سياسة الخصوصية

Privacy policy (English)

Effective 2026-11-09. Covers the Hassa customer app, the Hassa Driver app, the restaurant dashboard and the hasssa.com website, operated by Hassa (هسّه), Mosul, Iraq.

Hassa is a food-ordering platform for Mosul: customers order at the restaurant's own prices, the restaurant's driver delivers, and payment is cash on delivery. We collect only what is needed to deliver an order. We do not sell data, show ads, or include any advertising, analytics or tracking SDK in the apps.

Customer app

• Phone number: sign-in with a one-time WhatsApp code; the restaurant may call to confirm the order. Seen by the restaurant you ordered from, and its driver during delivery.
• Name and delivery address (neighbourhood, landmark text, optional map pin): to deliver the order. Seen by the restaurant and its driver during delivery.
• Device location: read once, only when you tap “my current location”, to place the pin. Never collected in the background.
• Address search: what you type to find your area, a landmark or a street moves the map. It is not saved with your account. When you press search, our server sends only that text (not your name, phone, IP address or location) to an address service: OpenStreetMap's Nominatim, or Google Places if we turn it on.
• Orders and complaints: items, prices, status, notes; kept as the restaurant's records and shown in “My orders”.
• Order ratings (optional, after delivery): stars for the food, good or not for the delivery, the quick notes you pick and your comment. The restaurant you ordered from sees them with the order number and your name as the order shows it, including a delivery score per driver; the Hassa team sees averages. Drivers never see ratings.
• Push token and app language, a random device identifier, IP address and user agent at sign-in: order notifications in your language and account security (one session per device, sign-in rate limits).
• Restaurant link visits: when you open a restaurant's public page (/r/…) or open the app from that link, we count one visit for that restaurant per day. Your IP address is mixed with a random value that changes daily and hashed; the hash is deleted within 2 days and only daily counts per restaurant are kept. No cookies and no third-party analytics. An order placed after such an open is marked “from the link”. When you open the page on a phone we also keep that restaurant for one hour under the same hash, so that if you install the app it opens on that restaurant the first time. The restaurant and the Hassa team see the counts only.
• Live order card: while an order is on its way, your phone shows its progress on the Lock Screen (iPhone Live Activity) or as an ongoing notification (Android). On iPhone the card's own push token is sent to us so we can update it; it is deleted when the order ends.

While your order is out for delivery you see the driver's position on a map, with the driver's first name and vehicle. The driver's phone number is never shown.

Driver app

• Precise location, only from pickup until the order is delivered or reported as failed, including while the app is closed or the screen is off, with a persistent “delivery in progress” notification. Never while waiting or off shift; the Android app does not request background location permission. Shared only with that order's customer and the driver's restaurant; deleted after 7 days.
• Phone number, first name and vehicle (entered by the restaurant); the cash ledger (cash collected and handed in); push token and app language, device identifier, IP address and user agent at sign-in.
• Customer name, phone and address are shown to the assigned driver only from “ready” until delivery, then hidden.

Restaurant join form (hasssa.com)

When you apply from the website we receive only what you type: restaurant name, contact name, phone number, neighbourhood, whether you have drivers and how many, and your note. We use it only to contact you about joining. It is seen by the Hassa team, in the admin dashboard and as an alert to the Hassa admins' Telegram group. The website sets no cookies and has no tracking or analytics; your IP address is used only to limit repeated submissions and is not stored with the application. Applications are kept while we follow up and deleted on request.

Service providers

WhatsApp/Meta (phone number and sign-in code), Telegram (new-order alerts to the restaurant's staff group, including the customer's name, phone, neighbourhood and items; join-form applications to the Hassa admins' group), Expo, Google Firebase and Apple push services (push token, Live Activity token and notification text), Google Maps (map display, under Google's policy), OpenStreetMap's Nominatim or Google Places (the text of a submitted address search, sent by our server without anything that identifies you), Sentry (crash reports: app version, device model, OS and where the error happened, with no name, phone, address or location), Hetzner in Germany (servers and database) and Cloudflare (menu photos, encrypted backups, this page). We disclose data to authorities only when Iraqi law requires it.

Retention and security

Sign-in codes: 5 minutes, single use. Sessions: 90 days from last use. Driver location trail: 7 days. Link-visit hashes: 2 days (only daily counts per restaurant remain). Join-form applications: while we follow up, deleted on request. Orders, cash ledger, complaints and ratings are kept as the restaurant's records (anonymised when you delete your account). Encrypted database backups: 30 days. Server logs: a few days, with phone numbers masked. All traffic uses HTTPS; codes and passwords are stored only as one-way hashes.

Your choices and account deletion

Edit your name and addresses in the app. Delete your account in the app under Profile → Delete account: we erase your phone number, name and saved addresses, remove your name, phone, address and notes from past orders, and sign you out everywhere; the restaurant keeps only the order number, items and amount, and the stars of any rating (your written comment is erased). See account deletion. Drivers are removed by their restaurant and may ask us to erase their name and phone. Contact: support@hasssa.com; we answer within 7 days. The apps are not directed at children under 13. We will update the date above when this policy changes and tell you in the app about material changes.