Privacy Policy

Personal information you provide. We collect personal information that you voluntarily provide when you create an account, place an order, or contact us. This may include:

• Account information: your first and last name, email address, phone number, username, and password (stored only in hashed form).
• Delivery addresses: the addresses you save for delivery, including any landmarks or notes and, where you choose, their map coordinates (latitude/longitude) so we can estimate delivery fees and route your order.
• Order information: the stores you order from, the items in your order, order totals, delivery or pickup choice, order status history, and any notes or ratings you leave.
• Payment information: payments are processed by our third-party payment provider. We receive a confirmation, the amount, and a transaction reference — we do not collect or store your full card number or card security details.
• Communications: if you contact support, we collect the content of your messages and related records.

All personal information you provide must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected. When you use our Services we automatically collect certain information, such as your device type and operating system, app version, IP address, language preferences, and information about how you use the app (pages or stores viewed, session and device identifiers). This is used to operate and secure the Services and for analytics. On our website, we use essential cookies and local storage to keep the site working.

Location information.With your permission, we collect your device's location to show stores near you, pre-fill delivery addresses, and estimate delivery distances and fees. You can enable or disable location access at any time in your device settings; some features may not work without it.

Push notification token.If you enable notifications, we collect a push token from your device's notification service (Firebase Cloud Messaging) so we can send you order updates and other messages. You can turn off notifications at any time in your device settings.

We process your personal information to:

• Create and manage your account.
• Process and fulfil your orders — sharing the necessary details with the store and, for delivery orders, the assigned rider.
• Process payments through our payment provider and maintain your order history.
• Send notifications — order status updates, receipts, and account or service messages.
• Provide customer support and resolve issues or disputes about an order.
• Detect fraud and keep the platform secure and enforce our Terms of Service.
• Improve our Services using analytics and feedback.
• Send marketing or promotional messages where you have opted in. You can opt out at any time.

Stores and riders. When you place an order, we share the details needed to fulfil it. The store receives your order contents, your first name, and (for delivery) your delivery address and a contact number. For delivery orders, the assigned rider receives your delivery address and contact details so they can complete the delivery.

Service providers. We share information with third parties who perform services for us and require access to do that work, including:

• Cloud infrastructure and hosting providers
• Our payment processor and financial institutions
• Push notification and SMS messaging services
• Analytics and performance-monitoring services

These providers are bound by contracts and may only use your data as directed by us.

Legal requirements. We may disclose your information where required to comply with applicable law, a governmental request, or legal process, or where necessary to investigate or prevent fraud, protect the safety of any person, or address illegal activity.

Business transfers. We may share or transfer your information in connection with a merger, sale of assets, financing, or acquisition. We do not sell your personal information to third parties for advertising purposes.

On our website we use essential cookies and local storage to keep the site functioning and to remember your preferences. We do not use third-party advertising cookies. In the mobile app we use device and usage identifiers for analytics and to keep you signed in. You can control cookies through your browser settings, though some parts of the site may not work without them.

We keep your personal information only for as long as necessary for the purposes set out in this Notice, unless a longer period is required or permitted by law. We retain account data while your account is active. Order and payment records are kept for a minimum period required to meet financial, tax, and legal obligations (typically up to seven years). Precise location captured for an order is not retained beyond what is needed to fulfil and support that order.

When we no longer have a legitimate business need to process your information, we will delete or anonymise it, or securely store and isolate it where deletion is not immediately possible (for example, in backups).

We use appropriate technical and organisational measures to protect your information, including TLS encryption in transit, encrypted storage of sensitive fields, role-based access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You access the Services at your own risk and should use a secure network and keep your password confidential.

We do not knowingly collect data from or market to children under 18. By using the Services you represent that you are at least 18 years old or that you are using the Services with the involvement of a parent or guardian. If we learn that we have collected personal information from a child under 18, we will deactivate the account and delete such data. If you believe we may have any information from a child under 18, contact us at privacy@bigmerchant.co.

Depending on your location, you may have the right to:

• Access — request a copy of the data we hold about you.
• Rectify — ask us to correct inaccurate or incomplete data.
• Erase — request deletion of your account and personal data, subject to our legal retention obligations.
• Restrict or object — limit or object to certain processing, including direct marketing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — where we rely on consent (e.g. location or marketing), at any time.

You can review and update most account details directly in the app under Account. To exercise any other right, email privacy@bigmerchant.co. We will respond in line with applicable data protection laws, generally within 30 days. To delete your account, see our Account Deletion page.

Most browsers and some mobile systems offer a Do-Not-Track ("DNT") setting. As no uniform standard for DNT has been finalised, we do not currently respond to DNT signals. If a standard is adopted that we must follow, we will update this Notice.

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised "Last updated" date. For material changes we may notify you in the app or by other means. Continued use of the Services after changes take effect constitutes acceptance of the revised Notice.

If you have questions or comments about this Notice, you can reach our Data Privacy team: