Privacy Policy — Diwan

What the extension reads

It works inside the session you opened on your supplier's website and reads: supplier catalog data (item names, codes, barcodes, prices, pack sizes); your purchase history with that supplier (item, quantity, price paid, date); files you upload yourself (shortage lists, invoices); for a supplier site Diwan does not support yet, a technical description of how the site is built — its service addresses, field names and types, and counts about them (for example, how many items have a zero price), with no values, item names, passwords or tokens, sent only when you press “Sync” on an unsupported site or “Record this supplier”, so support can be added; when a step fails (sync, purchases pull, recording), a description of the failure — the step, the error type, the supplier, the extension version and the time — and the line count when a purchases pull succeeds, with no prices or tokens, and addresses without their parameters, so we can notice a problem before you have to report it; and the temporary session token the supplier's own site places in your browser — which stays in your browser and is never sent to us.

What we never read or store

Passwords (never read, entered, or stored). API keys in your browser — the AI provider key lives only on our server. Your email or messages. Your browsing history, or any page outside the supplier sites you authorised. Payment card or bank details.

Where data is stored

Your browser: pulled catalogs, price-change history, and your settings — removed when you remove the extension. Our server (api.diwanstaff.com, Virginia, USA): a copy of catalogs to build price history across your devices, and chat messages at the time they are sent. Each store is isolated by its own token and its own data directory.

Service providers

Anthropic — when you use the chat tab, your question and the related computed data are sent to generate a reply; nothing is sent if you do not use chat. “Find a wholesaler”: when you search for a product, only the product name you typed is sent, to search public websites for wholesale suppliers that list it — never your store name, token, or any other data. Our server keeps the query and its result for 7 days so a repeat search costs nothing, and counts searches per store for the daily limit. “Supplier without a website”: when you add a past supplier invoice, its file (PDF or photo) is sent through our server to read its lines; the lines come back and are stored only in your browser — our server does not keep the invoice or its lines. When you prepare an order, only what it needs is sent: the supplier's items from your invoices (without prices), shortage items, your requests and answers, and the supplier, rep and store names for the signature. The result is a draft: Diwan never sends any message or email to any supplier — you send it yourself from your own mail or phone. Amazon Web Services — server hosting. We use no tracking or advertising tools, and we do not sell or share data for marketing.

Permissions

storage and unlimitedStorage to keep catalogs and settings in your browser (a single supplier catalog can exceed 4 MB); scripting, tabs, activeTab to read the supplier page you have open when you press “Sync”; supplier site access to pull catalogs and purchase history; and access to api.diwanstaff.com, the Diwan service your store subscribes to — supplier settings come from it, and catalogs and chat questions are sent to it.

Retention and deletion

Browser data is removed when the extension is removed, or via the delete button inside it. Server data is kept while your subscription is active and deleted within 30 days of your request or of the subscription ending. To request a copy or deletion: m.alqatari@saudiahuniversal.org.

Children

This is a business tool intended for commercial use, not for anyone under 18.

Changes

Material changes are posted on this page with their date, and subscribed stores are notified before they take effect.

Contact

Diwan · m.alqatari@saudiahuniversal.org