Privacy Policy

This policy explains how we handle the personal data of:

• Customers who use the Touran Eats app (Android, iOS and the web version at app.turan-eats.com) to browse and order.
• Visitors to turan-eats.com and people who fill in its forms (applying to join as a store or courier, and signing up as a beta tester).

It does not cover the data of couriers and partner stores relating to their work with us (such as tracking a courier's location while working). That is governed by our agreements with them.

The rules for ordering, cancellation and refunds are in the Terms and Conditions (الشروط والأحكام), not in this policy.

This policy is our notice to you of what we do with your data, under section 11 of the Privacy Protection Law, 1981. Where we need your consent for something specific (such as promotional messages or access to your location), we ask for it separately and explicitly.

The database owner is טורעאן שליחים בע"מ (Turan Couriers Ltd., trading as "Touran Eats"), company no. 517400651, Al-Zaytoun Street, Touran 1695000, Israel.

For any privacy question or request: support@touran.store, or WhatsApp 052-4411637 (daily, 12:00 noon to 24:00 midnight).

What we don't collect: we don't collect advertising identifiers (IDFA/GAID) or MAC addresses, we don't ask for your ID number or date of birth, and we never receive or store your full card number or CVV (see the "Payment" row above).

Sensitive details you write yourself: if you write health information in an order or support note (such as a food allergy), we use it only to pass your order to the store and to serve you. Don't write more than necessary.

If you don't provide the necessary data, we can't fulfil the order. You are under no legal obligation to provide it.

• When we access your device's location: when you tap "Use my location" on the address screen, the app asks for permission (if you haven't given it) and reads your precise location for a few seconds to set the point on the map. If you have already given permission, the app may also use your current location to centre the map when you open the address screen.
• What we keep: only the delivery point you confirm (in your saved addresses and in the order). We don't keep a history of your movements.
• On the web: your browser asks for its own permission in the same way.
• Turning it off: in your phone or browser settings at any time. You can always set the address manually.
• The courier's location: during delivery (once the order is "on the way") we show you the courier's live location on the map. At handoff we record the location from which the courier confirmed delivery, for verification and complaint handling.

• Fulfilling your order: taking payment, sending it to the store, assigning a courier, estimating the delivery time, sending status updates, and contacting you about the order.
• Login and account protection: sending a verification code by SMS, keeping you signed in on your device, and preventing unauthorised access.
• Support and complaints: handling cancellations, refunds, complaints and disputes.
• Offers: applying coupons and the stamp card (such as counting your orders).
• Preventing fraud and misuse: such as abusing offers through multiple accounts.
• Improvement and statistics: understanding how the app is used, fixing faults, and monitoring store and delivery quality.
• Promotional messages: only as described in section 9.
• Legal obligations: keeping accounting records and responding to lawful requests from the authorities.

We don't sell your personal data, and we don't use your location for advertising.

Service providers process data only to provide their services to us, under their terms of service and data-protection commitments, and may not use it for their own purposes.

Others: we may disclose data when required by law, a court order or a competent authority, to protect our rights in a legal dispute, or to prevent harm to a person. If the service passes to another entity (a merger or sale), the data goes with it and remains subject to this policy, and we will tell you.

Our servers, database, backups and images are all hosted in Israel (Google Cloud, Tel Aviv region), as are our payment provider Tranzila and our SMS provider 019. Some providers in section 6 process data outside Israel: PostHog in the European Union, and Expo, Mapbox, Google and Apple in the United States and other countries.

We transfer data abroad as permitted by the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001, for example to countries with an adequate level of protection such as EU member states, or to providers who have committed to protect the data and use it only to provide their services to us.

In the app

• We use PostHog to record usage events (such as opening a screen, viewing a store, adding to cart, completing an order), app open and close events, and technical errors. PostHog infers an approximate location (city/country) from your IP address.
• After you verify your phone number, we link these events to your account (ID, name, phone and email) so we can diagnose problems with a specific account.
• Session replay is not active. We won't turn it on before updating this policy, and sensitive input fields would then be hidden from recordings.
• The app contains no advertising tools and no social-media tracking pixels.
• The web version of the app stores data in your browser's local storage so the service works, such as your cart, your login session and the PostHog analytics identifier. It uses no advertising cookies and no cookies that track you across other sites. You can clear this data in your browser settings; you'll then need to sign in again.

