1Who we are
“Hattli” is a platform for ordering food and groceries and for delivery services in Palestine. It connects customers with restaurants, stores and drivers through the customer app, the driver app, the restaurant portal and the admin dashboard, and it is operated by هاتلي (رام الله والبيرة). This policy explains what data we collect, why we collect it, how we protect it, and what your rights are.
2The data we collect
- Account data: your name, phone number and password (stored encrypted with the bcrypt algorithm, so no one can read it), plus your email address and profile photo if you add them.
- Addresses and location: the delivery addresses you save and their coordinates, and your location when you order, to calculate the delivery fee. The driver app collects the driver’s location for as long as they are logged in — even when the app is closed or in the background. While the driver is “Online”, it is used to send them nearby orders, to show their position to the customer and the store during a delivery (including while they finish an earlier delivery first) and to estimate arrival times. While they are “Offline”, their location (about once a minute) goes to the Hattli operations team only and is never shown to any customer or store. A persistent notification stays visible on the driver’s device for as long as their location is being shared. Location access is required to receive orders, and tracking stops when the driver logs out.
- Orders and payments: what you order, the amounts, discounts, your wallet balance and loyalty points. When you pay by card, your card details are processed directly by the payment gateway — they never pass through our servers and we don’t store them.
- Device data: your notification token, device type, operating system, app version and IP address — to send you notifications and to protect your account (for example, by ending your sessions when you log out or delete your account).
- Chats and reviews: support messages and the chat between a customer and a driver about an order, as well as the ratings and reviews you write and the photos you attach to them. Your review is shown to other customers on the restaurant or store page, with your first name, the first letter of your last name, your profile photo and the review photos.
3How we use your data
- To fulfil your order: sending it to the restaurant or store, assigning it to the nearest available driver, and tracking it until it’s delivered.
- To calculate prices, delivery fees, discounts, cashback and loyalty points.
- To send you order status notifications and important messages, and offers in reasonable amounts.
- To protect the platform: preventing fraud and guessing attacks, analysing faults, and improving the service.
- To meet our legal and accounting obligations.
We never sell your personal data to anyone, and we don’t use it for third-party advertising.
4Who we share data with
- The restaurant or store: your order details, name, phone number and delivery address, so they can prepare your order and contact you if needed — only while the order is in progress. After delivery or cancellation, they keep the order itself (items and amounts) with your first name only.
- The driver: your name, phone number, delivery address and its location on the map — only while the order is in progress.
- Customers, stores and order recipients: they see the driver’s name, and they see the driver’s phone number and live location only during the delivery. With the “Request a driver” service, the store enters the recipient’s name, phone number and address so we can deliver the order, and the recipient gets a tracking link that shows the driver’s name, phone number and location until delivery.
- Service providers: the online payment gateway, notification services (Firebase / Apple Push), hosting and storage — only as far as needed to provide the service, and under data protection commitments.
- Public authorities: when there is a legally binding request.
5How long we keep data
We keep your account data for as long as your account is active. Order records and financial transactions are kept for as long as our accounting obligations require. Verification codes are deleted within a day, and expired sessions within 30 days. Order chat messages are deleted after 180 days, payment gateway details are reduced after 90 days to the transaction number, status and amount only, and order tracking links expire 48 hours after the order ends.
6Your rights
- You can view and edit your data from within the app.
- Deleting your account: go to “Account → Delete account permanently” (at the bottom of the page) in the customer app, or ask the support team. When you delete your account, we remove your name, phone number, email and addresses and end all your sessions, and we keep an anonymised order history for accounting purposes.
- You can turn off location or notification permissions in your device settings at any time.
- You can log out of the app at any time, and ask the support team to end your sessions on all devices.
7Data security
We use encrypted connections (HTTPS) for all communication, encrypted passwords, sessions that can be revoked instantly, two-step verification for admin accounts, and specific permissions for each staff member, with an audit log of every admin action. No system is 100% secure, so we recommend using a strong password and never sharing it.
8Children
Hattli’s services are intended for people aged 16 and over, and we don’t knowingly collect data from anyone under that age.
9Changes to this policy
We may update this policy. We’ll announce any significant change in the app, and the date of the last update is shown at the top of this page.
10Contact us
For any question about privacy or your data:
- Phone0594558016
- WhatsApp+970594558016
- In the customer appAccount → Hattli Support → Live chat
- In the driver appSupport button on the home screen → Chat with Hattli Support