Bayatoo — Privacy Policy

سياسة الخصوصية

Version 1.0 · Official Source of Truth

Field	Value
Status	Final for Production v1 (subject to legal review)
Effective date	`[EFFECTIVE_DATE]`
Operator	`[COMPANY_LEGAL_NAME]` (“Bayatoo”, “we”, “us”)
Contact	`[CONTACT_EMAIL]` · `[SUPPORT_CHANNEL]`
Address	`[COMPANY_ADDRESS]`

English

1. Who we are

Bayatoo is a purchase intermediary service for customers in Jordan.
We help you request products from third-party stores (such as SHEIN, Temu, and iHerb) by collecting product links, preparing a quote, and—after you confirm—purchasing and arranging delivery on your behalf.

We are not the original online store that manufactures or lists those products.
Product pages, stock, and original store policies belong to those third parties.

This Privacy Policy explains what personal data we collect, how we use it, and your choices.

2. Scope

This Policy applies to:

The Bayatoo Android application
Related customer-facing services we operate
Our admin systems only insofar as they process your customer data to fulfill orders

It does not control privacy practices of SHEIN, Temu, iHerb, payment networks, or messaging apps (WhatsApp, Messenger, Instagram) you use to share links or invites.

3. Data we collect

3.1 Account and identity

Data	Why
Mobile phone number	Sign-in via OTP, account identity, order contact
First name, last name, city	Registration, delivery planning, service personalization
Email (optional)	Optional contact if you provide it
Authentication session / tokens	Keep you signed in securely

We do not use a password for v1 login; access is via phone verification (OTP).

3.2 Orders and shopping activity

Data	Why
Product URLs, product names/images (when available), notes (size, color, qty)	Build cart and quote
Store name (e.g. SHEIN / Temu / iHerb)	Route and process orders
Order status history and events	Fulfillment, tracking, support
Delivery address, delivery phone, payment method choice (e.g. COD / prepaid offline)	Confirm and deliver orders
Quote amounts (subtotal, delivery fee, discounts, totals)	Pricing and confirmation
Guest session identifiers (before login)	Preserve cart until you sign in

3.3 Referrals (Referral System v1)

Data	Why
Your unique invite code / link	Attribute sign-ups
Referral events (who invited whom, timestamps)	Run the referral program fairly
Referral progress points (count toward credit, max 10)	Program rules
Bayatoo Credit balance and credit ledger (in-app only)	Apply discounts on future Bayatoo orders

We do not pay out cash for referrals. Credit is not transferable and is not withdrawable.

When you share Bayatoo, you may use WhatsApp, Messenger, or Instagram. Those apps process the message under their privacy policies. Our default invite message is a personal recommendation and does not advertise points or rewards to the recipient.

3.4 Notifications

Data	Why
Notification records related to your orders (titles/bodies, type, read state)	Trust-based order updates
Device / push token (if provided)	Deliver notifications when available
Permission state (on device)	Respect system settings

We send order-related notifications only (e.g. quote ready, need info, shipped, delivered, cancelled). We do not use notifications for spam marketing, games, or daily “come back” campaigns in our MVP policy.

3.5 Technical and security data

Data	Why
App version, basic device/platform info (as needed)	Compatibility and support
IP address and request logs (server-side)	Security, abuse prevention, diagnostics
Approximate timestamps of actions	Audit and fraud resistance

3.6 Admin processing

Authorized staff may access order and customer data only to price quotes, fulfill purchases, handle support, prevent fraud, and operate the service. Admin access is restricted and intended for legitimate business purposes only.

3.7 Data we do not intentionally collect

Full contact books
Precise continuous location tracking for ads
Microphone or unrelated sensors for marketing
Payment card numbers inside the app in v1 (if prepaid is offline/manual, card data is not stored by us unless a future payment provider is added—with an updated Policy)

4. How we use data (purposes)

We use personal data to:

Create and secure your account (OTP).
Maintain guest and logged-in carts.
Create orders, prepare quotes, confirm orders, and fulfill purchases/delivery.
Communicate order status (including notifications you allow).
Operate Referral System v1 and Bayatoo Credit (in-app discount only).
Prevent fraud, abuse, and self-referral misuse.
Improve reliability, fix bugs, and meet legal obligations.
Respond to support requests.

Legal bases (as applicable under applicable law): performance of a contract (providing the service you request), legitimate interests (security, fraud prevention, service improvement), and consent where required (e.g. certain notifications on some OS versions).

5. Sharing of data

We may share data only as needed with:

Recipient	Purpose
Fulfillment partners / shipping providers	Purchase logistics and delivery in Jordan
Third-party stores (indirectly)	We use product links you provide to purchase items; those stores see what any buyer would when purchasing
SMS/OTP or messaging infrastructure providers	Deliver verification codes
Hosting / infrastructure providers	Run servers and backups
Professional advisors / authorities	Legal compliance when required by law

We do not sell your personal data.

