Privacy Policy

1. Who is responsible for your data

For merchant accounts, Belahzah decides how the data is used and is the controller.

For shoppers, each merchant decides what to sell and how to fulfil orders, so the merchant is the controller of the shopper's order data. Belahzah acts as the merchant's processor: it handles that data only to run the store and only on the merchant's instructions. If you have a question about an order, contact the store first.

2. Data protection contact

Our data protection contact handles questions and requests about personal data: hello@belahzah.com.

3. Data we collect

We do not intentionally collect sensitive data such as health, biometric, or religious data. Please do not put it in your store.

• Merchants: name, phone number, email, password (stored hashed, never in plain text), store name and store link, store content such as products and images, and payment receipts you upload for your subscription.
• Shoppers: name, phone number, delivery address, cart contents, and order history.
• Usage data: pages viewed, traffic source, and similar events used to show store analytics to the merchant and to keep the service reliable.
• Technical data: IP address, browser type, and security and access logs.

4. Why we use data, and your consent

We collect and process personal data for these specific purposes only. By creating an account, placing an order, or otherwise using the service after reading this policy, you give your explicit consent to this processing. You can withdraw your consent at any time by contacting us; withdrawal does not affect processing done before it, and we may then be unable to provide the service.

We do not sell personal data.

• To create accounts, host stores, and process orders.
• To verify phone numbers with one-time codes.
• To show merchants their sales and visitor analytics.
• To provide support, prevent fraud and abuse, and keep the service secure.
• To meet legal obligations.

5. Phone verification providers

To send one-time codes we use third-party messaging providers (WhatsApp and SMS delivery services). They receive the phone number and the message needed to deliver the code, and nothing else.

6. Sharing

We do not share your data with anyone else without telling you.

• With the merchant whose store a shopper orders from.
• With service providers that help us run Belahzah, such as hosting and messaging, who may only use the data on our instructions and must keep it secure.
• With public authorities when Syrian law or a lawful request requires it.

7. Transfers outside Syria

Some of our providers, such as hosting or message delivery, may process data outside Syria. We transfer data abroad only as Syrian law allows: where the destination gives adequate protection, where required approvals are in place, or with your consent.

8. Cookies and local storage

We use cookies and similar storage that are necessary to keep you signed in, remember your language, and secure your session. We do not use advertising cookies.

9. Marketing messages

We do not send you promotional messages unless you have agreed to receive them, and every such message will say who we are and how to opt out. Account, security, and order messages are not marketing.

10. Retention and logs

We keep data only as long as needed for the purposes above and as the law requires, then delete it or make it non-identifiable. Merchants can ask us to delete their store and its data. Syrian law may require us to keep certain user logs and communication records for set periods and to provide them to the competent authorities on a lawful request; we keep such records only for that purpose.

11. Your rights

Write to our contact above. We will answer requests within seven working days. Shoppers may also contact the merchant of the store they ordered from.

• Know what data we process, why, how, and for how long.
• Access your data, and have it corrected, updated, completed, or deleted.
• Withdraw your consent, and restrict how your data is processed.
• Object to processing that infringes your fundamental rights.
• Be told if your data is affected by a breach.
• Complain to the Personal Data Protection Authority.

12. Data breaches

If a breach of personal data occurs, we will notify the competent Authority and give it the details within 72 hours, and we will tell affected people within three working days of reporting, explaining what happened and what we are doing about it.

13. Security

We use access controls, encrypted connections, and hashed passwords, and we limit access to personal data to people who need it. No online service is completely secure, so please use a strong, unique password.

14. Children

Belahzah is not intended for children, and merchants must be legally able to run a business. Data about children needs a guardian's consent.

15. Changes

We may update this policy. When we make important changes we will update the date above and, where appropriate, notify you.

16. Applicable law

This policy is governed by the laws of the Syrian Arab Republic, including Law No. 12 of 2024 and its executive instructions.

Questions, or a request about your data? Write to our data protection contact at