On turan-eats.com

The website records anonymous usage events through PostHog: opening the page, taps on the buttons to download the app, open it or order in the browser, where the visit came from (for example an Instagram link or the page you came from) and your device type (iPhone/Android/computer). The website uses no cookies and stores no identifier in your browser, and we don't link these events to your other visits, your identity or your app account. PostHog infers an approximate location (city/country) from your IP address. The website uses no advertising tools or tracking cookies. The font is loaded from Google Fonts, so Google receives your IP address when you visit.

Website forms

• Applying to join as a store or courier: phone number (with a verification code), name and application type. We use them only to contact you about your application.
• Signing up as a beta tester: email address. We use it to add you to the Google Play testing programme through Google's services.

• Service messages (verification codes, order status, cancellations) are not promotional. You receive them while you have orders or an active account.
• Promotional SMS: we send them only if you tick the box "أوافق على استلام العروض والتخفيضات عبر الرسائل" (I agree to receive offers and discounts by message). The box is not pre-ticked, and declining doesn't stop you from ordering. You can withdraw consent at any time by WhatsApp or email to us.
• Push notifications: the "Notifications" switch under My Account → Settings turns on order updates and offers together. You can turn it off there or in your phone settings, but that also stops order updates.
• We don't currently send promotional emails.

You may also ask in writing to be removed from any list we use for direct marketing (section 17F of the Privacy Protection Law).

We keep data for as long as it is needed for any of the purposes in this policy, including running the service, accounting and tax, handling complaints and disputes and defending our rights in existing or potential claims, preventing fraud and misuse, analysis and service improvement, and legal obligations. We review the data we hold periodically, and delete or de-identify data that is no longer needed for any of these purposes.

We may keep aggregated or anonymised data that doesn't identify you, without time limit, for statistics and service improvement.

What happens when you delete

• Immediately: we delete your name, email, photo and saved addresses, replace your phone number with an internal identifier, disable the account, sign you out on every device, and stop notifications.
• What we keep: records of your past orders and payments (including the name and delivery address recorded on each order), support tickets and consent records, as described in section 10.
• Analytics: we ask for your PostHog profile to be deleted as soon as reasonably possible after account deletion.
• Backups: your data stays in backups until they are deleted automatically on their normal cycle, and backups are used only to restore the system after a failure.
• Unused offers and rewards (such as loyalty-card stamps) are cancelled.

Under the Privacy Protection Law, 1981, you have the right to:

• Access the information we hold about you (section 13), in Arabic, Hebrew or English.
• Ask us to correct or delete information that is incorrect, incomplete, unclear or out of date (section 14). If we refuse, we'll tell you why, and you may apply to court.
• Be removed from direct-marketing lists (section 17F).
• Withdraw consent you have given (such as for promotional messages or location access) at any time, without affecting anything done before the withdrawal.

You can also delete your account at any time (section 11), even if the information is correct.

How to make a request: contact us through the channels in section 16. We may verify your identity (for example with a code sent to your phone). We reply within the period set by law.

Complaints: you may complain to the Privacy Protection Authority at the Ministry of Justice.

Measures we apply include:

• Communication between the app and our servers is encrypted (HTTPS/TLS).
• Customers sign in with a one-time code sent to their phone, with no passwords.
• Short-lived login tokens.
• Rate limits to prevent guessing and flooding.
• Servers hosted on Google Cloud, which encrypts stored disks by default.

No storage or transmission method is completely secure. If a serious security incident affects your data, we will report it to the Privacy Protection Authority as the law requires and notify you where required or appropriate.

The service is not directed at children. We don't ask for age and don't knowingly collect children's data. If you learn that a child gave us data without a parent's knowledge, contact us and we will delete it.

We update this policy when our practices or the law change, and change the effective date at the top of the page. We tell you in the app in advance about any material change (such as a new type of data, a new provider receiving data that identifies you, or turning on session replay). Where a change requires your consent, we ask for it before applying the change.

• Email: support@touran.store
• WhatsApp/phone: 052-4411637
• In the app: My Account → Support
• By post: טורעאן שליחים בע"מ, Al-Zaytoun Street, Touran 1695000, Israel