6. Retention

Category	Retention (principle)
Account profile	While account is active; then per deletion policy
Orders and financial records	As long as needed for fulfillment, accounting, disputes, and legal retention duties
OTP challenges	Short-lived; consumed or expired codes are not kept longer than needed for security
Referral and credit ledgers	While needed to operate balances and prevent abuse; residual records may remain in anonymized/aggregated form
Notification logs	Limited operational period
Server logs	Limited security/diagnostic period

When you delete your account, we follow the Account Deletion Policy. Some records may be retained where law or legitimate dispute handling requires it (e.g. completed order invoices).

7. Security

We apply reasonable technical and organizational measures appropriate to a service of this size, including access controls for admin tools, encrypted transport (HTTPS in production), and separation of development and production practices.
No method of transmission or storage is 100% secure; we work to protect your data against unauthorized access.

8. Your rights and choices

Depending on applicable law, you may:

Access or correct profile information
Request account deletion (see Account Deletion Policy)
Withdraw notification permission in system settings
Stop using optional features (e.g. not sharing invites)
Contact us about privacy questions: [CONTACT_EMAIL]

9. Children

Bayatoo is intended for users who can form a valid customer relationship (typically 18+).
If you believe a minor has provided data, contact us to request deletion where appropriate.

10. International processing

Servers or processors may be located outside Jordan. Where data is transferred, we take steps appropriate to the service and applicable requirements.

11. Changes

We may update this Policy. Material changes will be reflected by updating the version/effective date and, where appropriate, notifying you in-app or on https://bayatoo.com. Continued use after the effective date constitutes acceptance of the updated Policy where permitted by law.

12. Contact

Privacy inquiries: [CONTACT_EMAIL]
Support: [SUPPORT_CHANNEL]
Operator: [COMPANY_LEGAL_NAME], [COMPANY_ADDRESS]

العربية

1. من نحن

Bayatoo خدمة وسيط شراء لعملاء في الأردن.
نساعدك على طلب منتجات من متاجر خارجية (مثل SHEIN وTemu وiHerb) عبر لصق روابط المنتجات، إعداد عرض تسعير، وبعد تأكيدك نقوم بالشراء وترتيب التوصيل نيابة عنك.

لسنا المتجر الأصلي الذي يبيع أو يصنّع تلك المنتجات.
صفحات المنتجات والمخزون وسياسات المتاجر تعود لتلك الأطراف.

توضح سياسة الخصوصية هذه ما نجمعه من بيانات، ولماذا، وخياراتك.

2. نطاق السياسة

تسري على:

تطبيق Bayatoo لأندرويد
الخدمات المرتبطة بالعميل
أنظمة الإدارة بقدر ما تعالج بياناتك لتنفيذ الطلبات

لا تغطي ممارسات خصوصية SHEIN أو Temu أو iHerb أو تطبيقات المراسلة التي تستخدمها للمشاركة.

3. البيانات التي نجمعها

3.1 الحساب والهوية

رقم الهاتف (تسجيل عبر OTP)، الاسم، المدينة، البريد إن أدخلته، وجلسات الدخول.

3.2 الطلبات والتسوّق

روابط المنتجات، الملاحظات (مقاس/لون/كمية)، المتجر، حالات الطلب، العنوان، طريقة الدفع المختارة، مبالغ العرض، ومعرّفات جلسة الضيف قبل تسجيل الدخول.

3.3 الإحالات (نظام الإحالة v1)

كود/رابط الدعوة، أحداث الإحالة، نقاط تقدّم الإحالة (بحد أقصى 10)، ورصيد Bayatoo Credit (خصم داخل التطبيق فقط — غير قابل للسحب أو التحويل).

3.4 الإشعارات

سجلات إشعارات مرتبطة بالطلبات، ورمز الجهاز إن وُجد، وفق سياسة إشعارات هادفة (ليست إعلانات مزعجة).

3.5 بيانات تقنية وأمنية

سجلات تشغيل وأمان بالقدر المعقول لمنع الإساءة وضمان الاستقرار.

3.6 الإدارة

قد يصل موظفون مخوّلون إلى بيانات الطلب لتنفيذ التسعير والشراء والدعم ومنع الاحتيال فقط.

4. أغراض الاستخدام

إنشاء الحساب، السلة والطلبات، التسعير والتأكيد والتنفيذ، الإشعارات المتعلقة بالطلب، برنامج الإحالة والرصيد، منع الاحتيال، الدعم، والالتزامات القانونية.

5. المشاركة مع أطراف أخرى

شركاء تنفيذ/شحن، متاجر المصدر عند الشراء، مزوّدو OTP/بنية تحتية، وعند الاقتضاء جهات قانونية.
لا نبيع بياناتك الشخصية.

6. الاحتفاظ والحذف

نحتفظ بالبيانات طالما لزم تشغيل الخدمة والمحاسبة والنزاعات والقانون.
حذف الحساب يخضع لـ سياسة حذف الحساب. قد تبقى سجلات طلبات مكتملة عند وجود موجب قانوني أو محاسبي.

7. حقوقك

طلب تصحيح البيانات، حذف الحساب، إيقاف الإشعارات من إعدادات الجهاز، والتواصل عبر [CONTACT_EMAIL].

8. التواصل

[CONTACT_EMAIL] · [SUPPORT_CHANNEL] · [COMPANY_LEGAL_NAME] · [COMPANY_ADDRESS]

تاريخ السريان: [EFFECTIVE_DATE] · الإصدار: 1.0