BeloBag
Privacy
BeloBag helps you rescue tonight’s unsold food from local shops. We collect as little as we can, keep it in the region of the market you use, and never sell it.
What we keep, and why
- Phone number or email. To send your one-time sign-in code and to tie each pickup pass to you, so nobody else can collect your bag.
- Reservations and passes. Shop, bag, price, pickup code and time. Shops see only what they need to hand over your bag: the pickup code and your first name.
- Reviews. Your rating, tags and short note. Reviews are shown as “Verified pickup”, never with your name or number.
- Pickup reliability. Whether you collected a bag or didn’t turn up. It is private, only used to limit free holds after repeated no-shows, and is never shown to anyone.
- Location. Your exact position stays on your phone, where it sorts drops by walking distance. To draw a walking route, the app sends our API a start point rounded to about 100 metres plus the shop’s location, in the body of the request rather than the web address. Our routing service works out the route and doesn’t log either point. We don’t keep a history of where you’ve been.
- Payments. Handled by the payment provider you choose (for example Apple Pay, Google Pay, eSewa or Khalti). We receive a confirmation, never your card or wallet details.
- Launch alerts and partner call-backs. If you sign up on belobag.com, we keep your email, city and the language of the page, plus your shop’s name and type if you run a kitchen, and when you agreed. We use it only to email you about BeloBag opening in your city. It is stored in the region of the city you choose.
- For shops. Business name, registration number, address, owner phone, payout bank details and the photos and videos you publish.
On your device
The app stores your settings (language, visitor or local, preferences) on your phone. If you turn on Face ID or fingerprint sign-in, your session is kept in your phone’s secure Keychain or Keystore and never leaves it. The app’s fonts are built in, so opening it contacts no font service. Optional analytics run only if you choose “Accept all”.
Where your data lives
Each region has its own API and its own database, and your data is stored in the region of the market you use:
- Europe (Greece, Czechia, Romania). API in Frankfurt, Germany. Database and shop photos in Frankfurt (EU).
- Asia (Nepal, Thailand, India). API in Singapore. Database and shop photos in Singapore.
So if you live in the EU and reserve a bag in Kathmandu or Bangkok, that reservation (your first name, phone number, pickup code and the bag) is stored in Singapore, because that is where the shop’s market runs. Singapore has no EU adequacy decision. We send data there because it is needed to carry out the reservation you ask for (GDPR Article 49(1)(b)), and our agreements with the providers below use the European Commission’s Standard Contractual Clauses. Where a provider is based in the United States, the same clauses, or the EU–US Data Privacy Framework where the provider is certified, apply.
Who processes it for us
- Render runs our API servers in Frankfurt and Singapore.
- Supabase hosts our databases and shop photos, in Frankfurt for Europe and Singapore for Asia.
- Cloudflare sits in front of our API servers to encrypt traffic and block attacks. It sees your IP address and requests as they pass through.
- Vercel delivers this website through its global network. It sees your IP address when you visit belobag.com.
- OpenFreeMap serves the map tiles in the app. It sees your IP address and which part of the map you’re looking at, not your GPS position.
- Sign-in codes are sent through an SMS, WhatsApp or email delivery provider, which sees your number or address and the code.
- Apple Maps or Google Maps open only when you tap Directions. We pass them the shop’s location; from then on that app’s own privacy policy applies.
- Payment providers you choose, as described above.
How long we keep it
Account and reservation data stays while you use BeloBag and as long as the law requires for bookkeeping. Sign-in codes expire after 5 minutes. Launch alerts are deleted once we’ve sent the launch email for your city, and partner call-backs once your shop is set up or you tell us you’re not interested. You can delete your account at any time.
Your rights
You can ask to see, correct, export or delete your data, and you can object to how we use it. If you are in the EU you can also complain to your data protection authority.
Scams
BeloBag never sends payment links and never asks for your code, password or card by phone, SMS or chat. Pay only inside the app or at the shop’s counter. Our official site is belobag.com.
Contact
Questions or requests: privacy@belobag.com