This document explains how the JOE — Specialty Coffee app (the café’s digital menu) collects, uses, and protects your information. We are committed to protecting your privacy in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia.

1 Browsing without signing in

You can browse the full menu — coffee, tea, cold drinks, and desserts — view prices, and see the nearest branch without creating an account or signing in. We do not request any personal data at this stage.

We only ask for your mobile number and verify it via a one-time code (OTP) when you place an order. The “Wallet” and “Loyalty Points” features then appear in the side drawer.

2 Data we collect

• Mobile number: to create and verify your account via OTP when you place your first order.
• Location (GPS): to detect and suggest the nearest branch when ordering.
• Your addresses: addresses you save for delivery orders.
• Order data: the products you ordered, the branch, and the order date and time.
• Wallet & loyalty points: your balance, points, and related transaction history.
• Technical data: device type and operating system, used to run and improve the app.

3 How we use your data

• To process and manage your orders at the right branch.
• To suggest the nearest branch based on your location.
• To manage your wallet balance and loyalty points.
• To secure your account and verify your identity via OTP.
• To improve app performance and user experience.

4 Location data

We use your device location (GPS) solely to determine the nearest branch. You may decline the location permission and select a branch manually. We do not track your location in the background.

5 One-time code (OTP)

When you order, we send a verification code via SMS to your mobile number to confirm it belongs to you. We may use a trusted third-party SMS provider solely to deliver these messages.

6 Data sharing

We do not sell your personal data to anyone. We may share it only with:

• Service providers who help us operate the app (such as SMS/OTP delivery or hosting), under agreements that protect your data.
• Competent government authorities where required by law.

7 Data retention

We retain your data while your account is active, or as needed to provide the service and meet legal and financial obligations. When you delete your account, your data is removed as described on the Delete Account page.

8 Your rights

• Access your data and request a copy.
• Correct any inaccurate data.
• Request deletion of your account and data.
• Withdraw consent for permissions such as location at any time.

9 Account & data deletion

You can delete your account and data directly within the app or by contacting us. Full steps are on the Delete Account page.

10 Children’s privacy

The app is not directed to children under 13, and we do not knowingly collect data from them.

11 Data security

We apply reasonable technical and organizational measures to protect your data from unauthorized access or use. However, no method of transmission over the Internet is 100% secure.

12 Changes to this policy

We may update this policy from time to time; the last-updated date appears at the top of the page.