Privacy Policy

Sallimni — Delivery Platform

1. Introduction

Sallimni respects the privacy of its users (customers, merchants, and drivers) and is committed to protecting their personal data. This policy explains what data we collect, how we use it, and your rights as a user.

2. Data We Collect

2.1 Account Data

• Mobile phone number (for login via OTP verification).
• Full name (optional for customers, required for merchants and drivers).
• Email address (optional — for drivers).
• Physical address and store/working-area coordinates (for merchants and drivers).
• Verification documents (images): ID or business license for contracted merchants, and driver's license, vehicle license, ID, and insurance for drivers.

2.2 Usage Data

• Geolocation — requested when creating an order (customer), or throughout the time a driver is "Online / available for orders" (driver — via a foreground service with a visible notification).
• Photos of items uploaded by customers or merchants, and pickup/delivery proof photos from drivers.
• Text, voice, and image messages exchanged between parties.
• Order and transaction history.
• Search terms and part names you enter — to improve the in-app parts dictionary.
• Ratings and reviews you write about merchants or drivers.

2.3 Technical Data

• Device identifier for push notifications (Firebase Cloud Messaging).
• Operating system type and app version number.
• IP address on service access (for security purposes only).
• Crash reports and diagnostic data (device type, OS version, app version, stack trace) — to detect, fix, and improve stability. Does not include your message content or personal data.

3. How We Use Your Data

• Connecting customers with merchants and drivers, and fulfilling orders.
• Sending live notifications (new reply, offer, driver en route, etc.).
• Calculating delivery fees based on distance and zone.
• Generating invoices and financial settlements.
• Computing trust/risk scores to maintain service quality.
• Contacting users for technical support.

4. What We Do Not Do With Your Data

• We do not sell your data to any third party.
• We do not use your data for advertising outside the platform.
• Merchants cannot see your financial data or your dealings with other merchants.
• We do not use any third-party advertising or marketing-tracking SDKs; the only third-party SDKs are Firebase Cloud Messaging for notifications and Sentry for crash reports only.

5. Data Sharing

We share a very limited set of data, on a need-to-know basis, with the following parties:

• Driver: customer name, delivery address, and phone number — to coordinate and complete the delivery; disclosed only to the driver assigned to the task.
• Merchant: customer phone number (only after the customer accepts the offer).
• Payment gateways: Bank al Etihad CliQ and Visa for processing payments.
• Firebase (Google): sending push notifications (FCM) — no personal data is transmitted.
• Cloudinary: storage of uploaded images.
• Sentry: crash and diagnostic reports for bug-fixing only — no personal data or message content is sent.
• Government authorities: only upon formal legal request.

6. Data Security

• OTP verification codes are encrypted with BCrypt (we do not use passwords).
• User sessions are managed via JWT with secure refresh.
• All server communication uses HTTPS with TLS 1.2+.
• Admin permissions are granular (13 distinct role-based permissions).

7. Driver Location

When a driver selects "Online / available for orders", the app tracks location via a "foreground service" with a persistent visible notification: roughly every 30 seconds while waiting, and more frequently during an active delivery — to assign nearby orders and show the live location to the customer during delivery. Tracking stops as soon as the driver goes offline or closes the app. We do not collect location in the background when the app is closed.

8. Your Rights

• Request a copy of your data at any time.
• Edit or delete your personal data (subject to legal and financial constraints).
• Request deletion of your account and associated data via the account deletion page (or in-app: Profile/Settings → Delete account) — executed within 30 days after any pending transactions are settled. Your personal data is permanently deleted, except records we are legally required to retain under Jordanian law (such as transaction and invoice records for accounting and tax purposes), which are kept for the legally required period and then deleted.
• Object to a specific use of your data.

9. Minors

Our services are not intended for users under 18 years of age. We do not knowingly collect data from minors, and any such account will be deleted immediately upon discovery.

10. Policy Updates

We may update this policy from time to time. The date at the top of this page indicates the latest update. Users will be notified of any material change via an in-app notice.