Data Handling

1. Data We Collect

Mall Drop collects only the data necessary to provide our marketplace services. Here is a complete breakdown by category:

Personal Identity Data

Transaction Data

Location Data

Device and Security Data

Content Data

2. How Data Flows Through Our System

Understanding the journey of your data from collection to storage:

3. Where Your Data Is Stored

Cloud Infrastructure (Supabase)

• PostgreSQL Database: User profiles, orders, products, payments, support tickets, reviews, store information, and all relational data.
• Object Storage Buckets:
  • product-images — Product photos uploaded by vendors.
  • store-assets — Store logos, banners, and branding images.
• Supabase Auth: Password hashes, authentication sessions, and email/phone recovery tokens.

On Your Device

• Flutter Secure Storage: Authentication tokens (access and refresh tokens) stored using platform-native encryption:
  • iOS: Keychain Services (hardware-backed encryption)
  • Android: EncryptedSharedPreferences (AES-256 encryption)
• SharedPreferences: Non-sensitive app settings only:
  • Theme preference (light/dark mode)
  • Onboarding completion status
  • Language preference

4. Data Protection Measures

Encryption

• In Transit: All API communication uses HTTPS with TLS 1.2+ encryption.
• At Rest: Authentication tokens are encrypted using platform-native secure storage. Database connections use SSL.
• Passwords: Hashed using bcrypt through Supabase Auth — plaintext passwords are never stored or transmitted after initial processing.
• PIN Codes: Hashed using PBKDF2-HMAC-SHA256 with unique salts before storage. Plaintext PINs are never persisted.

Access Controls

• Row Level Security (RLS): Database-level policies ensure users can only read and modify their own data. Vendors can only access their own store and products. Admins have broader access for platform management.
• Role-Based Access: The app enforces role-based navigation and API access — buyers cannot access vendor management screens, couriers cannot access admin tools, etc.
• JWT Authentication: Every API request includes a signed JSON Web Token that validates the user's identity and permissions.

Session Security

• 30-Minute Timeout: Sessions automatically expire after 30 minutes of inactivity, requiring re-authentication.
• Token Refresh: Access tokens have short lifespans and are refreshed automatically. Expired refresh tokens require a full login.
• Biometric Verification: Users who enrol in biometric authentication can use Face ID or fingerprint for quick, secure re-authentication and payment confirmation.
• PIN Verification: A secure PIN serves as both a login method and a payment confirmation step, providing an additional layer of identity verification.
• Device Trust: Devices can be registered and tracked for additional security context.

5. Third-Party Data Sharing

We share data with the following third-party services, limited to what is strictly necessary for their function:

6. Data Retention Schedule

7. Your Data Rights

You have control over your personal data. Here's how to exercise your rights:

8. Data Breach Protocol

In the event of a data breach, Mall Drop commits to the following response:

1. Detection & Containment: Immediately identify the scope and contain the breach to prevent further data exposure.
2. Assessment: Evaluate the nature and extent of the compromised data.
3. Notification: Notify affected users within 72 hours of breach confirmation, including details of what data was affected and recommended protective actions.
4. Regulatory Reporting: Report to relevant data protection authorities as required by applicable law.
5. Remediation: Implement corrective measures to prevent recurrence and communicate these to affected users.

9. Contact Our Data Team

For any questions about how we handle your data, or to exercise your data rights: