Privacy Policy
Last updated : 8 août 2026
Hia is a platform connecting users with partner merchants in Tunisia. This policy sets out the personal data the app collects, the purposes for which it is processed, the recipients it is disclosed to, how long it is retained, and how you may exercise your rights.
It applies to the Hia mobile application and to this website.
1. Data you provide
| Data | Why | Required |
|---|---|---|
| Email address | Login identifier, verification codes, order-related email | Yes |
| Phone number | Account identification, so the merchant can reach you about an order | Yes |
| Password | Account security. Stored only as a cryptographic hash (bcrypt) — never in plain text, never readable by us | Yes |
| First name, last name, display name, profile photo | Personalising your account and identifying you to merchants | No |
| Date of birth | Verifying the minimum age requirement | No |
| Saved addresses (label, city, postcode, GPS coordinates) | Order pickup and showing nearby shops | No |
| Reviews, ratings and photos you post | Published publicly in the app | No |
| Support messages | Handling your support request | No |
2. Data collected automatically
| Data | Why |
|---|---|
| Precise location (if you allow it) | Showing shops around you and calculating distances. Requested in the app and revocable at any time in your phone’s settings. |
| Device identifier and notification token (Firebase) | Delivering order-tracking notifications (“your order is ready”) |
| Device type and operating system | Compatibility and diagnostics |
| IP address and app signature | Security: detecting suspicious sign-ins, limiting abuse, keeping an account access log |
| Order history, favourites, notifications | Running the service and showing your history in the app |
3. Payment data
We collect no payment data.
Payment is made directly to the merchant at pickup (cash or on-site payment). No card number is ever entered, transmitted or stored by Hia.
4. Why we use this data
- Providing the service: creating your account, processing orders, connecting you with the merchant.
- Keeping you informed: order-tracking notifications and transactional email (verification, password reset).
- Security: one-time code verification, detecting fraudulent access attempts, limiting abuse.
- Support: answering your requests.
- Improving the service: aggregated, anonymous usage statistics.
We do not sell your personal data, and we do not use it for third-party targeted advertising.
5. Who your data is shared with
| Recipient | Data shared | Reason |
|---|---|---|
| The merchant you order from | Display name, order contents, phone number, pickup window | Preparing and handing over your order |
| Google (Firebase Cloud Messaging) | Device notification token, notification content | Delivering push notifications |
| Brevo | Email address, message content | Sending transactional email |
| Railway (hosting) | All application data, encrypted in transit | Hosting the infrastructure |
| Competent authorities | As required | Only under legal obligation |
Some of these providers host data outside Tunisia. Your data is transmitted encrypted (HTTPS/TLS).
6. Retention
| Data | Retained for |
|---|---|
| One-time verification codes (OTP) | 5 minutes, then invalidated |
| In-app notifications | 30 days |
| Account and profile | As long as the account is active (see section 8) |
| Order history | Kept for applicable accounting and tax obligations |
| Security logs (IP address, sign-ins) | A limited period, for security and evidential purposes |
7. Security
- Passwords stored as bcrypt hashes, never in plain text.
- Communications encrypted end to end over HTTPS/TLS.
- Short-lived session tokens, revocable remotely (“log out all devices”).
- One-time code verification when signing in from a new device.
- Access to production data restricted to those who need it.
No system is infallible. If a breach occurs that is likely to create a risk to your rights, we will inform you and the competent authority as required by applicable regulation.
8. Your rights
Under Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data, you have the following rights:
- Access: obtain a copy of the data concerning you.
- Rectification: correct inaccurate data (editable directly in the app).
- Erasure: request deletion of your account and data — see Account deletion.
- Objection: refuse certain processing, in particular notifications (which can be disabled in the app’s settings).
- Withdrawal of consent: in particular for location, revocable at any time in your phone’s settings.
To exercise these rights, write to the address at the bottom of this page. We respond within 30 days at most. You may also contact the Tunisian National Authority for Protection of Personal Data (INPDP).
9. Children
Hia is not intended for people under 16. We do not knowingly collect data about children under 16. If you believe a child has provided us with data, contact us and we will delete it.
10. Changes
This policy may change. The date of the last update appears at the top of this page. For any substantial change, we will inform you in the app or by email.