Privacy Policy

This Service is operated by Bitar LLC, a company organized under the laws of the State of Qatar (“Bitar LLC”, “we”, “us”), acting on behalf of and operating the Al-Rimlawipopsicle brand and its ordering website, admin console, and related services (together, the “Service”). Al-Rimlawi is a Lebanese-style popsicle business with consumer delivery currently limited to the Greater Beirut area of Lebanon, and wholesale supply to businesses available across Lebanon.

Bitar LLC is registered in Doha, Qatar, at the following address, which is also its address for data protection purposes:

This policy covers information we collect through the Rimlawi website at rimlawibooza.com, including the checkout and ordering flow, subscriber accounts, promotions and prize draws, and our WhatsApp order communications. It does not cover third-party sites we may link to.

Because the Service is reachable from anywhere, this policy is written to meet the expectations of visitors in the EU/EEA/UK (GDPR/UK GDPR), the United States (including the CCPA/CPRA for California residents), Qatar (Law No. 13 of 2016 on the Protection of Personal Data Privacy), and Lebanon, in addition to anyone ordering for delivery.

We collect information you give us directly:

• Contact and delivery details: your name, WhatsApp phone number, delivery district/area, and street address.
• Order details: the flavors and quantities you choose, order total, discount or promo codes used, delivery status, and order history.
• Account details: if you create a subscriber account, your phone number and a password (stored securely as a salted hash; we never see or store your password in plain text). We do not require or collect an email address for accounts.
• Promotion entries: if you enter a prize draw or claim a promotional code, the name, phone number, and district you submit.
• Support communications: messages you send us over WhatsApp.

We also collect some information automatically:

• Technical data: your IP address, used to secure the Service (rate-limiting abusive traffic and blocking IPs that repeatedly trip our fraud protections); see Section 10.
• Captcha verification data: when you submit certain forms, Cloudflare Turnstile (our captcha provider) processes limited technical signals to confirm you're not a bot. See Section 11.

We deliberately collect less than most e-commerce sites. We do not process card or bank payment details: Al-Rimlawi is cash-on-delivery only, so no payment card data ever reaches us or a payment processor. We run no advertising or remarketing of any kind, so nothing here is used to build ad profiles or target you with ads on other sites. We do not collect precise geolocation. We do not require an email address to create an account.

• To take, prepare, and deliver your order, including calculating delivery fees for your area.
• To verify subscriber eligibility and apply the correct subscriber or promo-code pricing.
• To send you order-status messages over WhatsApp (order received, confirmed, out for delivery, delivered).
• To run prize draws and promotions, including preventing any one person from claiming a prize more than once.
• To detect and prevent fraud, abuse, and automated attacks against the Service.
• To respond to your support requests.
• To understand how the Service is used, so we can improve it; see Section 11 for the specific tools and how to control this.
• To comply with legal obligations, such as tax and commercial record-keeping requirements.

If you are located in the EU, EEA, or UK, we rely on the following legal bases under GDPR / UK GDPR:

• Performance of a contract: processing needed to take and fulfil your order or manage your account.
• Legitimate interests: securing the Service, preventing fraud and abuse, and improving reliability, balanced against your rights.
• Consent: where we ask separately, such as entering a specific promotion, or before any cookie-based analytics tool runs (see Section 11).
• Legal obligation: where retention or disclosure is required by law.

We do not sell your personal information. We share it only where necessary to run the Service:

• Infrastructure providers who host and run the Service on our behalf under contract, including our database/authentication provider, our web hosting provider, and Cloudflare (captcha and security).
• Delivery staff, who receive the name, phone number, address, and order details needed to complete your delivery.
• WhatsApp / Meta Platforms, when order-status messaging is sent through the WhatsApp Business Platform.
• Authorities, where disclosure is required by law or to protect the rights, safety, or property of Bitar LLC, Al-Rimlawi, or others.

Bitar LLC is based in Qatar, Al-Rimlawi operates in Lebanon, and our infrastructure providers may process and store data in other countries, including the United States and the European Union. Where we transfer personal data of EU/EEA/UK individuals outside those regions, we rely on appropriate safeguards recognized under GDPR / UK GDPR, such as Standard Contractual Clauses, or the fact that our providers maintain their own adequacy or certification frameworks.

