Privacy Policy

The party responsible for processing your personal data (the data controller) is شركة الفارس الأصيل لأعمال الوساطة التجارية ذ.م.م (trade name وفرة الرزق لأعمال الوساطة التجارية), registered in the Hashemite Kingdom of Jordan under Commercial Registration No. 304988, dated 30/06/2026, which operates the “Wafra” platform. For any privacy question, or to exercise the rights described below, contact us at wafrasupport@gmail.com.

• Name, email, phone number
• Approximate location — after you sign in and with your permission, to show nearby stores. We do not request it while you browse as a guest.
• Order and transaction history
• Reviews, ratings and photos you publish
• A device identifier for notifications — stored only if you enable notifications in the app.

You can browse Wafra without creating an account. When you do, we do not ask for your name, email or phone number, we do not create a record for you, we do not use analytics tools or advertising identifiers, and we do not request access to your location.

What reaches us while you browse is the technical minimum needed to deliver the content to you, such as network connection data, plus the map position you yourself move to see nearby stores.

Review text is not shown to people who are not signed in — only the star ratings and the number of ratings.

Making a reservation, collecting an order, or using points requires an account.

To run and protect the service we process technical data: IP address, device type and operating system, and crash and error reports.

We use Sentry to record crashes. A crash report may include your IP address, device information, and the context of the request in which the error occurred. We have configured the service not to send personal data by default, and we redact sign-in data and authentication headers — but we cannot guarantee that no personal data ever appears inside an error message itself.

We use this data only for security, debugging and abuse prevention. We do not use it for advertising.

• Fulfilling orders and sending pickup updates
• Improving the app experience and providing recommendations
• Contacting you about your orders and service notifications. The emails we send are limited to account verification, password resets, and replies to messages you send us — we do not send marketing email. There are currently no per-category notification settings in the app; you can turn notifications off in your phone’s system settings, by signing out, or by deleting your account.
• Fraud prevention and account protection

We share with the partner store the minimum needed to fulfil your reservation: the order details, the pickup time, and the display name on your account so staff can recognise you at pickup.

We do not share your phone number, your email address, or your order history with partner stores. Under the partner agreement, partners are required to use this data only to fulfil the order, and not to use it for marketing or pass it to anyone else.

We do not sell your data to any third party.

When you write a review or rating, or upload a photo, you are publishing content that appears to signed-in Wafrausers on the store’s page, together with your first name and your level. The star rating and the number of ratings are visible to everyone.

Do not write anything inside a review that you would not want others to see — such as your phone number or address. We cannot guarantee the privacy of what you publish yourself.

You cannot currently edit or delete your own review after publishing it; contact us to request removal. Photos you upload are stored with our image hosting provider and may remain reachable at their direct link even after the review or the account is deleted.

We may disclose your information where the law requires it, in response to a valid request from a competent judicial or governmental authority, to enforce our Terms of Service, to investigate fraud or abuse, or to protect the rights, property or safety of Wafra, our users, or others.

If Wafra is involved in a merger, acquisition, reorganisation or sale of assets, user data may be transferred as part of that transaction. Transferred data remains subject to this policy, and we will notify you of any material change in how it is handled.

We may produce aggregated statistics that do not identify any individual — such as the number of bags rescued or estimated environmental impact — and use them internally, publish them, or share them. These figures are estimates and aggregates, and cannot be traced back to a particular user.

If aggregated data is ever recombined with data that identifies a person, we treat it again as personal data subject to this policy.

On the website we use the minimum cookies needed to run the site and remember your preferred language. We do not use third-party advertising or tracking cookies. We also use cookieless, aggregate analytics (from Vercel) to count page visits and general interactions — such as which FAQ questions get opened most — which stores no cookies and does not identify you personally.

We keep your data for as long as your account is active.

When you delete your account from the app, deletion is immediate and cannot be undone. It covers your orders, reviews, points and notifications. If you have an active reservation, deleting your account cancels it.

Some records remain afterwards where they must: support messages you sent us, administrative audit records, and anything the law requires us to keep. Photos you uploaded may also remain reachable at their direct link with our hosting provider.

In rare cases deletion cannot complete automatically, and you will be shown a message asking you to contact support.

• Access and review your data from inside the app
• Correct your data from the profile page
• Request deletion of your account and data
• Request a copy of your data by contacting us — there is no self-service export tool in the app today; we provide the copy on request.

We take reasonable technical and organisational measures to protect your data, including encrypted connections and restricted internal access.

Even so, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security. Please do not send us sensitive information by email, and tell us immediately if you believe your account has been compromised.

We use the following third-party services to run Wafra:

• Firebase (Google) — delivering notifications
• Cloudinary — storing images you upload
• Resend — sending email (verification codes, password resets, and messages you send through the website forms)
• Sentry — recording crashes and technical errors

These services receive only the minimum data needed to perform their function.

Our service is for users 18 years and older only. We do not knowingly collect data from minors.

Our service may contain links to sites or apps we do not operate. This policy does not apply to them, and a link is not an endorsement. We encourage you to read the privacy policy of any site you visit.

We may update this policy from time to time. Updates will be posted here, and for material changes we will notify you in the app or by email.

For privacy inquiries, reach us at wafrasupport@gmail.com.