Food Service by YallaGo! Merchant App — Privacy Policy

1) Who we are and scope

YallaGo! (“we”, “us”) operates a marketplace connecting merchants, customers, and—where applicable—delivery partners. This Privacy Policy explains what data we collect, why and how we use it, whom we share it with, and your choices.

Roles. We act as an independent data controller for platform operations (account administration, fraud prevention, support, analytics, payouts, security). Each Merchant is an independent controller for data relating to its own staff, menus/inventory, and in‑store/order fulfillment. Certain partners (e.g., mapping, analytics, telecom) may act as independent controllers under their own terms.

2) Data we collect

Merchant & staff data. Business name and registration details; contact person, email, phone; usernames, hashed passwords, roles/permissions; device identifiers, OS/app version, crash logs; store address and map pin; operating hours; menus/items/prices/stock; order timestamps and reasons (accept/decline/cancel); refund and complaint handling; payout bank details and invoices; KYC/KYB documents; optional selfie/ID of authorized representatives where required to prevent fraud; communication content and metadata (in‑app chat, call logs or recordings where lawful); support tickets and interactions; marketing/attribution events and cookie/SDK signals.

From customers and couriers about your store. Order details (items, amounts), delivery/pickup timing, limited contact options (including masked calling where available), ratings/reviews.

Location & maps. Geocoding, routing, ETAs, and distance calculations via mapping providers. These providers receive necessary queries and signals when used.

3) Why we process data (purposes; legal bases depend on applicable law)

• Provide the service: authenticate accounts; show/manage orders; dispatch/ETAs; provide support; process and settle payouts; operate security and performance features.
• Trust, safety & anti‑fraud: identity/KYB checks; sanctions screening; anomaly/velocity detection; device fingerprinting; IP/network intelligence; dispute/chargeback correlation; internal risk scores/lists; automated decisions that can affect access to features, payouts, or account status (with human review where required).
• Legal obligations: accounting and tax, anti‑fraud/AML/KYB duties, responding to lawful requests by competent authorities.
• Legitimate interests: platform integrity and reliability; product improvement; analytics and measurement; personalized in‑product tips and guidance.
• Consent (where required): certain marketing communications and non‑essential cookies/SDKs; optional features.

4) How we use data

Operate the Merchant app and dashboards; enable order acceptance/decline and prep/pack time settings; share the minimum necessary fulfillment details with couriers and customers; detect/prevent fraud and abuse; provide support and troubleshoot incidents; generate analytics and benchmarks (using anonymized/aggregated data where possible); meet compliance and audit needs; train our teams and automated systems to improve quality.

5) Sharing your data

We do not sell personal data. We share only as needed:

• Customers & couriers: limited details for fulfillment (store name/location, relevant order contents, masked contact options where available).
• Service providers: cloud hosting; payment processors; SMS/email/voice providers; mapping/analytics; customer support tools; identity/KYB services. Some act as independent controllers for their specific services under their own terms.
• Payment partners & banks: to process customer payments and merchant settlements; partners may apply their own policies.
• Affiliates & corporate transactions: for platform operations or reorganization/merger/acquisition.
• Legal & safety: to comply with law, enforce our terms, protect rights and safety, or investigate suspected fraud/abuse.

6) International transfers

Our infrastructure and vendors may be located in other countries. When we transfer data internationally, we apply appropriate contractual, organizational, and technical safeguards and minimize what we share.

7) Retention

We keep data only as long as needed for the purposes above: account/KYB (life of account + 3–7 years for audit); orders/payouts (per bookkeeping/tax rules); support/security logs (reasonable windows for operations and fraud defense). Where investigations are ongoing or claims may arise, we may retain relevant evidence beyond standard periods until closure or expiry of limitation periods.

8) Your choices and rights

Depending on applicable law, you may have rights to access, correct, delete, or export your data; to object to or restrict certain processing based on legitimate interests; and to withdraw consent where we rely on consent (this will not affect prior processing). You can manage notifications and certain cookie/SDK preferences in settings where available. Some requests may be routed through your parent Merchant entity.

9) Security

We apply administrative, technical, and physical safeguards appropriate to the data’s sensitivity, including encrypted transit/storage for key data, role‑based access, least‑privilege controls, monitoring, and incident response. You are responsible for protecting credentials, managing staff access/roles, and securing your devices and networks.

10) Cookies/SDKs

We use cookies/SDKs for core functionality (authentication, load balancing), preferences, analytics/measurement, crash reporting, and—where required by law, with consent—marketing attribution and personalized guidance. Some partners may handle limited data as independent controllers under their own notices.

11) Children

The Merchant app is not intended for children. We do not knowingly collect personal data from individuals below the legal working age.

12) Changes to this Policy

We may update this Policy to reflect operational, legal, or regulatory changes. We will notify you via the app or email before material changes take effect. Continued use after the effective date means acceptance of the updated Policy.