We keep order records for as long as reasonably necessary for accounting, tax, warranty, and dispute-resolution purposes. If you delete your subscriber account, we remove your login and profile; your past order records may be retained, detached from your account, for the same purposes. Promotion and draw entries are kept for the duration of the relevant promotion and a reasonable period after, to prevent duplicate claims.

We built the Service with these protections in place, not as an afterthought:

• All traffic is encrypted in transit (HTTPS).
• Passwords are never stored in plain text.
• Our database enforces row-level access control by default, so data is only reachable through the application itself, never directly.
• Public forms are rate-limited, and IP addresses that repeatedly abuse the Service are automatically blocked.
• Sensitive admin actions require authentication and, where applicable, captcha verification.

No online service can guarantee absolute security, but this is a genuine, current description of our practices, not boilerplate.

We use analytics to understand traffic to the Service, and we may add or change analytics tools over time. Currently:

• Our own visit counting: runs for every visitor, always on. We record which page was opened, the site you arrived from (the site's address only, never the full link), whether you were on a phone, tablet or computer, and the country your network reports. We do not store your IP address, your browser's user-agent string, or any identifier on your device — no cookie, nothing in local or session storage. To count visits rather than page views we use a short code derived from your network address and browser, mixed with the date and a secret we hold; it changes every midnight and cannot be reversed, so the same person on two days cannot be linked. Because nothing is stored on your device, it does not require consent under GDPR/ePrivacy.
• Vercel Web Analytics: not currently enabled. The Service is built to support it and we may switch it on. If we do, it is cookieless: it identifies visits using a rotating hash that is discarded within 24 hours, never a persistent identifier, and cannot re-identify you individually. Because it would store nothing on your device, it would not require consent under GDPR/ePrivacy. See Vercel's Web Analytics privacy notice.
• Vercel Speed Insights: not currently enabled. If we switch it on, it reports how quickly pages load and respond for you, using measurements your browser already takes. Like Web Analytics it is cookieless, stores nothing on your device, and carries no identifier, so it would not require consent. See Vercel's Speed Insights privacy notice.
• Google Analytics: not currently enabled. No Google Analytics measurement ID is configured, so it does not load and sets no cookies. The cookie banner exists so that we can ask first if we ever turn it on. Were we to enable it, it would use cookies and would only run after you click “Accept” on that banner; we would use it for traffic and usage reporting only, with Google Signals, ad personalization and all remarketing/advertising features left off, so the data would never be used to advertise to you elsewhere and would not be a “sale” or “share” of your information under CCPA/CPRA. You can decline or withdraw consent at any time by clearing your browser's local storage for this site. See Google's Privacy Policy.
• Admin session cookie: a secure, staff-only cookie that keeps an administrator signed in. Not set for ordinary visitors.
• Cloudflare Turnstile: our captcha provider may set a short-lived cookie or use similar signals to verify you're not a bot when you submit certain forms. See Cloudflare's privacy policy.

We still run no advertising cookies or third-party ad-tech. If we add another analytics or similar tool in the future, we will update this section rather than treat it as a separate policy.

You can ask us at any time what information we hold about you, ask us to correct it, or ask us to delete it, using the contact details in Section 15.

If you are in the EU, EEA, or UK, you additionally have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; receive your data in a portable format; and lodge a complaint with your local data protection supervisory authority.

If you are a California resident, you additionally have rights under the CCPA/CPRA to know what personal information we collect, to delete it, to correct it, and to non-discrimination for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, so there is no “opt-out of sale” action needed.

If you are in Qatar, you have rights under Law No. 13 of 2016 to access and correct your data and to object to processing that causes you harm.

The Service is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy from time to time. If we make material changes, we will update the “Last updated” date above. Continued use of the Service after a change means you accept the updated policy.

For any privacy question, or to exercise any of the rights above, contact us at bilal@bitar.llc, or via WhatsApp at +961 76 923 117. Requests may also be sent by post to our registered address in section 1.

See also our Terms of Service.