Privacy Policy

Who we are

Al-Zafar is a marketplace that connects customers with independent vendors. This policy explains what personal information the Al-Zafar website and mobile apps (iOS and Android) collect, how we use it, and the choices you have.

Information we collect

We collect only what we need to run the marketplace:

• Account details: your name, email address and password. Passwords are stored only as a salted hash, never in plain text.
• Order and delivery details: items purchased, order status, and the shipping address and phone number you provide at checkout.
• Payment: card payments are handled entirely by Stripe. We never see or store your card number; we only receive confirmation that a payment succeeded or was refunded.
• Reviews: the rating and comment you choose to post, shown with your first name and last initial.
• Device information for notifications: if you allow notifications in the app, a push-notification token for your device.
• Technical data: standard server logs (such as IP address, request time and error details) used to keep the service secure and reliable.

How we use your information

We use your information to:

• create and secure your account and sign you in;
• process, fulfil, cancel and refund orders;
• send transactional emails such as order confirmations and password resets;
• send you offers and updates by push notification, only if you have allowed notifications;
• prevent fraud and abuse, and troubleshoot problems.

Who we share it with

We do not sell your personal information. We share it only as needed to provide the service:

• Vendors: the vendor who sold you an item receives your name, delivery address, phone number and order details so they can fulfil it.
• Stripe: processes payments, refunds and vendor payouts.
• Service providers that run our platform: cloud hosting and database providers (Render, Neon, Upstash, Vercel), Resend for email delivery, and Google Firebase Cloud Messaging for push notifications.
• Authorities, where we are required to by law.

International transfers

Our service providers operate servers in several countries, including outside the United Arab Emirates. By using Al-Zafar you understand your information may be processed in those locations, under the safeguards our providers maintain.

How long we keep it

We keep your account information while your account is open. Records of completed orders, including the order total and the email address used, are retained after account deletion for as long as we need them for accounting, tax and dispute purposes.

Deleting your account and data

You can delete your account at any time from the Profile screen in the iOS or Android app. Deleting your account signs you out everywhere, removes your name and saved addresses, disconnects your device from push notifications, and replaces your email address with an anonymous placeholder so the account can no longer be used or recovered.

You can also request access to, correction of, or deletion of your data by emailing support@alzafar.app from the email address on your account. Order records we must retain, as described above, are kept in a form that no longer identifies your account.

Your choices

You can turn off push notifications at any time in your device settings. You can use the marketplace without allowing notifications.

Security

Data is transmitted over encrypted connections. Sign-in tokens are stored in the iOS Keychain or Android's protected app storage. No method of storage or transmission is completely secure, but we work to protect your information.

Children

Al-Zafar is not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will change the date above and, for significant changes, notify you in the app or by email.

Contact us

Questions or requests about your privacy: support@alzafar.app.