Privacy Policy

This Service is operated by Bitar LLC, a company organized under the laws of the State of Qatar (“Bitar LLC”, “we”, “us”), acting on behalf of and operating the Al-Rimlawipopsicle brand and its ordering website, admin console, and related services (together, the “Service”). Al-Rimlawi is a Lebanese-style popsicle business with delivery currently limited to the Greater Beirut area of Lebanon.

Bitar LLC is registered in Doha, Qatar.

This policy covers information we collect through the Rimlawi website at rimlawibooza.com, including the checkout and ordering flow, subscriber accounts, promotions and prize draws, and our WhatsApp order communications. It does not cover third-party sites we may link to.

Because the Service is reachable from anywhere, this policy is written to meet the expectations of visitors in the EU/EEA/UK (GDPR/UK GDPR), the United States (including the CCPA/CPRA for California residents), Qatar (Law No. 13 of 2016 on the Protection of Personal Data Privacy), and Lebanon, in addition to anyone ordering for delivery.

We collect information you give us directly:

• Contact and delivery details: your name, WhatsApp phone number, delivery district/area, and street address.
• Order details: the flavors and quantities you choose, order total, discount or promo codes used, delivery status, and order history.
• Account details: if you create a subscriber account, your phone number and a password (stored securely as a salted hash — we never see or store your password in plain text). We do not require or collect an email address for accounts.
• Promotion entries: if you enter a prize draw or claim a promotional code, the name, phone number, and district you submit.
• Support communications: messages you send us over WhatsApp.

We also collect some information automatically:

• Technical data: your IP address, used to secure the Service (rate-limiting abusive traffic and blocking IPs that repeatedly trip our fraud protections) — see Section 10.
• Captcha verification data: when you submit certain forms, Cloudflare Turnstile (our captcha provider) processes limited technical signals to confirm you're not a bot. See Section 11.

We deliberately collect less than most e-commerce sites. We do not process card or bank payment details — Al-Rimlawi is cash-on-delivery only, so no payment card data ever reaches us or a payment processor. We run no advertising or remarketing of any kind, so nothing here is used to build ad profiles or target you with ads on other sites. We do not collect precise geolocation. We do not require an email address to create an account.

• To take, prepare, and deliver your order, including calculating delivery fees for your area.
• To verify subscriber eligibility and apply the correct subscriber or promo-code pricing.
• To send you order-status messages over WhatsApp (order received, confirmed, out for delivery, delivered).
• To run prize draws and promotions, including preventing any one person from claiming a prize more than once.
• To detect and prevent fraud, abuse, and automated attacks against the Service.
• To respond to your support requests.
• To understand how the Service is used, so we can improve it — see Section 11 for the specific tools and how to control this.
• To comply with legal obligations, such as tax and commercial record-keeping requirements.

If you are located in the EU, EEA, or UK, we rely on the following legal bases under GDPR / UK GDPR:

• Performance of a contract — processing needed to take and fulfil your order or manage your account.
• Legitimate interests — securing the Service, preventing fraud and abuse, and improving reliability, balanced against your rights.
• Consent — where we ask separately, such as entering a specific promotion, or before any cookie-based analytics tool runs (see Section 11).
• Legal obligation — where retention or disclosure is required by law.

We do not sell your personal information. We share it only where necessary to run the Service:

• Infrastructure providers who host and run the Service on our behalf under contract, including our database/authentication provider, our web hosting provider, and Cloudflare (captcha and security).
• Delivery staff, who receive the name, phone number, address, and order details needed to complete your delivery.
• WhatsApp / Meta Platforms, when order-status messaging is sent through the WhatsApp Business Platform.
• Authorities, where disclosure is required by law or to protect the rights, safety, or property of Bitar LLC, Al-Rimlawi, or others.

Bitar LLC is based in Qatar, Al-Rimlawi operates in Lebanon, and our infrastructure providers may process and store data in other countries, including the United States and the European Union. Where we transfer personal data of EU/EEA/UK individuals outside those regions, we rely on appropriate safeguards recognized under GDPR / UK GDPR, such as Standard Contractual Clauses, or the fact that our providers maintain their own adequacy or certification frameworks.

We keep order records for as long as reasonably necessary for accounting, tax, warranty, and dispute-resolution purposes. If you delete your subscriber account, we remove your login and profile; your past order records may be retained, detached from your account, for the same purposes. Promotion and draw entries are kept for the duration of the relevant promotion and a reasonable period after, to prevent duplicate claims.

We built the Service with these protections in place, not as an afterthought:

• All traffic is encrypted in transit (HTTPS).
• Passwords are never stored in plain text.
• Our database enforces row-level access control by default, so data is only reachable through the application itself, never directly.
• Public forms are rate-limited, and IP addresses that repeatedly abuse the Service are automatically blocked.
• Sensitive admin actions require authentication and, where applicable, captcha verification.

No online service can guarantee absolute security, but this is a genuine, current description of our practices, not boilerplate.

We use analytics to understand traffic to the Service, and we may add or change analytics tools over time. Currently:

• Vercel Web Analytics — runs for every visitor, always on. It is cookieless: it identifies visits using a rotating hash that is discarded within 24 hours, never a persistent identifier, and cannot re-identify you individually. Because it doesn't store anything on your device, it does not require consent under GDPR/ePrivacy. See Vercel's Web Analytics privacy notice.
• Google Analytics — uses cookies and only runs after you click “Accept” on the cookie banner shown on your first visit. We use Google Analytics for traffic and usage reporting only — we do not enable Google Signals, ad personalization, or any remarketing/advertising feature, so this data is never used to advertise to you elsewhere and is not a “sale” or “share” of your information under CCPA/CPRA. You can decline or withdraw consent at any time by clearing your browser's local storage for this site, which will show the banner again on your next visit. See Google's Privacy Policy.
• Admin session cookie — a secure, staff-only cookie that keeps an administrator signed in. Not set for ordinary visitors.
• Cloudflare Turnstile — our captcha provider may set a short-lived cookie or use similar signals to verify you're not a bot when you submit certain forms. See Cloudflare's privacy policy.

We still run no advertising cookies or third-party ad-tech. If we add another analytics or similar tool in the future, we will update this section rather than treat it as a separate policy.

You can ask us at any time what information we hold about you, ask us to correct it, or ask us to delete it, using the contact details in Section 15.

If you are in the EU, EEA, or UK, you additionally have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; receive your data in a portable format; and lodge a complaint with your local data protection supervisory authority.

If you are a California resident, you additionally have rights under the CCPA/CPRA to know what personal information we collect, to delete it, to correct it, and to non-discrimination for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, so there is no “opt-out of sale” action needed.

If you are in Qatar, you have rights under Law No. 13 of 2016 to access and correct your data and to object to processing that causes you harm.

The Service is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy from time to time. If we make material changes, we will update the “Last updated” date above. Continued use of the Service after a change means you accept the updated policy.

For any privacy question, or to exercise any of the rights above, contact us at adam@bitar.llc, or via WhatsApp at the number listed on our homepage.

See also our Terms of Service.