Privacy Policy

Last Updated: January 2025

1. Introduction

Welcome to Spana ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App") and related services.

By using our App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our App.

2. Information We Collect

We collect minimal information necessary to provide our services:

2.1 Information You Provide

• Login Credentials: Phone number and password for account authentication
• Order Data: Product selections and quantities when you place orders (this data is sent to our servers to process your orders)

2.2 Information Stored Locally on Your Device

The following information is stored locally on your device and is not transmitted to us:

• Authentication Tokens: Access and refresh tokens stored securely on your device to maintain your login session
• Cart Information: Items you add to your shopping cart (stored locally until you place an order)
• App Preferences: Your language preference and theme settings (dark/light mode)

2.3 Information for Push Notifications

• Firebase Cloud Messaging Token: A unique token generated by Firebase to enable push notifications. This token is sent to our servers to deliver order updates and notifications to your device.

2.4 Information We Do NOT Collect

We do not collect the following information:

• Location data or GPS coordinates
• Device identifiers for tracking purposes
• Usage analytics or app performance metrics
• Payment information (payment processing is handled by our backend servers, not stored in the app)
• Email addresses (we only use phone numbers for authentication)
• Personal profile information stored locally

3. How We Use Your Information

We use the limited information we collect solely for the following purposes:

• Authentication: To verify your identity and allow you to access your account using your phone number and password
• Order Processing: To process and fulfill your orders based on the products and quantities you select
• Push Notifications: To send you notifications about your order status and important updates using Firebase Cloud Messaging
• Local App Functionality: To remember your cart items, language preference, and theme settings on your device

We do not:

• Track your usage patterns or analyze how you use the app
• Use your information for advertising or marketing purposes
• Share your information with third parties for analytics or tracking
• Collect location data or device identifiers

4. Third-Party Services

We use the following third-party service:

4.1 Firebase Cloud Messaging

Our App uses Google Firebase Cloud Messaging (FCM) solely to deliver push notifications to your device. We do not use Firebase Analytics or any other Firebase services that collect usage data.

Firebase Cloud Messaging requires a device token to send notifications. This token is generated by Google's Firebase service and is necessary for push notification functionality. Firebase's use of information is governed by Google's Privacy Policy: https://policies.google.com/privacy

Note: Firebase Analytics is disabled in our app. We do not collect or share analytics data with Google or any other third party.

4.2 Information Sharing

We share minimal information only as necessary:

• With Our Backend Servers: Your phone number, password (hashed), and FCM token are sent to our servers for authentication and notification delivery. Order data (product IDs and quantities) is sent to process your orders.
• Legal Requirements: We may disclose information if required by law, court order, or government regulation

We do not:

• Share your information with advertisers or marketing companies
• Sell your personal information to third parties
• Share your information with analytics providers
• Share your information with delivery partners (this is handled by our backend servers if needed)

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using SSL/TLS protocols
• Encryption of sensitive data at rest
• Regular security assessments and vulnerability testing
• Access controls and authentication mechanisms
• Secure data storage practices
• Employee training on data protection

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

6. Data Retention

Data Stored on Your Device: Information stored locally on your device (authentication tokens, cart items, preferences) remains on your device until you:

• Log out of the app (which clears authentication tokens)
• Clear the app's data or uninstall the app
• Place an order (cart data is cleared after order submission)

Data Sent to Our Servers: Information sent to our backend servers (phone number, order data, FCM token) is retained as necessary to:

• Maintain your account and process your orders
• Comply with legal obligations (e.g., order records for tax purposes)
• Deliver push notifications

When you delete your account or request data deletion, we will remove your personal information from our servers, except where we are required to retain it for legal or regulatory purposes.

7. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a portable format
• Opt-Out: Opt-out of marketing communications and certain data processing activities
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing of your personal information

To exercise these rights, please contact us using the information provided in the "Contact Us" section below.

8. Cookies and Tracking Technologies

We do not use cookies or tracking technologies. Our app does not:

• Use cookies or web tracking
• Track your app usage or behavior
• Use analytics or performance monitoring tools
• Display advertisements or use advertising tracking

Your app preferences (language, theme) are stored locally on your device using the device's local storage, not through cookies or tracking technologies.

9. Children's Privacy

Our App is not intended for children under the age of 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly.

10. International Data Transfers

Your information (phone number, order data, FCM token) is sent to our backend servers, which may be located in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. By using our App, you consent to the transfer of your information to these countries. We will take appropriate measures to ensure your information receives adequate protection in accordance with this Privacy Policy.

Note: Information stored locally on your device (cart items, preferences, authentication tokens) never leaves your device and is not subject to international transfer.

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including:

• The right to know what personal information is collected, used, or shared
• The right to delete personal information
• The right to opt-out of the sale of personal information
• The right to non-discrimination for exercising your privacy rights

Important: We do not sell your personal information to third parties. The only information we collect is your phone number, password (for authentication), FCM token (for notifications), and order data (product selections).

12. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including:

• Right of access: You can request a copy of the personal information we hold about you
• Right to rectification: You can request correction of inaccurate information
• Right to erasure: You can request deletion of your personal information
• Right to restrict processing: You can request that we limit how we use your information
• Right to data portability: You can request your data in a portable format
• Right to object: You can object to processing of your personal information
• Right to withdraw consent: You can withdraw consent for data processing
• Right to lodge a complaint: You can file a complaint with your local data protection authority

To exercise these rights, please contact us using the information provided in the "Contact Us" section below.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated Privacy Policy in our App
• Updating the "Last Updated" date at the top of this policy
• Sending you a notification (if required by law)

Your continued use of our App after such changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

This Privacy Policy is effective as of the "Last Updated" date shown above and applies to all users of the Spana mobile application.