Bahiran Restaurant App
Privacy Policy

This Privacy Policy applies to the Bahiran Restaurant App — the progressive web application used by restaurant partners to manage incoming orders, update their menu, control their open/closed status, track earnings, and interact with customers and drivers via the Bahiran Delivery platform.

As a restaurant, you are both a business entity and an account holder on our platform. We collect business-level and account-level data to operate the partnership. This policy explains what data we collect, how it is used, and how it is protected.

We collect the following data from restaurant accounts:

Your restaurant's GPS coordinates are stored in MongoDB with a 2dsphere geo-index, enabling:

• Customers to find your restaurant when searching for food near their delivery address
• Drivers to navigate to your restaurant for order pickup
• The platform to calculate delivery fees based on restaurant-to-customer distance
• Discovery features such as "restaurants near me" in the User App

Your location is static (set during registration) and is not continuously tracked like driver locations. You may update your location by contacting support.

Your full menu — including item names, descriptions, prices, categories, photos, availability, and packaging fee settings — is stored and displayed publicly to customers browsing the Bahiran User App. This is the nature of a marketplace listing:

• Menu data is visible to all Bahiran customers and is considered public business information
• Menu item photos are stored on Cloudinary and served via CDN
• Packaging fees (per-item ETB charge) are configured by you and disclosed to customers at checkout
• You can add, edit, or remove menu items at any time from the Restaurant App

Revenue generated from orders flows into your in-app wallet (ETB balance). When you request a withdrawal:

• Withdrawal requests are processed via Chapa Transfer
• Your bank account or mobile money details are transmitted to Chapa to process the payout
• Bahiran deducts applicable platform fees per the restaurant partner agreement before transfer
• VAT (15%) is applied to applicable order components per Ethiopian tax law
• All financial transactions are logged and retained for accounting and dispute resolution

We use Firebase Cloud Messaging (FCM) to notify restaurants of:

• New incoming orders requiring acceptance
• Order updates and cancellations from customers
• Driver arrival for pickup
• Wallet credits and payment confirmations
• Account status changes (approval, suspension, policy updates)

The Restaurant App supports multiple devices per account. Each device's push token is registered separately. Tokens are removed on logout.

We do not sell restaurant data to third parties for marketing purposes.

New restaurant accounts must be reviewed and approved by Bahiran administrators before going live. During this process:

• Your business identity, contact details, location, and phone verification are reviewed
• Upon approval, your restaurant becomes discoverable to customers on the platform
• Restaurants may be temporarily suspended (isOpen: false / acceptingOrders: false) or banned for policy violations
• You will be notified of status changes via push notification and SMS

• Account & business profile — retained while account is active; deleted within 30 days of deletion request
• Order history — retained for up to 3 years for dispute resolution
• Financial & withdrawal records — retained for 5 years per Ethiopian financial and tax regulations
• Menu data and photos — deleted when account is deleted (Cloudinary assets purged)
• Push notification tokens — removed when you log out of a device
• Technical logs — retained for 90 days

• Passwords hashed with bcrypt (12 salt rounds) — never stored in plain text
• All API communication encrypted via HTTPS/TLS
• JWT access tokens expire in 15 minutes; refresh tokens in 30 days
• Rate limiting on authentication and sensitive endpoints
• SMS OTP verification for account registration and recovery
• Admin approval gating prevents unauthorized public restaurant listings

We may update this Privacy Policy when our data practices change. Material changes affecting restaurant partners will be communicated via in-app notification and SMS at least 7 days in advance. Continued use of the Restaurant App after the effective date constitutes acceptance.