Makolet.store

Makolet.store is a Swiss-designed, Hebrew-first B2B mini-market platform that collapses five vendor categories — point of sale, e-commerce, delivery, marketing and business intelligence — into one product for the corner-store economy, priced at a single flat fee per tenant. Customers order through a per-tenant web storefront, tenant operators run their business from a Hebrew-first dashboard, drivers work from an installable PWA, and platform administrators oversee billing, fraud and platform health from a separate console.

The platform is live in production at https://makolet.store/. It is zero-ORM, with every database query built on parameterised PDO, and multi-tenant, serving customers across eight live languages with Hebrew as the primary market.

At a glance

• Status: Live, in production.
• Current version: 1.1.0 (released 2026-07-24).
• Pricing: A flat 499 ILS per tenant per month. No self-service plan tiers.
• Audience: Hebrew-first mini-market operators, their customers, delivery couriers, and the platform operator.
• Languages: 8 live, with right-to-left layout for Hebrew, Arabic and Yiddish.
• Licence: Proprietary. All rights reserved.

Who it serves

• Tenant operators. Hebrew-first shopkeepers, often single-branch, who want to sell more without learning new software.
• Customers. They want to re-order in seconds, without installing another native app.
• Drivers and couriers. They want to maximise earnings per shift, including on patchy connectivity.
• Platform administrators. They keep tenants healthy, revenue compliant, and integrations working, from a dedicated command centre.

Core capabilities

Storefront and ordering. A per-tenant web storefront at a dedicated path or the tenant’s own domain, installable as a PWA, with a multi-level catalogue of categories, products, variants, brands, ingredients and allergens. Cart and language preference are held in Redis for the session.

Payments and billing. Tenant subscriptions run through PayPal at the flat monthly fee. Customers pay by PayPal, cash on delivery, in-house instalment credit, or bank transfer, with automatic account top-up and a grace period before an overdue account is actioned.

Fulfilment and delivery. Orders move through a defined lifecycle from placed to delivered. Dispatch scores the nearest available driver, with manual override and route optimisation for multi-stop runs. Drivers work from an offline-capable PWA that syncs every 30 seconds, and a delivery can be tracked from a signed, shareable link.

Loyalty and marketing. A points-and-tiers loyalty programme, a promotion engine (codes, buy-one-get-one, percentage and fixed discounts), and a recipe book used to draw organic traffic. Segmented campaign, abandoned-cart and feedback-request infrastructure is in place; outbound delivery for it is being rebuilt around email after the platform’s prior WhatsApp channel was retired.

Trust and fraud protection. Every order is scored in real time on a fraud scale from 0 to 100, with allow, monitor, review and block outcomes. A file-integrity monitor takes a SHA-256 baseline sweep every 15 minutes, and an internal incident-learning system tracks findings over time.

Multi-branch and multi-tenant operations. Tenants with more than one branch get per-branch stock and product overrides. Tax rates are configurable per tenant. Bulk catalogue, price and stock changes come in through a CSV import tool with inline validation and background processing for larger files.

Operator console and integrations. A separate admin console covers billing, fraud review, tenant health and integration status. The platform connects to point-of-sale (Clover, Square), accounting (Xero, QuickBooks), CRM (HubSpot, Mailchimp) and delivery-partner (Wolt, Gett) systems.

Discovery and content engines

A three-pillar discovery system, built in-house, auto-emits structured data on every public route: traditional search engines (JSON-LD, sitemaps, a push feed to Bing, Yandex, Seznam and Naver, and a Google Merchant feed), local and map search (Google Business Profile sync, name-address-phone consistency, delivery-zone coverage) and AI answer engines such as ChatGPT, Claude, Gemini and Perplexity (Schema.org typed content, FAQ and review markup written for model-mediated answers rather than ranked links). A daily audit scores each tenant across all three pillars and surfaces unresolved findings on the tenant dashboard.

An optional, off-by-default worker can bulk-generate product copy, SEO meta, AI-answer FAQs and spoken-style summaries using Claude, budgeted per tenant per day. Nothing it generates reaches the storefront, or the structured data emitted from it, until a tenant reviews and applies it.

Internationalisation and accessibility

The dashboard is live in 8 languages — Hebrew, English, Arabic, Russian, French, Spanish, German and Yiddish — with Hebrew and English co-canonical and the rest held to full parity by an automated check that blocks merges on drift. Hebrew, Arabic and Yiddish render right-to-left using logical CSS throughout, not a mirrored stylesheet.

The interface is WCAG 2.1 AA conformant, re-certified at major releases: every modal traps focus and is dismissible by Escape, reduced-motion preferences are honoured globally, and a standing headless-browser audit exercises public and signed-in pages alike for accessibility, console, network and performance regressions.

Quality and assurance

At version 1.1.0 the automated suite stands at 2,946 tests and 7,655 assertions with zero failures, covering 100 percent of controllers and services. Every SQL query is built on parameterised PDO with a regex allowlist on column names and an enum allowlist on operators, rather than relying on an ORM. Continuous integration runs a syntax sweep, the unit and integration suites, a build check, and a translation-parity gate across all 8 languages before merge, followed by a post-merge smoke test against staging.

Security is tracked as a first-class metric: an internal scorecard currently reads 10 out of 10, with zero open critical, high or medium issues. Compliance is treated the same way, with 13 frameworks — including GDPR, SOC 2, PCI DSS and ISO 27001 — mapped to 38 individually checked controls whose evidence is collected daily rather than assembled for an audit.

Technology summary

The stack is a conventional, self-hosted single-host deployment:

• PHP 8.4 (FPM, OPcache and JIT) on Debian.
• MariaDB 10.11 for all persistent, tenant-isolated data.
• Redis 7.2 for sessions, locks, queues, rate limiting and fraud state.
• Vite, Tailwind CSS 3.4 and Alpine.js 3.13 on the front end, served through Nginx.

Content-security-policy protection runs without “unsafe-eval” on every surface, using a CSP-safe expression evaluator for Alpine rather than the usual dynamic-code path.

Design principles

• A Swiss design system: three colours, two typefaces, one alert colour, square corners and heavy borders, with no exceptions.
• Logical CSS only, so the right-to-left languages are a first-class layout, not a mirrored one.
• Primary actions live in the bottom third of the screen, within easy thumb reach on a phone.
• Data reads as data: prose uses one typeface, numbers, prices and identifiers use a monospaced one.
• Verification over assertion: security, compliance and discovery all run as live, scheduled checks against the running system rather than being written into documentation once and left to go stale.

Intellectual property notice

Makolet.store is proprietary software. Its source code, fraud-scoring model, discovery and content-generation logic, data model, documentation and branding are the property of the project owner. This description is a summary for portfolio purposes only. It intentionally leaves out source code, fraud-scoring thresholds and rules, database schema, credentials and configuration, infrastructure and host details, security controls, and operational and recovery procedures. It grants no licence to use, copy or reproduce any part of the product. Any use beyond reading this summary needs written permission from the owner.