Privacy Policy

Effective date: 21 October 2026
Controller: Range SAL ("Range", "we", "us"), Lebanon. Privacy contact: rangelebanon@gmail.com.

This policy explains what personal data Range collects, why, who we share it with, and your rights. It applies to the Range customer, merchant, and driver apps and the admin website.

1. Data we collect

We do not intentionally collect special-category data. Please don't include sensitive personal data in free-text fields (e.g. delivery notes, chat).

2. How we use your data

• Provide the service, create and manage your account, show shops/products, run your cart and checkout.
• Process orders & payments, take payment (or arrange COD), apply wallet credit/promos/referral rewards, issue receipts and refunds.
• Deliver your order, share the delivery address and necessary contact details with the Merchant and the assigned Driver, and share the Driver's live location with you for tracking.
• Authenticate & secure, send and verify login codes over WhatsApp; detect and prevent fraud, abuse of promotions/refunds, and unauthorized access.
• Communicate, order updates and delivery notifications (push), and service messages; marketing only where permitted or with your consent (you can opt out).
• Connect you with friends, if you choose, show which of your contacts are on Range (contact matching) so you can chat and share products with them, and deliver those messages.
• Keep the community safe, review reports, remove messages that break our rules, and restrict chat access for people who misuse it.
• Improve & support, troubleshoot, analyze usage in aggregate, and improve the Platform.
• Comply with law, tax, accounting, and legal obligations, and to respond to lawful requests.

Legal bases (where required by Lebanon/applicable law): performance of our contract with you; your consent (e.g. precise location, marketing); our legitimate interests (e.g. security, fraud prevention, service improvement); and compliance with legal obligations.

3. Location data (detail)

• Customers: we use the delivery location you set to calculate delivery, route the Driver, and show tracking.
• Drivers: while you are on an active delivery, the app collects your precise location, including when the app is in the background or the screen is off, and shares it live with the customer so they can track the order. Collection stops when the delivery ends. You can disable location in your device settings, but you will not be able to accept or complete deliveries without it. iOS shows a status indicator while background location is active.

3A. Contact matching and friends chat (detail)

Contact matching is optional. It only happens when you tap Sync Contacts in the Chats tab and allow contacts access in your device's permission prompt. You can turn access off at any time in your device settings; the app then stops syncing.

• What we receive. The phone numbers in your address book, converted to international format on your device. We do not receive the names, emails, photos, notes or any other details saved with your contacts.
• What we do with them. We compare the numbers with the verified phone numbers of Range customers and tell your app which ones match. Numbers are processed only to perform that comparison and are not stored on our servers, whether or not they match.
• What we keep. A daily count of how many numbers your account checked, to prevent abuse (for example, someone uploading lists of numbers to find out who uses Range). Checks are also limited per day.
• What stays on your device. The list of your contacts who are on Range, shown under the names you saved them with, plus contacts who aren't on Range so you can invite them. It is deleted from the device when you sign out.
• People who aren't on Range. Their numbers are only compared and then discarded. We never contact them. If you invite someone, the invite is sent by you, from your own WhatsApp or messaging app.
• How you appear to others. If your verified phone number is saved in another customer's contacts and they sync, their app shows that you are on Range, with the name they saved for you (or your profile name). People who can see you this way can start a chat with you. You are not shown to anyone you have blocked or who has blocked you. Accounts without a verified phone number can't be found this way; they can only be added with their Range code, which they choose to share.
• Choosing not to be found. Account → Privacy → "Let friends find me by my number" is on by default. Turn it off and contact matching stops showing you to anyone, from their next sync. Chats you already have keep working, and friends can still add you with your Range code. You can turn it back on at any time. The switch is also on the Chats → New Chat screen.
• Friends chat. Messages and shared products are stored so we can deliver them and show your chat history. They are visible to you and the person you are chatting with. A shared product includes its name, picture, shop and price at the moment it was shared. We don't read your chats, except when someone reports a conversation: our team then reviews that conversation to decide whether it breaks our rules.
• Blocking and reporting. You can block anyone from a chat; they can no longer message you or find you through contact matching. When you report someone, we don't tell them who reported them. We tell you when we have reviewed your report.
• Moderation. If a message breaks our rules we may remove it for both people, keeping a copy in an internal record as evidence. We may suspend a person's chat access and tell them why. A chat suspension doesn't affect shopping or orders.

4. Payments

Card payments are processed by our payment provider (Tap Payments) via its **hosted payment page. Your full card number and security code are entered on the provider's page and are not seen or stored by Range's servers.** We store only non-sensitive card metadata (brand, last 4, expiry) and a provider token so you can reuse a saved card. Wallet payments are processed by
Whish Money. Cash on Delivery is collected by the Driver. Payment providers process your data under their own privacy policies.

