Privacy Policy

About this policy

This Privacy Policy explains how DIP – Digital Industrial Platform (“DIP”, “we”, “us”) collects, uses, shares and protects personal data when you use:

the website dipengine.com;
the DIP web app at system.dipengine.com;
the DIP mobile app for iOS and Android (app ID com.dip.platform).

Together we call these “the Service”. DIP is a business-to-business platform: it is built for factories, suppliers, buyers and industrial service providers, and for the people who use it on behalf of their business. One DIP account works in the web app and in the mobile app.

Who we are

The Service is operated by DIP – Digital Industrial Platform, which is responsible for the personal data described in this policy.

For any privacy question or request, write to info@dipengine.com. Our office is at 20 Abu El Mahasen El Shazly St., Mohandessin, Giza, Egypt.

Personal data we collect

Account and profile

When you create an account, or accept an invitation to one, we collect your e-mail address and password (stored only as a secure hash, never in readable form), your full name, phone number, job role and preferred language. We also keep sign-in records and the session data that keeps you signed in.

Your business

When you register a business we collect its details: account type, legal name in English and Arabic, industry and activities, location and addresses, contact phone, tax ID and commercial registration number and — if you upload them — the tax card and commercial registration documents. We also record who belongs to the business and their roles, and the e-mail addresses of people invited to join it.

Business profile and marketplace listings

If your business publishes a profile or listings on the DIP marketplace, the information it chooses to publish — such as the business name, logo, description, products, and the business contact e-mail, phone and website — is public: anyone can see it, including on dipengine.com.

What you do in the Service

The products, prices, stock, customers, quotations, orders, requests for quotation (RFQs), RFQ responses, messages exchanged between businesses, notes and other records you create while using DIP.

Files you upload

Product images and documents, RFQ attachments (for example drawings and specifications), business registration documents and payment receipts.

Notifications and devices

In-app notifications and your notification preferences. If push notifications are enabled in the mobile app and you allow them, we also store a push token for your device with its platform, language and app version. E-mails and push messages from DIP never contain prices, quantities, message text or the names of other businesses.

Subscriptions and billing

If your business takes a paid plan we keep its billing details (legal name, tax ID, billing address and e-mail), invoices, payment and refund records, subscription history and the payment receipts you upload. DIP does not currently take card payments online: payments are made offline (for example by bank transfer or cash) and confirmed by our team. We never receive or store card numbers.

Website forms

When you use the contact, registration (“Join DIP”) or request-for-quotation forms on dipengine.com we collect what you enter: your name and e-mail address, your phone and company (required for registration, optional otherwise), and the form's own fields — the topic and message; the account type, industry, role and location; or the requirement, industry, quantity and target date. The message is stored in DIP's database and forwarded by e-mail to our team at info@dipengine.com.

DIPI, the website assistant

DIPI answers only from the content of this website. Your questions are matched inside your own browser and are never sent to DIP or to any AI provider. The conversation is kept in your browser for the current visit only.

Usage and technical data

Website analytics: where enabled, dipengine.com uses PostHog to count page views and clicks on buttons such as “View demo” or “Join DIP”, and to record that a form was sent (never what you typed in it). See “Cookies and similar technologies”.
Marketplace view counts: to count how often a public profile or listing is viewed we use a random key per visit. It is not linked to an account, DIP does not store IP addresses for it, and the key is discarded the next day once it has been added to daily totals.
Error reports: where enabled, the web and mobile apps send technical error reports to Sentry. They are designed to contain no personal data — no user identity, no request content and no web addresses with parameters.
Server logs: our servers keep the standard technical logs needed to run and protect the Service. The application removes tokens, keys, e-mail addresses and query strings from them.
Audit log: to protect the integrity of business records, the Service records which user made which change and when.

The mobile app contains no advertising or analytics SDKs, and DIP does not track you across apps or websites owned by other companies.

Information about other people

Businesses can keep information about people at other organisations in their own records — for example customer contacts, delivery contacts and addresses. The business that enters this information is responsible for having the right to do so; DIP stores and processes it on that business's behalf. If your details appear in a business's records, please contact that business first; we will help where we can.

How we use personal data

We use personal data to:

create and run your account, sign you in and keep your session secure;
set up and run your business on DIP, including its members, roles and invitations;
publish the business profiles and listings that businesses choose to make public on the marketplace;
let businesses send and answer RFQs, place and fulfil orders and exchange messages;
send service e-mails and, if you allow them, push notifications — for example to confirm your e-mail address, reset your password, deliver invitations and tell you about activity you asked to be notified about;
review business registration documents and payment receipts, issue invoices and manage subscriptions;
answer the messages you send us through the website or by e-mail;
keep the Service secure and reliable: prevent abuse and fraud, limit repeated submissions, handle reports about marketplace content, investigate errors and keep the audit log;
understand, in aggregate, how the website and the Service are used, so we can improve them;
meet our legal, tax and accounting obligations.

We do not use personal data for advertising, we do not sell it, and we do not use it for profiling that has legal or similarly significant effects on you.

Legal bases

Depending on the law that applies to you, we process personal data on these grounds:

Contract — to provide the Service you or your business signed up for.
Legitimate interests — to keep the Service secure, prevent abuse, improve the Service and communicate with businesses, in ways that do not override your rights.
Legal obligation — for example to keep accounting and tax records.
Consent — where it is required, for example for push notifications and, where applicable, website analytics. You can withdraw consent at any time; this does not affect processing that happened before.

