RESEARCHED 24 OCTOBER 2026 · PROTOTYPE HANDOFF

From concept
to the first surprise.

Updated 25 October 2026: the catalogue now uses ten supplied product photographs and suggested names and descriptions. Prices, contents and delivery rules need merchant confirmation. The phone preview includes a browser-local editor. The separate Qhost ZIP includes a PHP product manager and settings with server-checked passwords; it requires HTTPS and first-time setup. V3 adds enlarged combo galleries, captioned component photos, moderated reviews, optional unpaid order requests, admin email settings and sales-report screens. Real requests remain disabled until the merchant enables them in Settings. No live payment gateway or paid fulfilment workflow is connected. Instagram could not be retrieved.

Verified requirements

Electronic selling licence. Ministerial Decision 25/2026 requires a commercial registration, relevant activity approvals and an identified selling site. It requires separate licensing for each site, electronic payment facilities, and visible CR/licence numbers, contact and customer-service details, product information, return policies and complaint procedures. Its definition includes social media. See the official Arabic text, Articles 1–5 and 7.

Application route. The MOCI Single Window eCommerce License service lists an active CR on the electronic licensing path, valid QID/Tawtheeq access and approximately QAR 500 annually. The permit itself does not require a physical operating location. Confirm applicability to the merchant’s exact activity; this does not waive premises or food-related approvals for other operations.

Consumer information. MOCI’s consumer guidance includes accurate information, dated invoices and Arabic-language ads, invoices, contracts and product details. This English prototype needs approved Arabic content before commercial launch.

Personal data. Qatar has Law 13/2016 on personal data privacy. The NCSA and its guidance hub provide privacy, controller/processor, rights, security and breach guidance. Both sender and recipient details need protection.

Confirm locally before launch

• Merchant identity, ownership eligibility, approved activity codes and whether gift assembly, flowers, food, storage, home operations, delivery or imports need additional licences. Check separate licensing for Instagram and the website.
• Food handling, supplier permits, allergen declarations, expiry and transport requirements if offering cakes or edible hampers.
• Approved Arabic and English disclosures; cancellation and refund rights for perishable, customised, substituted, late or failed deliveries. Do not use a blanket “no refunds” policy.
• Tax registration, accounting and invoice obligations with the General Tax Authority or a Qatar accountant. The prototype makes no tax calculation or exemption claim.
• Privacy basis for recipient information supplied by someone else, courier and hosting contracts, overseas processing, retention periods, marketing consent and complaint process.
• Actual catalogue, images and usage rights, stock, service areas, delivery costs, cutoffs, daily capacity, holiday service and verified WhatsApp number.

International payment plan

Candidate: Qatar bank hosted checkout. QNB documents hosted payments, 3-D Secure and merchant onboarding. Commercial Bank’s merchant terms list Visa International and Mastercard among supported cards. These establish options to evaluate, not approval for Fika. Ask each acquirer to confirm Qatar merchant eligibility, Indian-issued and other foreign cards, QAR settlement, fees, reserves, refunds, chargebacks and 3DS behaviour. No promise that every card will work; issuer restrictions and international-payment settings still apply. Do not assume UPI availability.

1. Backend validates products and stock, computes QAR total in integer dirhams, and reserves inventory and a delivery slot in a transaction.
2. Create a pending order and idempotent gateway session using server-held sandbox credentials. Redirect only to the approved hosted checkout; never collect PAN or CVV in Fika.
3. Verify signed gateway webhooks, timestamp, replay protection, event ID, order ID, currency and amount; query the gateway if necessary. Only a verified capture marks the order paid. Browser redirects are informational.
4. On cancellation, timeout or failure release reservations and allow safe retry. Deduplicate delayed events. Reconcile settlements and refund states; do not dispatch pending payments.
5. Complete sandbox tests, foreign-card tests, 3DS challenge/failure, duplicate webhook, timeout, amount mismatch, refund and reconciliation testing before enabling live credentials.

Admin architecture

Separate authenticated staff application with MFA and server-enforced roles: owner (staff and configuration), catalogue manager (products/stock), fulfilment (delivery details/status), support (order assistance), finance (payments/refunds). The Qhost package now implements a single-admin catalogue and settings manager. It does not yet implement these proposed staff roles or customer order management. The preview editor is only a browser-local demonstration.

Core records: Product, Variant, StockReservation, DeliveryZone, DeliverySlot (Asia/Qatar date and capacity), Order, OrderItem (price snapshot), RecipientAddress, GiftMessage, PaymentAttempt, PaymentEvent (unique provider event ID), Refund, StaffRole and AuditEvent. Keep contact details encrypted and out of logs. Store only necessary data and define deletion jobs and backups.

Service endpoints: GET /api/products; POST /api/quotes; POST /api/orders with idempotency key; POST /api/orders/:id/payment-session; POST /api/payments/webhook; authenticated staff routes for catalogue, slot capacity, order fulfilment and refunds. Validate requests, enforce rate limits and authorisation, protect staff sessions and CSRF, and use opaque customer order-access tokens.

Order lifecycle: pending_payment → paid → preparing → out_for_delivery → delivered. Cancellation, failed delivery and refunds have separate authorised transitions and audit records. Slots and stock must be reserved atomically; never trust browser prices. Courier access should reveal only the assigned recipient’s delivery details. Keep surprise preferences off recipient messages.

Launch gates

Verify licensing and merchant disclosures → approve catalogue, service rules and privacy notices → implement backend and staff access → onboard acquirer in sandbox → test security, mobile checkout, Arabic content and operational workflows → enable live payments only after merchant and acquirer sign-off.

Evidence-backed project research, not a legal clearance. Local application to this merchant remains to be confirmed. Theqa is a voluntary trustmark to evaluate after eligibility checks, not a replacement for licences. MCIT e-commerce FAQ.

Order alerts and sales reports

The Qhost version can store unpaid order requests when explicitly enabled by the administrator. New requests appear in Orders; a configured hosting mail service can email an order reference and amount to the private admin email. Inbox delivery must be tested. Sales reports use captured-payment and refund events, with Qatar date filters and CSV export; unpaid requests are excluded. No paid gateway events are created until a real acquirer integration is implemented. Browser-local demo reports are clearly labelled.

Combo galleries and feedback

Products can hold a main combo image and up to ten captioned component photos, plus a contents list. Separate component images have not yet been supplied. Customer reviews begin pending and appear publicly only after admin approval. These are customer-submitted comments, without a verified-purchase claim.