Privacy Policy
Last updated: May 2026
1. Information We Collect
You give us: phone number, name, delivery addresses (with optional geolocation coordinates when you grant location access), order details, and any messages you send us. Automatically: IP address, browser and device info, page URLs you visit, and click/scroll patterns. Stored locally on your device: cart contents, selected delivery zone, language, and theme — held in browser storage (IndexedDB / cookies) so the app works between visits. We do not collect or store payment card numbers — all payments are handled by our payment provider.
2. How We Use Your Information
To fulfil orders and arrange delivery, send one-time-password codes by WhatsApp or SMS, communicate about your account and orders, send marketing only with your explicit opt-in, detect fraud and abuse, improve the product through aggregated analytics, and meet legal obligations under Lebanese law.
3. Service Providers We Share Data With
We do not sell your personal data. The third parties below process specific data on our behalf under contract: Supabase (account, profile, addresses, orders — primary database, hosted in the EU); Vercel (website hosting, cookieless web analytics, performance metrics); Microsoft Clarity (anonymised session recordings and heatmaps); Meta WhatsApp Cloud API (one-time-password delivery to your phone); Twilio (SMS one-time-password delivery when WhatsApp fails); Upstash Redis (short-lived storage of one-time-password codes, automatically deleted after 5 minutes). When required by law, we may disclose data to legal authorities.
4. Data Security
We use HTTPS for all traffic, encrypted database storage, hashed authentication tokens, row-level security policies on our database, HMAC-signed internal webhooks, and a strict Content-Security-Policy on the website. No method of transmission over the internet is 100% secure; in the unlikely event of a breach affecting your data, we will notify you.
5. Your Rights
You may request access to your personal data, correct it, export a machine-readable copy, or delete your account. You may also opt out of marketing messages at any time. To exercise any of these rights, email info@frutzco.com from the address associated with your account — we will respond within 30 days.
6. Cookies and Local Storage
Essential (no consent needed): your sign-in session, cart contents, selected delivery zone, language, and theme. Analytics: Microsoft Clarity uses cookieless mode by default and we have not enabled cross-session cookies; Vercel Web Analytics is fully cookieless; our own first-party analytics stores an anonymous session ID locally — no advertising cookies are set. We do not currently run third-party advertising pixels (Meta, Google Ads, TikTok). You can clear all of the above from your browser at any time.
7. Children's Privacy
Our services are not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us data, email info@frutzco.com and we will delete it.
8. Changes to This Policy
We may update this policy when our data practices change or when we add or remove a service provider. Changes take effect upon posting; the date at the top reflects the most recent revision. We will notify you of material changes by email or in-app.
9. Analytics & Performance Tools
We use Microsoft Clarity to record anonymised session activity (clicks, scrolls, page navigations) so we can identify usability issues and broken flows. Recordings have phone-number fields, OTP inputs, full addresses, profile details, order history, and order receipts explicitly masked — these appear as blocked rectangles in playback. Clarity may aggregate behavioural patterns to improve Microsoft's services; it does not sell raw recordings. We also use Vercel Web Analytics for traffic counts (cookieless, aggregated) and Vercel Speed Insights for page-performance metrics (Core Web Vitals like LCP, CLS, INP). In addition, our own first-party analytics records button clicks, page views, and errors against an anonymous session ID — never tied to your real name or phone.
10. Data Retention
Order records: retained for 7 years to meet Lebanese accounting and consumer-law requirements. Profile and address data: kept while your account is active; deleted within 30 days of account closure. Session recordings (Clarity): retained 30 days by default. First-party analytics events: retained 90 days for product analysis.
11. Contact Us
Email: info@frutzco.com | Phone: +961 71864864 | Address: Main Road, Facing Kortbawi USJ, Adma, Lebanon