shop you order from sees your order and your first name, because it needs them to serve you. That is the only sharing.

Processors and technical recipients

Running Dibs takes a handful of providers, and here they all are. Supabase hosts the database and handles authentication for merchant accounts; the data sits in the European region eu-west-1 (Ireland). Netlify, Inc. (United States) hosts and serves the pages of this site. Google Fonts supplies the site's two typefaces: loading them from fonts.googleapis.com and fonts.gstatic.com sends your IP address to Google LLC. esm.sh distributes the technical library used by the merchant space and the dashboard, which likewise sends your IP address to that CDN's operator. None of these providers is allowed to use your data for its own purposes, and no data is sold, rented or handed to anyone for commercial ends. Transfers outside the EU are covered: Netlify and Google LLC are certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), and standard contractual clauses (SCCs, decision 2021/914) govern any other transfer. Data processing agreements (DPAs) are in place with each of these providers.

How long

Orders and customer history are kept as long as the account is active, then deleted no later than 3 years after the last activity (the time needed to handle missed pickups and disputes). Location data shared by a customer who enables "new shops around me" is deleted as soon as they switch the option off. Technical logs are kept for 30 days. You may request early erasure at any time via [email protected].

Your rights

Access, rectification, erasure, objection, portability. Write to [email protected]. You may also lodge a complaint with the Belgian Data Protection Authority (Rue de la Presse 35, 1000 Brussels).

Data controller

Dibs, published by Issam Messaoudi (self-employed — company being formed, "Dibs" Ltd. planned for October 2026). Data contact: [email protected]. Registered address: to be confirmed upon registration with the Belgian Crossroads Bank for Enterprises (BCE/KBO) in Brussels, Belgium. No Data Protection Officer (DPO) is required at this stage (low-scope processing, Art. 37.1 GDPR).