سياسة الخصوصية

Lakta — Privacy Policy (English)

Effective date: 2 September 2026  |  Last updated: 2 September 2026

This Privacy Policy explains how Lakta ("Lakta", "we", "us") — the mobile apps (com.qlevar.lakta on Google Play and Lakta Souk on the App Store), the website lakta.online and the web app app.lakta.online (together, the "Service") — collects, uses, shares and protects your personal data. By using the Service you consent to this Policy.

1. Information we collect

• Account & registration: name, phone number, email; a hashed password for email sign-up; account type and, if you upload one, a profile photo or store logo.
• Sign in with Google / Apple: when you choose this, we receive your name, email address and the provider account ID (Apple may supply a private relay email). We never see your Google or Apple password. We use this data only to create or access your Lakta account and identify you. See section 4.
• Location: your GPS coordinates (with your permission) for accurate delivery addresses, shipping options, nearby pickup points and nearby stores. You can decline or revoke this in your device settings.
• Device & technical: device type, OS and version, device identifiers, app version, browser user-agent, IP address and approximate country, crash and error logs, and a Firebase Cloud Messaging token for notifications.
• Orders, delivery & payment: cart and order contents, delivery address and contact phone, gift-recipient details, and the payment method you choose. We do not store full card details — international card payments are handled by Stripe and ShamCash by its provider.
• Content you create: listings, products, reviews, questions, in-app chat messages to other users and their attachments, and support conversations and attachments.
• Usage, analytics & cookies: pages/screens viewed and actions taken (search, add-to-cart, purchase). On the web we use browser localStorage and IndexedDB for your session and offline cart/catalogue cache, and Meta advertising-measurement cookies (_fbp, _fbc). We use an analytics service (app-pulse) and the Meta Pixel / Conversions API to measure marketing.

2. How we use your information

To create and secure your account and sign you in (including via Google/Apple); to process and deliver orders and coordinate with delivery companies and payment providers; to provide customer support; to send transactional notifications and, with your consent, marketing notifications (which you can turn off); for fraud prevention, safety and content moderation; for analytics and product improvement; and to comply with legal and accounting obligations.

3. How we share your information

• Delivery / shipping companies: name, phone and city/address — only as needed to deliver your order.
• Payment providers (Stripe, ShamCash): data required to complete payment.
• Google: for Google sign-in, and Firebase Cloud Messaging (device token only) to deliver notifications.
• Meta Platforms (Facebook/Instagram): identifiers and events (some hashed) for ad measurement via the Pixel and Conversions API.
• Analytics provider: usage events, de-identified where possible.
• Other users: your public profile, listings, products, reviews and messages you send them.
• Competent authorities: when compelled by a valid order of the competent Syrian authorities.
• Business transfers: in a merger or acquisition, with notice of any material change.

We do not sell your personal data.

4. Sign in with Google — specific disclosure

• When you choose "Sign in with Google", we access your Google profile's basic information: name, email address and Google account ID.
• We use Google user data solely to create or access your Lakta account. We do not use it for advertising, we do not sell it, and we do not share it with third parties except as needed to run this feature or where legally required.
• We retain Google user data as part of your account for as long as your account exists; you can delete it by deleting your account (section 7).
• You can revoke Lakta's access at any time at myaccount.google.com/permissions.
• Lakta's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Security

Data in transit is encrypted with SSL/HTTPS. Data is stored on protected servers with least-privilege access limited to authorised staff. No method of transmission or storage is 100% secure; we use commercially reasonable measures to protect your data.

6. Data retention

We keep your personal data while your account is active and as needed to provide the Service. After account deletion we erase your data from our active records, keeping only what local law requires for accounting/legal audit, for a limited period, after which it is deleted or anonymised.

7. Your rights and choices

• Access & correction: in the app's or web app's profile settings.
• Account deletion: in the app ("Delete account"), via the Delete Account page, or by emailing us below.
• Marketing notifications: turn off in app or device settings.
• Location permission: decline or revoke in device settings.
• Google access: revoke on your Google Account permissions page.

8. Children's privacy

The Service is not directed to children, and we do not knowingly collect data from anyone below the legal age to contract in their country of residence. If we learn we have, we will delete it.

9. Where data is processed

Your data may be processed and stored on servers inside or outside Syria by the infrastructure and service providers named in section 3. By using the Service you consent to this transfer.

10. Changes to this Policy

We may update this Policy. We will post the updated version here with a new effective date, and for material changes we will notify you in the app or by email.

11. Contact us

For any privacy question or request: [email protected] · +963931478423 · https://lakta.online