Privacy Policy

Effective date: May 4, 2026 ·Last revised: November 5, 2026

This Privacy Policy explains how Dott LLC ("Dimi", "we", "us", "our") collects, uses, shares, and safeguards information when you use the Dimi platform (the "Service"). It is written to comply with the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and equivalent regimes in other jurisdictions where we operate.

For questions or to exercise privacy rights, contact privacy@orderdott.com.

1. Information we collect

You give us

Account: phone number (primary identifier), name, email (optional), profile photo, and country.
Business: business name, address, type, banking details (held by Stripe Connect or Wise; we keep the last four digits only), tax registration numbers where applicable.
Identity verification: for couriers and drivers — government-issued ID, selfie, vehicle photo, license. For business owners — KYC information required by Stripe Connect.
Content: messages, product photos, menu data, ratings, and reviews you upload.
Payment: card and mobile-money tokens are handled by our payment processors; Dimi receives confirmation but not the full payment instrument.

Collected automatically

Device: device model, OS version, app version, language, time zone, IP address, push-notification tokens.
Location: precise GPS while using delivery, taxi, courier, or in-app navigation; coarse location for marketplace discovery. Location is collected only while a session needs it.
Activity: pages viewed, features used, transactions, error logs.
Cookies and similar: see our Cookie Policy.

Contacts (only with your permission)

Address book: if you grant contacts access, Dimi uploads the names and phone numbers from your device’s address book to our servers to identify which of your contacts already use Dimi, so you can call, message, and send or request money to people you already know. Access is requested through your device’s permission prompt; if you decline, no contact data is accessed or uploaded and the app remains fully usable.
Storage & use: we store these contact entries (contact name, phone number, and whether the number matches a Dimi user) linked to your account to power your in-app contacts list for Calls, Chats, and Wallet. Phone-number matching uses secured hashed lookups. This contact data is used only for these contact-discovery features — it is never sold or used for advertising, and the only other use is the invitations you choose to send, described below. You can revoke contacts access at any time in your device settings, and deleting your Dimi account permanently removes your uploaded contacts.

Invitations

People you invite: when you choose to invite someone from the Dimi app, we keep the phone number or email you invited, and any name you entered, linked to your account. We use it to deliver the invitation where you ask us to, and to record that you invited them if they join. We do not use it for marketing.
If they join: we record who invited them, and we may use that record to understand how people find Dimi and to detect fraud. Anyone who opens your personal invite link sees your first name.
If they do not join: we remove their number, email and name ninety (90) days after the invitation.

From third parties

Identity and fraud signals from our verification partners.
Payout status and dispute information from Stripe and Wise.
Phone-number verification status from Termii (Africa) and Firebase Authentication (rest of world).

2. How we use information

Operate the Service: deliver orders, complete rides, broadcast chat and call signals, route payouts.
Authenticate and protect accounts: phone-number verification, fraud detection, rate limiting, sanctions screening.
Improve the Service: analytics, error monitoring, A/B testing, AI training where the data has been de-identified or aggregated.
Communicate with you: order status, payout notifications, security alerts, support replies, important policy changes.
Legal compliance: tax records, regulator requests, anti-money-laundering checks, response to lawful subpoenas.

Legal bases (GDPR users)

Contract — to provide the Service you signed up for.
Legitimate interests — fraud prevention, product improvement, security.
Consent — marketing communications, optional location features, optional analytics cookies.
Legal obligation — tax, accounting, AML/KYC.

3. How we share information

We do not sell personal information.

We share with:

Other users involved in the same transaction — for example, a delivery courier sees the consumer's address and contact during an active delivery.
Service providers — Stripe (payments), Wise (international payouts), Auth0 (authentication), Firebase (push, OTP), Termii (SMS in Africa), Resend (email), Sentry (error tracking), Cloudflare (security), Google Maps (geocoding), Anthropic (AI features, such as the in-app assistant and drafting replies to comments on our social media posts), AWS / Render (hosting). Each is contractually bound to use the data only for the purpose we engaged them.
Legal recipients — courts, regulators, tax authorities, when required by law.
Acquirers — in the event of a merger, acquisition, or bankruptcy, with continuing protection.

4. International transfers

Dimi is headquartered in the United States. Information you provide may be processed in the US, the EU, or wherever our service providers operate. Where required, we rely on Standard Contractual Clauses or equivalent transfer mechanisms.

5. Retention

We keep personal information only as long as needed for the purposes described above. Typical retention windows:

Account profile: while the account is active, plus 30 days after deletion request.
Transaction records: seven (7) years (tax / accounting requirement).
Pickup / drop-off photos and GPS traces: ninety (90) days.
Chat messages: until you delete them or close the account.
Voice and video call recordings (when made): thirty (30) days, unless retained for an open dispute.
Server access logs: ninety (90) days.
Details of people you invited who did not join: ninety (90) days.

