Privacy Policy

Dulaxa is the data controller for the personal data described in this policy — meaning we decide why and how it is processed.

Dulaxa — Cairo, Arab Republic of Egypt. Email: hello@dulaxa.com. WhatsApp: +20 10 1191 1502.

We collect only what the service actually needs. Concretely:

• Enquiry details — when you submit the Start form: your name, email address, the occasion, your event date, and the description of your vision.
• Account details — if you create an account: your email address, an encrypted password (we never see or store the plaintext), and optionally your full name, phone number, and profile photo.
• Project data — the invitations, media, and other content we create with you or that you upload, including images you add to a project.
• Messages — the contents of the conversation between you and the studio inside your dashboard.
• Billing records — invoice numbers, amounts, currency, status, and due dates. We do not process or store card details (see §7).
• Technical and performance data — your IP address and browser user-agent are processed transiently by our host to serve the site securely. We also collect anonymous Core Web Vitals (page-load and responsiveness measurements) via our own endpoint; these contain no identifiers and are not linked to you.

We do not sell personal data. We do not use it for behavioural advertising, and we do not run third-party advertising or tracking scripts on this site.

We rely on a small, deliberate set of providers. Each is bound to process data only on our instructions.

Our database is hosted in the European Union. Some providers listed above may process data outside Egypt or the EU. Where that happens, we rely on the provider's contractual safeguards (such as Standard Contractual Clauses) to keep the protection of your data intact in transit and at rest.

• Enquiries that do not become projects: up to 24 months, then deleted.
• Account and project data: for as long as your account is open, and for up to 12 months after you close it, so that a project can be restored if you return.
• Invoices and accounting records: retained for the period required by Egyptian tax and commercial law.
• Anonymous performance metrics: retained in aggregate only; they contain no personal identifiers.
• Backups: our database backups roll on a 30-day window, after which deleted data ages out.

We do not currently take card payments through this website, and we never store card numbers, CVVs, or bank credentials. Invoices are issued from your dashboard and settled by the method agreed with you. If we introduce online payments in the future, they will be handled by a PCI-compliant payment processor and this policy will be updated before that happens.

• All traffic is served over HTTPS with HSTS enforced.
• The application sends a strict Content-Security-Policy and related hardening headers to defend against injection and clickjacking.
• Database access is governed by row-level security: you can read and write your own records, and nobody else's.
• Passwords are hashed by our authentication provider; the studio never has access to them.
• Administrative access is restricted to authorised studio accounts.

Under Egypt's Personal Data Protection Law (Law No. 151 of 2020) — and, where it applies to you, the EU/UK GDPR — you have the right to:

• Know what personal data we hold about you and obtain a copy of it.
• Have inaccurate or incomplete data corrected.
• Have your data erased where we no longer have a lawful reason to keep it.
• Restrict or object to certain processing.
• Withdraw consent at any time, where we relied on consent.
• Receive your data in a portable, machine-readable format.
• Lodge a complaint with the Egyptian Personal Data Protection Centre, or with your local supervisory authority.

Write to hello@dulaxa.com from the address associated with your account. We will respond within 30 days. We may ask you to verify your identity before acting, so that nobody else can make a request in your name. Exercising these rights is free.

Dulaxa is a service for adults commissioning professional work. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

We will update this page when our practices change, and we will move the “last updated” date at the top. If a change materially affects your rights, we will tell you directly — by email to account holders — rather than relying on you to notice.