Flavor Meets Space
Compliance: This app is operated by Ahlan F&B (Askadinya — Sheikh Jarrah, Jerusalem) and adheres to the Israeli Protection of Privacy Law (5741-1981). Last updated: February 2026.
Data We Collect: Full name, mobile phone number, 4-digit PIN (stored hashed), loyalty balance and points ledger, order and delivery history, referral code, table booking history, push-notification device token (opt-in), and language preference.
Why We Collect It: To operate the loyalty program, deliver your orders, confirm bookings, send you optional offer notifications, and comply with Israeli tax invoicing (VAT-compliant points ledger).
Third-Party Processors: Supabase (authentication + database), Twilio Verify (SMS OTP), Resend (email OTP), Web-Push (browser push notifications), Microsoft Clarity (anonymous session heatmaps & performance analytics — customer pages only, never on staff pages). Each processor handles data solely to provide the listed service. We do not sell, share, or transfer data to advertisers.
Cookies & Analytics: Microsoft Clarity may set up to 8 first-party cookies for anonymous session replay and heatmapping. It never records values you type into password, PIN, or phone fields. Clarity is disabled entirely on staff/admin/POS pages. Auth session cookies are strictly essential for signing you in.
Retention: Your account and loyalty history are kept as long as your account is active. Points expire after 12 months of inactivity. On deactivation, personal data is deleted within 30 days; anonymized aggregates may be retained for financial audit compliance.
Your Rights: Under Israeli PPL you can access, correct, or delete your data. To deactivate your account and delete personal data, use Settings → Deactivate Account inside the app after login, or email privacy@askadinya-jerusalem.com. We respond within 30 days.
SMS & Marketing: One-time codes are sent via Twilio for account creation and PIN recovery only. Your phone number is never used for marketing SMS. By agreeing to this Privacy Policy at sign-up, you also consent to receive browser/PWA push notifications about your points earnings and redemptions, order status, offers, and events. You may withdraw this consent at any time by disabling notifications in your device settings or by deactivating your account.
Security: Your PIN is hashed by Supabase Auth — we cannot read it. All traffic is HTTPS with HSTS. Admin/staff APIs require HMAC-signed session tokens plus 2FA. Customer data access is limited to authorized staff.
Contact: Ahlan F&B — Sheikh Jarrah, Jerusalem · privacy@askadinya-jerusalem.com