Everyone: the business profile and listings your business publishes on the marketplace are public.
Businesses you deal with: when you send or answer an RFQ, place or receive an order or exchange messages, the other business sees the information involved — such as your business name, the contact name and phone for a delivery, and the messages themselves.
Members of your business: members with the right permissions see the business's records and the names and e-mail addresses of the other members.
DIP staff: authorised staff can access data only when it is needed to support you, review business documents and payment receipts, moderate the marketplace or keep the Service secure. Their access is limited by permissions and recorded.
Service providers that host or operate parts of the Service for us (see the next section), only for that purpose and under their contractual obligations.
Authorities and legal claims: when the law requires it, or when it is necessary to protect the rights, property or safety of DIP, our users or others.
A successor: if DIP is reorganised, merged or sold, personal data may pass to the new operator, which must continue to protect it as described in this policy.

We do not sell personal data, we do not share it with advertisers, and we do not use it to track you across other companies' apps or websites.

Service providers

We use a small number of service providers:

DigitalOcean — hosting. The servers that run the website and the web app, and DIP's own installation of the database, sign-in and file storage (api.dipengine.com), run on DigitalOcean.
Zoho ZeptoMail — sends DIP's service e-mails (account confirmation, password reset, invitations and notifications) and forwards website form messages to our inbox.
PostHog — website analytics on dipengine.com, only where enabled.
Sentry — technical error reports from the web and mobile apps, only where enabled. Reports are designed to contain no personal data.
Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) — deliver push notifications to the mobile app, only if push notifications are enabled and you allow them.
Apple App Store and Google Play — distribute the mobile app. When you download or update it, Apple and Google process data under their own privacy policies.

Cookies and similar technologies

Website: dipengine.com uses no advertising cookies. It uses your browser's session storage to remember the DIPI conversation and dismissed tips during your visit. Where website analytics is enabled, PostHog stores a random identifier in a cookie and in your browser's local storage to recognise repeat visits. You can block or delete these in your browser settings; the website keeps working without them.
Web app: system.dipengine.com uses only the storage it needs to keep you signed in and remember your preferences.
Mobile app: the app keeps your sign-in session in your device's secure storage (Keychain on iOS, Keystore on Android) and a few preferences, such as your language, on the device.

How long we keep data

Account, profile and business data: for as long as your account and your business exist on DIP. What happens when you delete your account is explained in the next section.
Business records (products, stock, quotations, orders, RFQs, messages and their documents): for as long as the business exists on DIP, and longer where legal, tax or accounting rules require it. Records shared with another business remain part of that business's records.
Invoices, payments and other billing records: for as long as accounting and tax rules require.
In-app notifications: 180 days.
Delivery records of e-mails and push messages: 90 days.
E-mail provider events (bounces and complaints): 30 days. To respect an unsubscribe or a bounce we keep only a one-way hash of the address, never the address itself.
Push tokens: deleted 30 days after the device is signed out or the token is revoked; a device that has not been used for 270 days is revoked automatically.
Marketplace visit keys: one day.
Website form messages: for as long as we need them to answer you and keep a record of our correspondence. You can ask us to delete them.
Audit log: kept to protect the integrity and security of business records; entries of a deleted account are kept or de-identified.
Backups: kept for a limited period and then replaced. Data deleted from the live system disappears from the backups when they roll off at the end of the backup window.

Account deletion

You can delete your DIP account at any time.

In the app

Mobile app: open the Account tab → Delete account.
Web app (system.dipengine.com): go to Settings → Profile → Delete account.

You can also ask us to delete your account without using the app — see Delete your DIP account.

What is deleted

Your sign-in account and password, your profile (name, phone, job role and language), your memberships, invitations addressed to you, your notification preferences, your push tokens and your sessions on all devices.

What is kept or de-identified

Records shared with other businesses that they rely on — such as orders, quotations, RFQs, RFQ messages and the documents attached to them — remain part of those businesses' records. Your name is removed from them or replaced (de-identified) where possible.
Invoices, payments and other billing records are kept for as long as accounting and tax rules require.
Audit records are kept or de-identified to protect the integrity and security of business records.

If you own a business

If you are the only Owner of a business that has other members, you must first transfer ownership to another member.
If you are the business's only member, the business is closed when you delete your account, and its profile and listings are removed from the marketplace.

Backups

Deleted data may remain in backups until they roll off at the end of the backup window. It is not used in the meantime.

How we protect data

We protect personal data with measures that include:

strict separation of each business's data in the database (row-level security) and permission-based access for members and staff;
encrypted connections (HTTPS) between your device and our servers;
passwords, invitation links and registration links stored only as hashes;
private files served only after a permission check, through short-lived links;
sign-in sessions kept in the secure storage of your mobile device;
no personal data in error reports, alerts or application logs;
an audit log of changes and regular backups.

No system is completely secure. If you believe your account has been compromised, contact us at info@dipengine.com straight away.

International transfers

Our servers and service providers may be located in countries other than yours. When personal data is transferred across borders we take steps to keep it protected as described in this policy — for example by relying on our providers' contractual commitments and security measures.

Children

The Service is meant for businesses and for people aged 18 or over who use it on behalf of a business. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Your rights

Depending on the law that applies to you, you can ask us to:

give you access to the personal data we hold about you, or a copy of it;
correct data that is wrong or incomplete — you can change most profile details yourself in the app;
delete your account and personal data (see “Account deletion”);
restrict or object to certain processing;
withdraw a consent you gave, for example by turning off push notifications.

Send your request to info@dipengine.com from the e-mail address of your DIP account. We may need to confirm your identity first, and we reply within 30 days. You may also have the right to complain to the data-protection authority where you live.

Changes to this policy

We may update this policy when the Service or the law changes. We will publish the new version on this page with a new “Last updated” date and, for significant changes, let you know in the app or by e-mail.

Contact us

For questions, requests or complaints about privacy, contact DIP – Digital Industrial Platform at info@dipengine.com, or write to us at 20 Abu El Mahasen El Shazly St., Mohandessin, Giza, Egypt.