1. Who we are
Bayatoo is a purchase intermediary service for customers in Jordan.
We help you request products from third-party stores (such as SHEIN, Temu, and iHerb) by collecting product links, preparing a quote, and—after you confirm—purchasing and arranging delivery on your behalf.
We are not the original online store that manufactures or lists those products.
Product pages, stock, and original store policies belong to those third parties.
This Privacy Policy explains what personal data we collect, how we use it, and your choices.
2. Scope
This Policy applies to:
- The Bayatoo Android application
- Related customer-facing services we operate
- Our admin systems only insofar as they process your customer data to fulfill orders
It does not control privacy practices of SHEIN, Temu, iHerb, payment networks, or messaging apps (WhatsApp, Messenger, Instagram) you use to share links or invites.
3. Data we collect
3.1 Account and identity
| Data | Why |
|---|---|
| Mobile phone number | Sign-in identifier, account identity, order contact |
| First name, last name, city | Registration, delivery planning, service personalization |
| Email (optional) | Optional contact if you provide it |
| Authentication session / tokens | Keep you signed in securely |
Access is by email or mobile number plus a password. Your password is never stored — only a bcrypt hash of it, which cannot be turned back into the password.
3.2 Orders and shopping activity
| Data | Why |
|---|---|
| Product URLs, product names/images (when available), notes (size, color, qty) | Build cart and quote |
| Store name (e.g. SHEIN / Temu / iHerb) | Route and process orders |
| Order status history and events | Fulfillment, tracking, support |
| Delivery address, delivery phone, payment method (cash on delivery) | Confirm and deliver orders |
| Quote amounts (subtotal, delivery fee, discounts, totals) | Pricing and confirmation |
| Guest session identifiers (before login) | Preserve cart until you sign in |
3.3 Referrals (Referral System v1)
| Data | Why |
|---|---|
| Your unique invite code / link | Attribute sign-ups |
| Referral events (who invited whom, timestamps) | Run the referral program fairly |
| Referral progress points (count toward credit, max 10) | Program rules |
| Bayatoo Credit balance and credit ledger (in-app only) | Apply discounts on future Bayatoo orders |
We do not pay out cash for referrals. Credit is not transferable and is not withdrawable.
When you share Bayatoo, you may use WhatsApp, Messenger, or Instagram. Those apps process the message under their privacy policies. Our default invite message is a personal recommendation and does not advertise points or rewards to the recipient.
3.4 Notifications
| Data | Why |
|---|---|
| Notification records related to your orders (titles/bodies, type, read state) | Trust-based order updates |
| Device / push token (if provided) | Deliver notifications when available |
| Permission state (on device) | Respect system settings |
We send order-related notifications only (e.g. quote ready, need info, shipped, delivered, cancelled). We do not use notifications for spam marketing, games, or daily “come back” campaigns in our MVP policy.
3.5 Technical and security data
| Data | Why |
|---|---|
| App version, basic device/platform info (as needed) | Compatibility and support |
| IP address and request logs (server-side) | Security, abuse prevention, diagnostics |
| Approximate timestamps of actions | Audit and fraud resistance |
3.6 Admin processing
Authorized staff may access order and customer data only to price quotes, fulfill purchases, handle support, prevent fraud, and operate the service. Admin access is restricted and intended for legitimate business purposes only.
3.7 Data we do not intentionally collect
- Full contact books
- Precise continuous location tracking for ads
- Microphone or unrelated sensors for marketing
- Payment card numbers. Orders are paid cash on delivery, so we do not collect or store card data—this would change only if a future payment provider is added, with an updated Policy
4. How we use data (purposes)
We use personal data to:
- Create and secure your account (password sign-in).
- Maintain guest and logged-in carts.
- Create orders, prepare quotes, confirm orders, and fulfill purchases/delivery.
- Communicate order status (including notifications you allow).
- Operate Referral System v1 and Bayatoo Credit (in-app discount only).
- Prevent fraud, abuse, and self-referral misuse.
- Improve reliability, fix bugs, and meet legal obligations.
- Respond to support requests.
Legal bases (as applicable under applicable law): performance of a contract (providing the service you request), legitimate interests (security, fraud prevention, service improvement), and consent where required (e.g. certain notifications on some OS versions).
5. Sharing of data
We may share data only as needed with:
| Recipient | Purpose |
|---|---|
| Fulfillment partners / shipping providers | Purchase logistics and delivery in Jordan |
| Third-party stores (indirectly) | We use product links you provide to purchase items; those stores see what any buyer would when purchasing |
| Messaging infrastructure providers | Deliver order notifications |
| Hosting / infrastructure providers | Run servers and backups |
| Professional advisors / authorities | Legal compliance when required by law |
We do not sell your personal data.
6. Retention
| Category | Retention (principle) |
|---|---|
| Account profile | While account is active; then per deletion policy |
| Orders and financial records | As long as needed for fulfillment, accounting, disputes, and legal retention duties |
| Password reset codes | Single-use and short-lived; stored only as a hash, and expired or used codes are not kept longer than needed for security |
| Referral and credit ledgers | While needed to operate balances and prevent abuse; residual records may remain in anonymized/aggregated form |
| Notification logs | Limited operational period |
| Server logs | Limited security/diagnostic period |
When you delete your account, we follow the Account Deletion Policy. Some records may be retained where law or legitimate dispute handling requires it (e.g. completed order invoices).
7. Security
We apply reasonable technical and organizational measures appropriate to a service of this size, including access controls for admin tools, encrypted transport (HTTPS in production), and separation of development and production practices.
No method of transmission or storage is 100% secure; we work to protect your data against unauthorized access.
8. Your rights and choices
Depending on applicable law, you may:
- Access or correct profile information
- Request account deletion (see Account Deletion Policy)
- Withdraw notification permission in system settings
- Stop using optional features (e.g. not sharing invites)
- Contact us about privacy questions:
[email protected]
9. Children
Bayatoo is intended for users who can form a valid customer relationship (typically 18+).
If you believe a minor has provided data, contact us to request deletion where appropriate.
10. International processing
Servers or processors may be located outside Jordan. Where data is transferred, we take steps appropriate to the service and applicable requirements.
11. Changes
We may update this Policy. Material changes will be reflected by updating the version/effective date and, where appropriate, notifying you in-app or on https://bayatoo.com. Continued use after the effective date constitutes acceptance of the updated Policy where permitted by law.
12. Contact
Privacy inquiries: [email protected]
Support: Email support
Operator: Bayatoo, Amman, Jordan