This explains what information AtollBuy collects when you use our marketplace — on the web or in the Android app — why, and how you can control it.
Last updated: October 2026
1. Information We Collect
Account details: your name, email address, and phone number when you sign up or apply to sell.
Delivery information: your saved address, atoll/island, and location, used to route orders to the right seller and calculate delivery.
Order history: what you’ve bought or sold, quantities, prices, and payment status.
Seller details: for approved sellers, shop information and bank account details used to pay out earnings.
Photos you upload: product images, your shop logo, and profile picture.
Device push tokens: if you turn on notifications, an identifier used only to deliver them to that device — see section 4.
2. How We Use It
To fulfil and deliver your orders, and to pay out seller earnings.
To send order, listing, and account updates — in-app, by email, and by push notification.
To operate seller tools like giveaways and storefronts.
To prevent fraud and abuse of the platform.
We do not sell your information to advertisers or data brokers.
3. Payments
Card payments are processed by BML Connect (Bank of Maldives). AtollBuy does not receive or store your full card number — BML handles that directly.
For bank transfer or cash-on-delivery orders, we record the payment status and any reference or receipt you provide, so the seller can confirm it.
4. Push Notifications
Push notifications are entirely optional and off by default. Turning them on registers a device-specific identifier — a browser subscription or, in the Android app, a Firebase Cloud Messaging token — used only to route a notification to that device.
Delivering a push notification means it passes through Google Firebase (Android) or your browser’s own push service (web) — they see only that a notification is being sent, not its content beyond the title and message shown.
You can turn notifications off at any time from the Notifications page, which also removes the stored identifier for that device.
5. Who We Share Data With
The seller (or buyer) in a transaction: the delivery details and contact info needed to fulfil an order.
Service providers: Supabase (database and authentication), DigitalOcean (hosting), BML Connect (card payments), Resend (transactional email), and Google Firebase (Android push delivery) — each processes data only as needed to provide that specific service to us.
We don’t share your information with anyone else without your consent, except where required by law.
6. Security
Your data is protected by row-level security in our database, meaning your account can only read the rows that belong to it — this is enforced at the database level, not just in the app.
All traffic to and from AtollBuy is encrypted in transit.
If you sell on AtollBuy, we record which seller tools you open (for example the storefront editor or the register) and when, never what you do in them. Only AtollBuy administrators can see this, to keep the marketplace secure, and it is deleted after 90 days.
No method of storage or transmission is 100% secure, but we take reasonable, industry-standard steps to protect your information.
7. Your Choices and Rights
You can review and update your account details, address, and notification settings at any time from your account page.
To delete your account: email [email protected] from your account’s registered address and ask us to delete it. We’ll delete your profile, listings, reviews, and saved locations. We keep order and payout records for up to 7 years from the transaction date, as required for legal, tax, and dispute-resolution purposes, and delete them once that period ends.
You can also request a copy of your data at any time by contacting us the same way.
AtollBuy is not directed at children, and we do not knowingly collect data from anyone under 13.
