Privacy Policy

This is a template text that must be reviewed and approved by a legal advisor before commercial launch.

This policy explains how the plus minus platform collects, uses and protects personal data on the website and in its apps (the Marketplace app for customers, the Merchant app and the Driver app), in line with the Saudi Personal Data Protection Law and its regulations where applicable.

Roles

Merchant, staff and driver accounts: the Platform is the controller of account data.
Store customers' orders: each store is the controller of the order data it receives; the Platform is a processor acting on the store's instructions solely to provide the service.
The unified customer account in the Marketplace app: the Platform is the controller of the account data (name, mobile number, saved addresses).

Data we collect

Account data: name and mobile number (and email for merchant accounts), and business details for merchants.
Order data: items, the address for deliveries, car details for curbside pickup, table number and similar — each store asks only for the fields its business needs.
Location (with your permission):
- Marketplace app: your location is used only while you use the app to sort stores by distance, and to pin an address when you choose “Use my current location”. It is not stored except as part of an address you save.
- Driver app: the driver's location is sent to the store only while a delivery is on the way and the app is open, and only the latest point is kept per delivery. Drivers are not tracked outside deliveries.
Notifications: the device token needed to send order notifications (your order status, a new order for a store, a new delivery for a driver). It is removed when you sign out or uninstall the app.
Wallet: your balance and its movements at each store that uses wallets.
Technical data: IP address, device or browser type, and security logs.
Payments: we never store card data. Online payments happen on the payment page of the provider chosen by the store, or you pay cash on delivery.

Purposes

Providing the service, fulfilling orders and deliveries, verifying your mobile number with a one-time code, security and fraud prevention, invoicing and legal obligations, and customer support. Marketing messages are sent only with explicit consent per store, which can be withdrawn at any time. We do not sell personal data or use it for advertising.

Sharing

When you order from a store, that store receives only what it needs to fulfil your order (name, mobile, address or pickup details). No store can see your orders with other stores.
The driver assigned to your delivery sees your name, mobile and address until the delivery is completed. You see the driver's first name and a handover code.
Necessary service providers under contract: hosting, SMS, email, notifications (Google Firebase), and the payment provider chosen by the store.
Authorities when legally required.

Retention and deletion

We keep account data while the account is in use.
Deleting your account: customers can delete their account in the app (Account → Delete account) or on the website. The account is closed, signed out on every device and detached from its sign-in details. Order and invoice records stay with the stores for the period required by accounting and tax laws. See Account deletion.
You can download a copy of your data from your account on the website.

Your rights

Access, correction, deletion, withdrawing consent, and obtaining a copy of your data. You can turn off location or notification permissions at any time in your phone's settings. Contact: —

Children

The service is not directed at children and we do not knowingly collect their data.

Security

Encrypted connections, encryption of secrets at rest, fine-grained staff permissions, audit logs, regular backups, and sign-in tokens kept in the phone's secure storage.

Changes

We may update this policy; the new date is published on this page and material changes are notified.