5. Who we share data with

We share personal data only as needed to run the Platform:

• Merchants, only what was bought from their shop (items, quantities, price and order status). Range stores, packs and delivers orders from its own warehouse, so merchants do not receive your name, address or phone number. If a product complaint needs the merchant's help, we share only what is needed to resolve it.
• Drivers, the pickup point (our warehouse), your delivery address and the contact/coordination details needed to deliver, for the duration of the delivery. When a Driver collects stock from a Merchant or brings a Merchant a cash payout, the Driver sees that Merchant's pickup address and the name and phone number of the pickup contact, for that trip only.
• Other customers, only through the friends chat: the people you chat with see your messages, the products you share, your profile name and whether you've read their messages. Customers who have your verified phone number in their contacts can see that you're on Range (see §3A). We never show your phone number to anyone who doesn't already have it.
• Service providers / sub-processors (process data on our behalf, under contract):
• Supabase, cloud hosting, database, authentication, file storage, and realtime.
• Tap Payments, card payment processing. Whish Money, wallet payments.
• Meta Platforms (WhatsApp Business) and Zavu, delivering your login code over WhatsApp.
• Apple (APNs) and Google (Firebase Cloud Messaging), via Expo, push-notification delivery and token registration.
• OpenStreetMap and MapTiler, map display (may receive approximate map-view and IP data to serve tiles).
• Vercel, hosting the admin website.
• Sentry, error/crash diagnostics (only if enabled).
• Resend, transactional email (e.g. confirmations, password reset).
• Shopify, only if a Merchant connects a Shopify store, to sync that Merchant's catalog.
• Legal & safety, authorities or third parties where required by law, to enforce our terms, or to protect the rights, property, or safety of users, Drivers, Merchants, or the public.
• Business transfers, in a merger, acquisition, or asset sale, subject to this policy.

We do not sell your personal data.

6. International transfers

Some sub-processors may store or process data on servers outside Lebanon (e.g. cloud regions). Where this happens, we take steps to ensure an appropriate level of protection as required by applicable law.

7. Data retention

We keep personal data while your account is active and as needed to provide the service. We retain transaction and financial records for as long as required for tax, accounting, and legal purposes (typically 10 years, as Lebanese commercial law requires). When data is no longer needed, we delete or anonymize it. Some data may persist in backups for a limited period before deletion.

• Contact numbers from contact matching are not retained at all (only a daily count of checks).
• Friends chat messages are kept so both people keep their chat history. Deleting a chat in the app hides it for you only; the other person still has it. If you delete your account, your name is removed, you can no longer sign in or be found through contact matching, and messages you already sent stay in the other person's chat history.
• Moderation records (reports, decisions, bans, and copies of removed messages) are kept for 2 years to handle appeals, repeat abuse and legal requests.
• Merchant verification photos (ID, selfie, registration certificate) are kept in private storage that only our team can open, while the shop is active and for 10 years after it closes, as required for business and tax records.

8. Your rights

Subject to Lebanon law, you may request to: access the personal data we hold; correct inaccurate data; delete your account and data; object to or restrict certain processing; withdraw consent (e.g. marketing, location) without affecting prior processing; and receive a copy of certain data. To exercise these rights, contact rangelebanon@gmail.com. We may need to verify your identity, and some data may be retained where the law requires. You may also lodge a complaint with the competent Lebanon data-protection authority.

Being found by your number: turn off "Let friends find me by my number" (Account → Privacy) to stop appearing in other customers' contact matching (see §3A).

Contacts access: you can withdraw it at any time in your device settings (iPhone: Settings → Range → Contacts; Android: Settings → Apps → Range → Permissions). This stops future syncing; your contact list was never stored on our servers.

Account deletion: you can request deletion in-app (Account, then Delete account) or by contacting rangelebanon@gmail.com. Deletion removes your profile and personal data, subject to legal retention of transaction records.

9. Security

We protect data with encryption in transit, database-level access controls (row-level security so users can only access their own data), and restricted administrative access. No system is perfectly secure; you are responsible for keeping your device and login secure.

10. Cookies & local storage

The mobile apps store your login session and push token on your device. The admin website uses local storage for your session and a service worker to enable web-push notifications. We use minimal, essential storage; we do not use third-party advertising cookies.

11. Children

The Platform is not directed to children under 18, and we do not knowingly collect their data. If you believe a child has provided us data, contact rangelebanon@gmail.com and we will delete it.

12. Changes to this policy

We may update this policy. Material changes will be notified in-app or by email/message before they take effect. The "Effective date" above shows the latest version.

13. Contact

Privacy questions or requests: rangelebanon@gmail.com · Range SAL, Lebanon.