Request account deletion: process and data retention rules
This information is not available yet.
Optional advertising matching
If you explicitly allow customer matching on our Cookies Policy page, we share SHA-256 hashes of your email, phone and account ID with Meta while you are signed in, to improve matching of shopping activity to advertising. Hashing does not make this data anonymous. We do not add your name, address or birth date for this matching. Matching is off by default and you can withdraw permission anytime on our Cookies Policy page.
Operational and security logs
To operate the website and app and diagnose problems, we collect IP addresses, visit times, page paths, referring hosts, selected campaign tags, device/browser types and versions, and the model where the browser or app discloses it. Country/city are estimated from IP using a local database, not GPS. Presence monitoring uses a temporary tab/app session reference and periodic messages while active; authenticated reports may include an account ID. We record coarse basket, sign-in and order-attempt outcomes to diagnose friction, without form contents or verification codes. We also record submitted product search terms and estimated visible time on each page, excluding background time. Email-like searches, long numbers and credential-like terms are redacted. These diagnostics exclude passwords, access tokens, form contents, full query strings and card numbers. Records are kept for 30 days and accessible only to the owner administrator. Hosting logs are separate and may have different retention. We do not create a permanent device identifier or send IP addresses to a third-party location lookup.
Additional technology disclosure
The current website code uses these services when the relevant feature is used:
- Google Analytics and Meta: page and shopping events measure website usage and advertising. You can disable optional measurement on our Cookies Policy page. Saved opt-outs and Global Privacy Control are respected. Page URLs exclude search parameters.
- Google Maps and Places: loading the address map sends your IP address to Google; an address or map point you enter is sent for place search or geocoding.
- The configured SMS provider and mail transport: phone or email information is sent to deliver verification codes and account messages.
- Firebase Cloud Messaging: device tokens may be used for order notifications if you enable them in the app.
- Hugging Face and jsDelivr: the administrator image editor may download a background-removal model and its WebAssembly runtime. The image is processed in the browser by that tool.
- Optional legacy Laravel digital checkout integrations include Stripe, Razorpay, bKash, Mercado Pago, PayPal, Paystack, Telr, SSLCommerz and SenangPay. The chosen payment provider receives payment and order details when its option is used. The current Next.js checkout places cash-on-delivery orders.
- Some legacy Laravel pages also load Font Awesome, Google hosted jQuery and reCAPTCHA, unpkg, Firebase, Quill CDN, DataTables CDN and MaxCDN. Those providers receive browser connection information when the relevant page is opened.
WhatsApp, Facebook, Instagram, TikTok, Google Play and the App Store receive information when you choose to open their links. Product and address data otherwise goes to the Al Khalil Foods backend. Contact us through the footer to ask about access or deletion.
Delivery maps and arrival estimates
When you open delivery tracking, your assigned driver’s vehicle coordinates and your saved delivery coordinates are sent to Google to calculate the route and arrival estimate. Google also receives browser connection information. Tracking is available only to the order owner while the order is out for delivery. Arrival times are estimates and may change because of traffic or stops.