6. Your rights

Depending on where you live, you may have rights including:

Access — get a copy of the personal information we hold about you.
Correction — fix inaccurate or incomplete data.
Deletion — close your account and have us delete data we are not legally required to retain.
Portability — receive your data in a machine-readable format.
Opt-out — of marketing emails, optional analytics cookies, and (in California) the limited "sale or sharing" categories defined under CPRA. We do not sell.
Object or restrict processing based on legitimate interests.
Withdraw consent at any time, where consent is the legal basis.
Lodge a complaint with your local data-protection authority.

To exercise any of these, email privacy@orderdott.com. We respond within 30 days, faster where required by law.

EEA, UK & Swiss residents (GDPR / UK GDPR)

Dott LLC, a United States company, is the data controller for the personal information described in this Policy. If you are located in the European Economic Area, the United Kingdom, or Switzerland, the EU GDPR, the UK GDPR, and the Swiss FADP apply to your personal data, and the rights listed above are available to you. The legal bases we rely on are set out in Section 2, and international transfers of your data are safeguarded as described in Section 4.

You have the right to lodge a complaint with your national data-protection supervisory authority — for example, the UK Information Commissioner's Office (ICO), or the Data Protection Authority in your EEA country. We would, however, appreciate the chance to resolve your concern first, so please contact privacy@orderdott.com before doing so.

7. Security

We use AES-256 encryption at rest for sensitive fields (phone numbers, banking details), TLS in transit, role-based access controls, PostgreSQL row-level security for tenant isolation, and regular security audits. No system is perfectly secure, but we work to keep ours close. Suspected security issues should be reported to security@orderdott.com.

8. Children

The Service is not directed to anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us information, contact privacy@orderdott.com and we will delete it.

9. Voice and video calls

Calls placed through Dimi may be recorded for safety, dispute resolution, and quality. When recording is active, all participants see an indicator. Recordings are encrypted and retained for thirty (30) days unless an open dispute extends that window. You may request deletion of a recording you participated in via privacy@orderdott.com. Where local law requires explicit consent of all parties, the recording feature is disabled by default in that jurisdiction.

10. Automated decisions

Some Dimi features use algorithms — for example, fraud scoring of payments, marketplace ranking, courier dispatch routing. These do not produce legal or similarly significant effects without human review. You may request a human review of any automated outcome that affects you by emailing privacy@orderdott.com.

11. California-specific disclosures (CCPA / CPRA)

We do not sell personal information and have not in the prior twelve (12) months. We share personal information with service providers listed in Section 3 only for the purposes described. California residents may exercise their CCPA rights via privacy@orderdott.com. We will not discriminate against you for exercising any privacy right.

12. SMS / text messaging

When you sign up or sign in to Dimi, you may receive a one-time verification code (OTP) by SMS to the mobile number you provide. You consent to receive these messages by entering your phone number and requesting a code in the Dimi app; the SMS is sent only in direct response to that request. Dimi sends these messages via SMS providers (e.g. Twilio and Africa's Talking) acting solely as processors on our behalf.

We do not share or sell your mobile number. Mobile phone numbers collected for SMS verification are never shared with or sold to third parties or affiliates for their marketing purposes. Numbers are disclosed only to the SMS providers that deliver your verification code, strictly to send that message.
Message frequency. Message frequency varies and is transactional — you receive a verification code only when you request one during sign-up or sign-in. We do not send recurring or marketing SMS.
Message and data rates may apply. Standard message and data rates from your mobile carrier may apply to messages you receive.
Help / opt-out. For help, contact support@orderdott.com. Because these are one-time security codes tied to accessing your own account, they are not promotional; you can stop receiving them by not requesting a code.

Dimi publishes its own posts and videos to its official pages on Facebook, Instagram, Threads, LinkedIn and YouTube, and replies to comments people leave on those posts. To do this we read the public comments on our own posts, including the commenter's public name or handle, and keep the comment text and our reply so our team can follow up. An AI service provider (Anthropic, see Section 3) reads the comment text to sort it and draft a reply; it does not receive anything else about the commenter. We do not collect anything else from those platforms, we do not access other accounts, pages or channels, and we do not sell this information. We delete a stored comment on request.

YouTube API Services

Dimi uses YouTube API Services to upload our own videos to the Dimi YouTube channel and to read, reply to and moderate comments on those videos. By interacting with Dimi's videos and channel you agree to the YouTube Terms of Service. YouTube is a Google service, and Google's handling of your information is described in the Google Privacy Policy.

The only Google account connected to Dimi through YouTube API Services is Dimi's own channel. Access can be revoked at any time from the Google security settings page, which stops our access at once; the stored access tokens are deleted when the channel is disconnected from our admin tools. To ask us to delete a comment we stored, email privacy@orderdott.com.

14. Changes to this Policy

Material changes will be announced in the app and by email at least thirty (30) days before taking effect. The "last revised" date at the top reflects the latest update.

15. Contact

Privacy / data subject requests: privacy@orderdott.com
Security incidents: security@orderdott.com
Legal: legal@orderdott.com
General support: support@orderdott.com

Dott LLC, Wilmington, Delaware, USA.

Last revised: November 5, 2026.