1Introduction
Bachir Ice Cream ("we", "us", "our") is committed to protecting your personal information and respecting your right to privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, with whom we share it, and the rights you have in relation to it. It applies to all users of the Bachir Delivery application ("App"). By using the App, you acknowledge that you have read and understood this Privacy Policy.
2Information We Collect
We collect the following categories of personal information:
a. Information you provide directly
- Full name
- Email address (when registering via email or Google OAuth)
- Phone number (including your WhatsApp number, used for OTP verification)
- Delivery address(es) you enter when placing an order
b. Information collected automatically
- Order history: items ordered, quantities, prices, order status, timestamps, and delivery outcome
- Loyalty programme data: stamps earned, rewards redeemed, and current programme cycle version
- Device push notification tokens (only if you opt in to push notifications)
- Session tokens and authentication state maintained for account security
c. Location data
- Your approximate or precise GPS coordinates, collected only when you actively use the App to select a delivery location or identify your nearest store
d. Information from third parties
- If you sign in using Google OAuth, we receive your name and email address from Google as provided by your Google account settings
3How We Use Your Information
We use the information we collect for the following purposes:
- To create and manage your user account
- To process and fulfil your orders and coordinate deliveries
- To calculate delivery routes, distances, and estimated delivery times
- To send you real-time order status updates via push notifications (if you have opted in)
- To manage and track your loyalty programme stamps and rewards
- To communicate with you about your orders via WhatsApp or in-app messaging
- To improve the App's functionality, performance, and user experience
- To detect, prevent, and address fraud, abuse, or security incidents
- To comply with applicable legal obligations
4Legal Basis for Processing
We process your personal data on the following legal bases:
Contractual necessity: To fulfil your orders, process payments (cash on delivery), coordinate deliveries, and provide you with the core service.
Legitimate interests: To manage our loyalty programme, improve our services, ensure security, and prevent fraud, where these interests are not overridden by your rights.
Consent: For push notifications. You may withdraw your consent at any time through your device settings or within the App, and doing so will not affect the lawfulness of processing before withdrawal.
Legal obligation: Where we are required to process or retain data to comply with applicable laws and regulations.
5How We Share Your Information
We do not sell, rent, or trade your personal data. We may share your information only in the following limited circumstances:
Infrastructure & authentication provider: We use Supabase (supabase.com) as our database, storage, and authentication infrastructure. Your account data, order history, and loyalty data are stored on Supabase-managed servers. Supabase processes data in accordance with its own privacy policy and applicable data protection legislation.
Delivery operations: Limited contact information (such as your name and phone number) and order details may be accessed by our delivery personnel solely to fulfil your delivery.
Legal compliance & safety: We may disclose your information if required to do so by law, court order, or a competent governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Bachir Ice Cream, our users, or the public.
Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred to the relevant third party, subject to equivalent privacy protections.
6Location Data
6.1 We access your location only when you actively use the App to: (a) determine your delivery address; (b) select your nearest store; or (c) calculate estimated delivery times.
6.2 We do not track, monitor, or record your location in the background when the App is not actively in use.
6.3 Location data is used solely to provide the delivery service and is not sold, shared with advertisers, or used for any other commercial purpose.
6.4 You may deny location access through your device settings, but doing so may impair the App's ability to automatically select your nearest store or pre-fill your address.
7Push Notifications
7.1 If you opt in to push notifications, we store a device-specific push token to deliver real-time order status updates directly to your device.
7.2 Push notifications are used solely for transactional purposes relating to your orders (e.g. order confirmed, out for delivery, delivered). We do not send unsolicited marketing notifications.
7.3 You may withdraw consent to push notifications at any time by disabling them in your device settings or through the notification management options in the App. This will not affect orders already placed.
7.4 Push tokens are deleted from our systems when you unsubscribe from notifications or when your account is deleted.
8Authentication & Account Security
8.1 We support authentication via email and password, Google OAuth, and WhatsApp OTP phone verification. Each method is designed to verify your identity securely before granting account access.
8.2 Passwords are never stored in plaintext. All authentication is handled through Supabase's secure, industry-standard authentication infrastructure, which employs encryption at rest and in transit.
8.3 We implement appropriate technical and organisational security measures to protect your data against unauthorised access, alteration, disclosure, or destruction.
8.4 You are responsible for maintaining the security of your own account credentials. Notify us immediately if you suspect any unauthorised access to your account.
9Data Retention
9.1 We retain your personal data for as long as your account is active, or for as long as is necessary to provide the Service and fulfil the purposes described in this Policy.
9.2 Order history and loyalty data are retained to enable you to view past orders, track accumulated stamps, and resolve any disputes relating to your account.
9.3 If you request deletion of your account, we will delete or irreversibly anonymise your personal data within a reasonable time, except where retention is required by law (for example, for tax, accounting, or legal compliance purposes).
9.4 Push notification tokens are removed promptly when you unsubscribe or when your account is deleted.
10Your Rights
Subject to applicable law, you have the following rights in relation to your personal data:
Right of access: You may request a copy of the personal data we hold about you.
Right to rectification: You may request that we correct inaccurate or incomplete personal data.
Right to erasure: You may request deletion of your personal data ("right to be forgotten"), subject to any legal retention obligations.
Right to data portability: You may request your data in a structured, commonly used, machine-readable format.
Right to object: You may object to the processing of your personal data in certain circumstances, including processing based on legitimate interests.
Right to withdraw consent: Where processing is based on consent (e.g. push notifications), you may withdraw your consent at any time without affecting prior processing.
To exercise any of these rights, please contact us through the Help section of the App or via WhatsApp. We will respond within a reasonable time and in accordance with applicable law. We may need to verify your identity before processing your request.
11Cookies & Local Storage
The App uses browser cookies and local storage to maintain your session, remember your language preference and selected store location, and keep you signed in between visits. These are essential for the App to function correctly. We also use Microsoft Clarity to understand how visitors navigate the customer app, including pages viewed, clicks, scrolls, and session recordings, so we can improve usability and troubleshoot issues. We do not use this for advertising.
12Children's Privacy
The App is not directed at children under the age of 16, and we do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16 without appropriate consent, we will take prompt steps to delete that information. If you believe a child has provided us with personal data, please contact us immediately.
13Third-Party Links & Services
The App may contain links to external websites or services, including Instagram and WhatsApp. We are not responsible for the privacy practices, content, or security of any third-party platforms. We encourage you to review the privacy policies of any third-party service you access through links in the App.
14International Data Transfers
Your data is stored and processed on servers managed by Supabase. Supabase may process data in multiple jurisdictions. Where data is transferred outside your country of residence, Supabase applies appropriate safeguards in accordance with applicable data protection law. For more information, please refer to Supabase's privacy policy at supabase.com/privacy.
15Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will revise the "Last updated" date at the top of the page. Your continued use of the App after changes are posted constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.
16Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us through the Help section of the App or via WhatsApp. We take your privacy seriously and will do our best to address your concern promptly.