Privacy Policy

Draft (version 2026-10) – to be reviewed by a lawyer before publishing. Replace every [PLACEHOLDER].

Version 2026-10 · applies to the BitePass app and the website bitepasslb.com

This policy explains which personal data BitePass processes, why, and what rights you have. It follows the Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data and, for users in the European Union, the GDPR.

1. Who is responsible

[COMPANY LEGAL NAME], [address], Lebanon (“BitePass”, “we”). Contact: support@bitepasslb.com. Company details: see the Imprint.

2. Data we process

• Account data: name, email address, account type (member, restaurant partner, staff), optional district, app language, and the date and version of the terms you accepted. If you sign up with email, your password is stored only as a secure hash by our authentication provider.
• Sign in with Google or Apple: if you choose it, we receive your name and email address (with Apple you can hide your real address; we then receive a relay address). We never receive your Google or Apple password.
• Account security: a device identifier created by the app, the device name and platform, the list of devices you confirmed, and one-time codes we email to you when you sign in on a new device. If you turn on two-factor authentication, the link to your authenticator app. We use this so that a membership is used on one phone at a time and to protect your account.
• Membership and payments: plan, free trial, start and end of your membership, store (App Store or Google Play), purchase and renewal status and transaction identifiers, promo codes you redeem and membership time gifted to you. Payments are processed by Apple or Google; we never receive your card or bank details.
• Deal activity: bookings and redemptions (date, time, restaurant, deal), favorite restaurants and deals, ratings, problem reports and app feedback.
• Location: only if you allow it, your location is used on your device (or in your browser on the website) to show you and nearby restaurants on the map. It is not sent to or stored on our servers.
• Notifications: the push notification token of your device, if you allow notifications.
• Restaurant partners: business name, contact details, address and map position, opening hours, photos, deals, and the names and email addresses of invited staff members.
• Support: the content of messages you send us.
• Technical data: IP address, device, browser and app version in server logs, needed to operate and secure the service.

3. Why we use it

• To provide your account, membership and deals, and to let restaurants honour your bookings (contract).
• To protect accounts and prevent abuse, e.g. device verification, one active phone per membership, waiting times between uses of a deal and blocking fraudulent accounts (legitimate interest).
• To check the status of your App Store or Google Play subscription (contract).
• To send booking-related and, if you agree, other notifications (consent – you can turn them off in your phone settings).
• To answer support requests and improve BitePass using aggregated statistics (legitimate interest).
• To comply with legal obligations, e.g. accounting rules.

4. Who receives data

• Restaurants see the booking details needed to honour a deal (deal, date and time, status). They do not receive your email address or payment details.
• Apple and Google process the payment of memberships bought in the App Store or Google Play as independent controllers under their own privacy policies; the same applies to Sign in with Apple and Google Sign-In.
• Service providers working on our behalf:

  Provider	Purpose
  Supabase	Database, authentication, file storage
  RevenueCat	Checking App Store / Google Play subscriptions
  Google Firebase Cloud Messaging	Push notifications
  Google Maps Platform	Maps in the app and on the website
  Resend	Emails (confirmation, sign-in codes, password reset)
  Vercel	Hosting of the website bitepasslb.com

• Authorities, if we are legally obliged to.

We do not sell personal data and do not use it for third-party advertising. Some providers process data outside Lebanon; we choose providers with appropriate safeguards.

5. Website

bitepasslb.com does not use advertising or tracking cookies. Your browser stores your language choice (local storage) and keeps the public restaurant list for a few minutes (session storage). When the map on the start page is shown, your browser loads it from Google Maps, which receives your IP address. The “Near me” button uses your location only in your browser and only after you allow it.

6. How long we keep data

• Account data: until you delete your account.
• Sign-in codes: expire after 5 minutes. Device records: until you sign out, remove the device or delete your account.
• Bookings: anonymized when you delete your account.
• Payment and invoice records: as long as tax and accounting law requires.
• Support messages: up to 2 years. Server logs and backups: up to 90 days.

7. Your rights

You can request access to, correction or deletion of your data, object to processing based on legitimate interest, and withdraw consent at any time. You can delete your account directly in the app (see Delete account). Write to support@bitepasslb.com for any request. You may also complain to the competent data protection authority.

8. Security

Connections are encrypted (TLS). Access to data is restricted by row-level security rules, passwords are hashed, new devices are confirmed with an email code, two-factor authentication is available, and the app stores your session in the device's secure storage.

9. Children

BitePass is not intended for children under 16. Paid memberships require the user to be of legal age or to have the consent of a parent or guardian.

10. Changes

We will inform you in the app about material changes to this policy.