Bahiran Restaurant App Privacy Policy

How we collect, use, and protect your business and personal information as a restaurant partner on the Bahiran Delivery platform.

Introduction

1. This Privacy Policy applies to the Bahiran Restaurant App — the progressive web application used by restaurant partners to manage incoming orders, update their menu, control their open/closed status, track earnings, and interact with customers and drivers via the Bahiran Delivery platform.
2. As a restaurant, you are both a business entity and an account holder on our platform. We collect business-level and account-level data to operate the partnership. This policy explains what data we collect, how it is used, and how it is protected.
3. Restaurant accounts require admin approval before going live on the platform. Your location coordinates are used to match your restaurant to nearby customers and drivers.

Data We Collect

1. We collect the following data from restaurant accounts:
   • Business Identity: Restaurant name, phone number, email address (optional), logo image, physical address, and business description.
   • Location: GPS coordinates of your restaurant location (2dsphere geo-indexed). Used for nearby search and delivery routing.
   • Menu Data: All menu items including names, descriptions, prices, categories, availability status, photos, and packaging fee flags.
   • Order Activity: All orders received, their status, items, pricing, and order timestamps. Full order history.
   • Earnings & Wallet: Wallet balance (ETB), total earnings, packaging fee configuration, and withdrawal history.
   • Ratings: Customer ratings received, cumulative rating sum, total number of ratings, and average score.
   • Operating Hours: Configured opening and closing times, current open/closed status, and accepting-orders flag.
   • Device & Session: Device platform, device ID fingerprint, and FCM push tokens registered per logged-in device.
   • Cuisine Tags: Cuisine category labels (e.g., Ethiopian, Italian, Fast Food) used to categorize your restaurant for customers.
   • Authentication: Hashed password (bcrypt), JWT tokens, phone verification status, approval status, and ban status.

How We Use Your Data

Location Data

1. Your restaurant's GPS coordinates are stored in MongoDB with a 2dsphere geo-index, enabling:
   • Customers to find your restaurant when searching for food near their delivery address
   • Drivers to navigate to your restaurant for order pickup
   • The platform to calculate delivery fees based on restaurant-to-customer distance
   • Discovery features such as "restaurants near me" in the User App
2. Your location is static (set during registration) and is not continuously tracked like driver locations. You may update your location by contacting support.

Menu & Pricing Data

1. Your full menu — including item names, descriptions, prices, categories, photos, availability, and packaging fee settings — is stored and displayed publicly to customers browsing the Bahiran User App. This is the nature of a marketplace listing:
   • Menu data is visible to all Bahiran customers and is considered public business information
   • Menu item photos are stored on Cloudinary and served via CDN
   • Packaging fees (per-item ETB charge) are configured by you and disclosed to customers at checkout
   • You can add, edit, or remove menu items at any time from the Restaurant App

Earnings, Wallet & Withdrawals

1. Revenue generated from orders flows into your in-app wallet (ETB balance). When you request a withdrawal:
   • Withdrawal requests are processed via Chapa Transfer
   • Your bank account or mobile money details are transmitted to Chapa to process the payout
   • Bahiran deducts applicable platform fees per the restaurant partner agreement before transfer
   • VAT (15%) is applied to applicable order components per Ethiopian tax law
   • All financial transactions are logged and retained for accounting and dispute resolution

Push Notifications

1. We use Firebase Cloud Messaging (FCM) to notify restaurants of:
   • New incoming orders requiring acceptance
   • Order updates and cancellations from customers
   • Driver arrival for pickup
   • Wallet credits and payment confirmations
   • Account status changes (approval, suspension, policy updates)
2. The Restaurant App supports multiple devices per account. Each device's push token is registered separately. Tokens are removed on logout.

Third-Party Services

1. We do not sell restaurant data to third parties for marketing purposes.

Restaurant Approval & Account Status

1. New restaurant accounts must be reviewed and approved by Bahiran administrators before going live. During this process:
   • Your business identity, contact details, location, and phone verification are reviewed
   • Upon approval, your restaurant becomes discoverable to customers on the platform
   • Restaurants may be temporarily suspended (isOpen: false / acceptingOrders: false) or banned for policy violations
   • You will be notified of status changes via push notification and SMS

Data Retention

1. Account & business profile — retained while account is active; deleted within 30 days of deletion request.
2. Order history — retained for up to 3 years for dispute resolution.
3. Financial & withdrawal records — retained for 5 years per Ethiopian financial and tax regulations.
4. Menu data and photos — deleted when account is deleted (Cloudinary assets purged).
5. Push notification tokens — removed when you log out of a device.
6. Technical logs — retained for 90 days.

Your Rights

1. Access. Request a copy of your restaurant account data and order history.
2. Correction. Update your business name, menu, hours, location, or contact info in-app.
3. Deletion. Request account and data deletion (subject to financial record retention requirements).
4. Portability. Request your menu and order data in a machine-readable format.
5. Notifications. Disable push notifications from your device settings.
6. Object. Object to processing based on legitimate interests by contacting us.

Security

1. Passwords hashed with bcrypt (12 salt rounds) — never stored in plain text.
2. All API communication encrypted via HTTPS/TLS.
3. JWT access tokens expire in 15 minutes; refresh tokens in 30 days.
4. Rate limiting on authentication and sensitive endpoints.
5. SMS OTP verification for account registration and recovery.
6. Admin approval gating prevents unauthorized public restaurant listings.

Changes to This Policy

1. We may update this Privacy Policy when our data practices change. Material changes affecting restaurant partners will be communicated via in-app notification and SMS at least 7 days in advance. Continued use of the Restaurant App after the effective date constitutes acceptance.

Contact Us

1. Reach the Bahiran Delivery privacy team at Gebeta Tech: bahiran@gebetatech.com.