Privacy Policy
Version of 2 Nov 2026
This policy explains what personal information Online.mv holds, why, who helps us run the service, and what you can ask us to do with your information. It is checked by a lawyer before Online.mv opens, and we will post any change here with a new date.
1. Who we are
Online.mv runs this website, the shop owners’ dashboard and the tills. Privacy questions: info@online.mv.
We play two roles:
- For our own users (shop owners, their staff, and shoppers with an Online.mv account), we decide how their account information is used.
- For each shop’s customers and orders, the shop decides what to collect and why. We store and process those details for the shop, on its instructions. Ask the shop first about what it holds about you. We will help it answer.
2. What we collect and why
| Who | What | Why |
|---|---|---|
| Shop owners and staff | Name, email, role, branches they work at, a scrambled (hashed) till PIN, sign-in records | To sign you in, control what each person may do, and keep a record of staff actions |
| Responsible person for a business | Full name, ID card or passport number, phone, permanent address, business registration document | To check that the business is real before its online shop goes live |
| Shoppers with an account | Name, email, phone, saved delivery addresses | Faster checkout at any Online.mv shop |
| Shop customers (recorded by the shop) | Name, phone, email for receipts; for a tax invoice the buyer's name, address and TIN; store credit balance | Receipts, tax invoices, loyalty and returns, as the shop needs |
| Online orders | Name, phone, delivery address, items, payment slip photo | To deliver the order and let the shop check payment |
| Reports about listings | What you wrote, and your email if you give it | To review the listing, and to reply to you |
| Newsletter | Email address | Only if you sign up to a shop's newsletter. You can unsubscribe at any time |
| Technical | Device and browser type, IP address, error reports | To keep the service secure and fix faults |
We do not sell personal information. We do not use it for advertising. We do not take card numbers: you pay each shop directly.
3. Who helps us run Online.mv
These companies process information only to provide their part of the service, under contract with us.
| Company | What it does | Where the data is |
|---|---|---|
| Supabase | Database, sign-in, stored files and photos | Singapore |
| Render | Runs our server | Singapore |
| Vercel | Serves the website, dashboard and till pages | Global network |
| PowerSync | Keeps tills in sync when they reconnect | Outside the Maldives |
| Resend | Sends emails (receipts, invitations, alerts) | United States |
| Sentry | Error reports | European Union |
These places are outside the Maldives. We choose providers with strong security and contracts that protect the data. We may also share information when the law requires it, for example with MIRA or a court, or to protect people from fraud.
4. Cookies and storage
We use only the cookies and browser storage needed to keep you signed in, keep your cart, remember your till, keep a sale on screen if the page reloads, and remember settings such as light or dark mode. We use no advertising cookies.
5. Tills and offline sales
A till keeps a copy of its products, staff names and recent sales on the device so it can sell without internet. Sales stay on the device until they are sent. Staff PINs are stored only in scrambled form. Signing out of a till removes its saved cart.
6. How we protect it
- Each business’s data is kept apart in the database, so one shop cannot see another’s.
- All connections are encrypted (HTTPS).
- Staff access follows the roles the owner sets. Important actions are written to a record that cannot be changed.
- Daily backups are made, and a restore is tested every month.
- If a breach puts your information at risk, we will tell the affected shops and people without delay, and the authorities where the law requires.
7. How long we keep it
- Shop accounts: while the account is open. After it closes, 90 days, then deleted.
- Sales, receipts and tax records: as long as Maldivian tax law requires the shop to keep them, then deleted.
- Shopper accounts: until you delete the account.
- Reports about listings: as long as needed to review them and keep the marketplace safe.
- Error reports: for the short time our error service keeps them.
8. Your choices and rights
You can ask to see the information we hold about you, correct it, delete it, or stop us using it for a purpose you object to. Shoppers can edit or delete their account themselves. For anything else, email info@online.mv. We reply within 30 days. We may need to check who you are first. Where a shop holds the information, we pass your request to the shop and help it answer.
9. Children
Online.mv accounts are for people aged 18 or over. Shops must not use Online.mv to collect information about children beyond what a normal sale needs.
10. Changes
We will post changes here with a new date, and email account holders about important changes before they apply.