Privacy Policy
This policy explains what information Dalo collects, why, and what we do with it. We keep it short and literal. If something is unclear, email us.
1. Information we collect
From merchants (people who sign up)
- Account details: your email address, business name, optional phone or Telegram handle, and the plan you are on.
- Store details: the public ABA Payment Link you paste, the merchant name ABA displays for it, your chosen store name and checkout colour.
- Payment records: for every payment you create, the amount, currency, reference id, metadata you send, status history and timestamps, and the QR image generated for it.
- Integration details: API keys (stored encrypted so you can view them again in your dashboard), webhook URLs and delivery logs (HTTP status and errors).
- Technical data: IP address and basic request logs used for security and abuse prevention, and a session cookie to keep you signed in.
From customers (people who pay a merchant)
- When a customer opens a checkout page we see the payment they are viewing, their IP address and browser type. We do not see or store bank account numbers, card numbers, PINs or banking app credentials. The payment itself happens inside the customer's own banking app with ABA.
- Any personal data in a payment reference or metadata is put there by the merchant; the merchant is responsible for it.
We never ask for, and you must never give us, your ABA online banking password, PIN or OTP codes.
2. How we use it
- To run the service: create QR codes on your ABA Payment Link, detect paid status, show your dashboard, deliver webhooks, send sign-in codes and service emails.
- To bill paid plans and apply plan limits.
- To keep the service secure: rate limiting, fraud and abuse detection, debugging.
- To tell you about changes to the service or these terms. We do not send marketing email unless you ask for it.
We do not sell personal data and we do not use it for advertising.
3. How payments are detected
To generate a QR and detect payment, our servers request an amount-specific QR from the public web page of your ABA Payment Link, the same page a customer would use, and read the payment status that page reports (for example "paid"). We use only what that public page makes available. We do not log in to ABA and we do not access ABA's private systems.
4. Who we share data with
- Cloudflare, Inc. hosts the Dalo application and database and serves the checkout pages. Data may be processed in Cloudflare data centres outside Cambodia.
- Google (Gmail) delivers sign-in codes and service emails, so your email address passes through Google's mail servers.
- ABA Bank receives the amount for each QR through your own Payment Link page, exactly as if you had typed it there yourself.
- Your webhook endpoints receive payment events you configure.
- Authorities, when the law requires it, or professional advisers under confidentiality.
The systems that operate your Payment Link page run on Cloudflare and on infrastructure controlled by us in Cambodia.
5. Retention
- Payment records are kept while your account exists and for up to 5 years afterwards for accounting and dispute purposes, unless the law requires longer.
- QR images are kept for 90 days.
- Sign-in codes are deleted after use or 10 minutes; sessions expire after 30 days.
- Request logs are kept for up to 30 days.
- Daily backups are kept for 30 days on infrastructure we control in Cambodia.
6. Security
All traffic uses HTTPS. API keys are stored encrypted with a key that is not kept in the database, and are shown only to the signed-in account owner. Webhooks are signed so you can verify they come from us. Access to production systems is limited to the operator. No system is perfectly secure; if we learn of a breach affecting your data we will inform you without undue delay.
7. Cookies and local storage
Dalo uses one session cookie (dalo_session) to keep you signed in, and browser local storage to remember your theme choice. There are no advertising or tracking cookies and no third-party analytics scripts.
8. Your rights
You can see and edit your account details in the dashboard. You can ask us to export or delete your data, correct it, or close your account by emailing us; we will respond within 30 days. We may keep records we are legally required to keep. If you are in a jurisdiction with data-protection law that applies to you, you have the rights that law provides.
9. Children
Dalo is for businesses and is not directed at anyone under 18.
10. Changes
We will post updates here with a new effective date and, for material changes, notify you by email or in the dashboard.
11. Contact
Dalo Desk · Dalo Chat · Phnom Penh, Cambodia · support@dalodesk.com · Telegram @dalodeskbot