Privacy Policy

1. Who we are

Di Peppi ("we", "us", "our") is a Lebanese premium gourmet delicacies company operating at www.dipeppi.com. This privacy policy explains how we handle personal data collected through our online shop, B2B trade portal, mobile apps, and website.

2. What data we collect

Essential cookies & storage. We store a small session token in your browser's local storage to keep you logged in. Apart from the Meta advertising-measurement tools described below, we do not use third-party advertising cookies or cross-site tracking cookies.

Aggregate analytics & error monitoring. We use Vercel Analytics (cookie-less, anonymized page views and Web Vitals) and Sentry (error monitoring) to keep the site fast and to learn when something is broken. These services receive your IP address and user-agent string for the duration of a request; they do not place persistent identifiers in your browser. We do not share this data with advertisers.

Advertising measurement (Meta). We use the Meta Pixel and Meta Conversions API to measure how our Instagram and Facebook ads perform. On our shop and trade portal (never on our back office), these tools share technical data with Meta Platforms Ireland Ltd. — the pages and products you view, items added to your cart, checkout and purchase events (including order value), your IP address, browser type, and Meta cookie identifiers — and, if you are signed in, enter your contact details in a form on our site (such as the sign-in or checkout form), or place an order, a hashed (scrambled, non-readable) version of your contact details (email address, phone number, first and last name, and for orders your delivery city) so your visit or purchase can be matched to an ad. We also share the ad-click identifier Meta adds to links from its ads, and the country your visit comes from. Visitors who do not sign in, enter contact details, or order share no contact details. Meta may use this data to show you relevant ads. You can control ad personalisation in your Facebook or Instagram ad settings.

Account & login. When you sign in or sign up we collect your name, email address, and/or phone number to send a one-time password (OTP). OTP codes are currently delivered by email; we may also offer delivery by SMS to your phone number in the future. We do not store passwords.

Orders & delivery. When you place an order we collect your delivery address, map pin (optional), delivery phone number, and order details (items, quantities, totals). This is used to process and deliver your order.

Wallet. If you use the prepaid wallet we store your balance and transaction history to process payments and refunds.

B2B trade access. When you request a wholesale account we collect your company name, contact name, email, phone, MOF number, VAT number, and the official business document you upload. This is used solely to verify eligibility.

3. How we use your data

We use your data only to:

• Authenticate you and keep your session secure
• Process and deliver orders placed through the shop, mobile apps, or trade portal
• Send login codes, order confirmations, and status updates by email (and by SMS in the future, where you use phone-based login or opt in)
• Manage your wallet balance and transaction history
• Review and approve B2B trade access applications

We do not sell or rent your personal data. Apart from the advertising-measurement data shared with Meta described in section 2, we do not share your personal data with third parties for marketing purposes.

4. Data storage & security

Your data is stored in Google Firebase (Firestore and Cloud Storage) on servers located in the European Union and/or United States. Firebase is certified under ISO 27001 and SOC 2/3. We enforce HTTPS-only access, HTTP security headers (HSTS, CSP, X-Frame-Options), and restrict Firebase API access to our own domain.

5. Third-party processors

We rely on the following processors to operate the service. Each receives only the minimum data needed for its role:

• Google Firebase (Ireland / United States) — hosting of Firestore database, Cloud Storage, and Cloud Functions. Receives all account, order, and wallet data.
• Vercel (United States) — website hosting and cookie-less aggregate analytics. Receives request IP and user-agent for the duration of each request.
• Sentry (United States) — error monitoring. Receives error stack traces, request IP, and user-agent when something breaks.
• Meta Platforms Ireland Ltd. (Ireland / United States) — advertising measurement through the Meta Pixel and Conversions API. Receives the browsing, cart, and purchase events described in section 2, request IP, user-agent and country, Meta cookie and ad-click identifiers, and — for signed-in customers, contact details entered in our forms, and orders — hashed email address, phone number, name, and delivery city.
• Resend (United States) — transactional email delivery (OTP login codes, order confirmations, status updates). Receives your email address and the message content.
• SMS delivery provider (planned) — if we introduce SMS delivery of login codes or order updates, a specialised SMS provider will receive only your phone number and the message content. We will update this policy with the provider's name before enabling SMS.

We do not sell, rent, or share your personal data with any party other than the processors listed above, and only to the extent necessary to provide the service.

6. Cookies

We use essential local storage for the session key that keeps you logged in. On our shop and trade portal, the Meta Pixel also places Meta's advertising cookies (such as _fbp and _fbc) to measure ad performance, as described in section 2. You can clear or block these cookies in your browser settings without affecting your ability to shop. The aggregate analytics and error-monitoring services described in section 2 are cookie-less and do not place persistent identifiers in your browser.

7. Your rights

You may request access to, correction of, or deletion of your personal data at any time.

Deleting your account. In our mobile app you can permanently delete your account yourself at any time: go to Profile → Delete my account. This removes your login and personal details (name, contact details, saved addresses). Records we are legally required to keep — such as past orders and invoices for tax and accounting purposes — are retained but stripped of identifying personal data.

You can also request access, correction, or deletion by emailing us at info@dipeppi.com. We will respond within 30 days. Full account-deletion instructions are available at dipeppi.com/account-deletion.

8. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of our services after an update constitutes acceptance of the revised policy.

9. Contact

For privacy-related questions, contact us at info@dipeppi.com.