Your privacy matters to us. This Privacy Policy explains how Star Power Supplements ("we", "us", "our") collects, uses, discloses, and safeguards your information when you use our mobile application and website ("Service"). Please read carefully.
1. Information We Collect
We collect information you provide directly and information generated through your use of the Service.
a) Account & Profile Information
- Name — to personalize your orders and receipts
- Email address — for account login and order notifications
- Phone number — for delivery coordination and OTP verification
- Delivery address — to fulfil orders
- Password — stored in encrypted (hashed) form only
- Role/Type — Customer, Wholesale (Gym Coach), Rider, or Admin
b) Order & Transaction Data
- Cart contents, order history, product preferences
- Payment method (Cash on Delivery or Credit/Udhaar)
- Voucher/discount code usage
- Outstanding credit balance and payment history
c) Location Data
- Delivery riders: Real-time GPS location (including background) during active deliveries to enable live tracking for customers and delivery ETA. Location is only shared while an order is in progress.
- Customers: We may request approximate location to auto-fill delivery addresses. Location tracking is not continuous for customers.
d) Device & Technical Data
- Device model, operating system version, unique device identifiers
- App version, crash reports, and performance data
- IP address, network connection type
- Push notification token (Firebase Cloud Messaging)
2. How We Use Your Information
We use the collected information for the following purposes:
- To provide, operate, and maintain the Service
- To process orders, arrange deliveries, and collect payments (COD/Udhaar)
- To display real-time delivery tracking on maps
- To send order status updates, delivery notifications, and payment reminders via push notifications, SMS, or email
- To manage customer credit ledger (udhaar payments) and generate PDF statements
- To communicate with you about promotions, announcements, and account-related information
- To detect, prevent, and address fraud, abuse, or security issues
- To comply with legal obligations under UAE law
3. Sharing of Information
We do not sell your personal data. Information is shared only with:
- Delivery Riders: Assigned rider receives customer name, phone, and delivery address for the specific order they are delivering
- Customers: Assigned rider's name, phone, and live location shown for the active order
- Service Providers:
- Google Maps Platform — for maps, geocoding, and routing (see Google Privacy Policy)
- Firebase (Google) — for push notifications and crash reporting
- MongoDB Atlas — for encrypted database hosting
- Legal Requirements: If required by UAE law, court order, or valid governmental request
4. Data Security
We implement industry-standard security measures to protect your data:
- All passwords are hashed using bcrypt — we never store plain-text passwords
- Authentication via secure JWT tokens with expiry
- Data transmission over HTTPS/TLS encryption
- Database access restricted with role-based permissions
- Regular security reviews and updates
However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
5. Your Rights
You have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Update or correct inaccurate information via your Profile settings
- Deletion: Request permanent deletion of your account and personal data (some order records may be retained for legal/tax purposes as per UAE law, typically 5 years)
- Withdraw Consent: Disable location tracking, push notifications, or camera access anytime via device settings
- Data Portability: Request an export of your data in a machine-readable format
To exercise these rights, contact us at the email listed below.
6. Data Retention
We retain your data only as long as necessary:
- Active account data — while your account exists
- Order records — up to 5 years (UAE tax/business record retention)
- Location logs — deleted 30 days after delivery completion
- Deleted accounts — anonymized within 30 days
7. Children's Privacy
Our Service is intended for users 18 years and older (particularly because we sell nutritional supplements). We do not knowingly collect personal information from anyone under 18. If we learn we have collected data from a minor, we will delete it promptly.
8. Third-Party Links
Our Service may contain links to third-party websites (WhatsApp support, Google Maps, etc.). We are not responsible for the privacy practices of these external sites. Please review their privacy policies separately.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and, for significant changes, notify you via in-app announcement or email. Continued use of the Service after changes constitutes acceptance.
10. International Data Transfers
Your data is primarily stored and processed in servers located in the region. By using our Service, you consent to the transfer of your data to our servers regardless of your location within the UAE.
11. Governing Law
This Privacy Policy is governed by the laws of the United Arab Emirates. Any disputes shall be resolved in the courts of the UAE.