Privacy Policy

1. Who we are

Doroo+ (the Windows ERP application) and Doroo Analytics (its companion mobile app) are built and operated by Catuleius. Catuleius is the data controller for account and system data described below, unless stated otherwise in Section 6.

2. Scope: two products, one policy

Doroo+ runs on a merchant's Windows computer and handles sales, inventory, accounting, and an optional online store. Doroo Analytics is a mobile app that connects to the same license and lets the license holder (and any staff they invite) view business data — sales, stock, orders — from a phone. Because both products share the same license and account system, this single policy covers both.

3. Information we collect

a) License & business owner information

• Business owner name and phone number, entered during license activation
• License key and device identifier (a hardware "CPU serial" used to bind a license to a specific computer and prevent unauthorized copies)
• License validity checks, including timestamp and IP address of each check

b) Doroo Analytics mobile account

• Name and phone number used to register the mobile app account
• Password (stored only as a one-way cryptographic hash — we never store or can see your plain-text password)
• A login/session token generated when you sign in, used to keep you signed in

c) Business data you enter into Doroo+

• Products, categories, prices, images, and stock levels
• Sales, cashier sessions, debts, and accounting entries
• Backups of your local Doroo+ database, created automatically for disaster recovery

d) Automatically collected technical data

• Push notification tokens (Firebase Cloud Messaging) and your notification preferences, so we can send you order and stock alerts
• App/POS version and basic device platform (e.g. Android), used for compatibility and support
• IP address, logged when your license is validated or your account signs in, used for security and abuse prevention

4. How we use information

• To create and operate your license and mobile account, and keep your Windows app and mobile app in sync
• To send push notifications you've opted into (new orders, low stock, daily summaries)
• To generate the analytics and insights shown in the app (sales trends, top products, cashier performance)
• To back up your business data and let you restore it if a device is lost or damaged
• To detect fraudulent license use, prevent abuse, and keep the Service secure
• To provide customer support when you contact us

We do not use your business data to train third-party AI models, and we do not sell your data to advertisers.

5. Sharing & third parties

We do not sell your personal information. We share data only as needed to run the Service:

Who	What they receive	Why
Firebase (Google)	Push notification tokens	Delivering app notifications
Our hosting & database provider	All account and business data	Running the servers Doroo+ runs on
Law enforcement / authorities	Relevant data, only if legally required	Legal compliance

We may also disclose information if Catuleius is involved in a merger, acquisition, or sale of assets — you'll be notified before your data becomes subject to a different privacy policy.

6. Your customers' data (online store feature)

If you use Doroo+'s online store feature, your end customers can place orders that include their name, phone number, delivery address, and province. For this data, you (the merchant/license holder) are the data controller, and Catuleius acts only as a data processor — we store and transmit this data on your behalf so your orders reach your till, but it is your responsibility to handle your own customers' data lawfully (for example, using it only to fulfill their order).

7. Security

• Passwords are hashed with bcrypt and are never stored or logged in plain text
• Login sessions use randomly generated tokens rather than reusable passwords
• Access to production data is restricted to Catuleius personnel who need it to operate the Service

No system is 100% secure. If we become aware of a data breach affecting your account, we will notify you at the phone number or contact on file, consistent with applicable law.

8. Data retention

• Mobile account data (name, phone, credentials) is kept while your account is active, and deleted within 7 business days of a verified deletion request — see Section 9.
• Business data (sales, stock, orders, analytics) is tied to your license, not to any one mobile app user, and is retained while your license is active, for your own accounting and record-keeping.
• Backups are kept on a rolling basis and are purged within 90 days of being superseded or after a deletion request.
• License validation logs (IP address, timestamp) are kept for a limited period for security purposes, then purged.

9. Your rights & account deletion

Depending on where you're located, you may have the right to access, correct, export, or delete your personal data. To request deletion of your Doroo Analytics mobile account and its associated personal data, visit our Delete Account page, which explains exactly what's deleted and what's retained. For any other privacy request, email contact@catuleius.com.

10. Children's privacy

Doroo+ is a business tool intended for merchants and their staff. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we'll remove it.

11. International data

Your data may be processed on servers located outside your country. Where we transfer data internationally, we take reasonable steps to keep it protected consistent with this policy.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above; continued use of Doroo+ after changes take effect means you accept the revised policy.

13. Contact us

Questions about this policy or your data? Email contact@catuleius.com.