Privacy policy
BLBAAB is a new Iraqi delivery service, built so that people here can get what they need day to day — food and groceries — brought to their door. This policy explains what we collect, why, and what you can ask us to do about it. It covers the BLBAAB customer app, the seller and driver apps, and blbaab.com.
Who we are
- BLBAAB is operated by Mesopo, based in Erbil, Iraq, and operating in Erbil and Baghdad. Postal address: Pynex Tower, near Sami Abdulrahman Park, Erbil, Iraq.
- Mesopo is the data controller: it is accountable for the data described here and it is who a complaint is made against. This policy is governed by the law of Iraq.
- For anything about this policy, or to ask what we hold about you, contact us on WhatsApp at +964 770 995 2717, or write to support@blbaab.com.
What we collect
- Your phone number, which is how your account is identified, and a password you choose. We do not currently verify the number with a code, so it is whatever you tell us.
- Your name and email, only if you choose to add them.
- Delivery addresses you save: the map pin, the building details and the landmark you give us. The landmark matters because Baghdad addresses are not reliably routable on their own.
- Your orders, and the reviews and ratings you leave.
- Basic device information — platform, app version and a notification token — so we can send you order updates.
- For drivers: location while a delivery is active, vehicle details, and the identity documents required to verify you.
- For sellers: your business details, catalogue and order history.
What we do not collect
- We do not take card or bank details. v1 is cash on delivery only, so no payment credentials ever reach our servers.
- We do not track your location in the customer app when you are not placing an order, and the customer app does not request background location at all.
- We do not sell your data, and we do not share it for advertising.
Who sees what
- The seller you order from sees the order and the first name it is under. They do not see your phone number or address.
- The driver delivering your order sees your address, landmark and a contact number, so they can reach you. They lose that access once the delivery is complete.
- You see the driver on the map only after they collect your order.
- Our support and operations staff can see order details in order to help you, and every such access is recorded.
How long we keep it
- Orders, deliveries and cash settlement records: seven years. These are accounting records — they underpin what we owe a seller and what cash a rider is accountable for — and Iraqi tax and commercial law requires us to keep them.
- Your account details — name, email, phone number, saved addresses: until you delete your account, and then immediately. Deletion is not a queue; the fields are cleared in the same request.
- Sign-in sessions, including the IP address and device they were used from: ninety days after the session ends, then deleted automatically. Long enough to look into "somebody signed in from where?", short enough not to be a permanent record of every network you have used.
- Driver location traces are downsampled and kept only long enough to resolve a delivery dispute.
- Server request logs are rotated by size rather than by date, and in practice hold a few days at current volume. They are not a database and are not searchable by person.
Deleting your account
- You can delete your account from within the app at any time. We remove your name, email and phone number, sign out every device, and delete your saved addresses.
- Past orders are retained in a form no longer linked to your identity, because we cannot settle a seller or reconcile a driver’s cash without them.
- An account cannot be deleted while an order is in progress. Finish or cancel it first.
Where your data is held, and who else touches it
- Our servers are in Germany, at Hetzner Online GmbH in Falkenstein. Your account, your addresses and your order history are stored there, not in Iraq. We use a European provider because it is what we can operate reliably; German and EU data-protection law applies to that hosting.
- Photographs — the ones merchants upload of their own products — are stored on the same servers, in storage we run ourselves rather than a third party.
- The map you place your delivery pin on is served by MapTiler, which sees that a map was requested and from roughly where. It is not told who you are, and we do not send it your account or your address.
- That is the full list of companies that touch your data. We do not use advertising networks, we have no analytics SDK in the app, and nothing here is sold or shared for marketing.
Children
- BLBAAB is for adults. You must be 18 or over to hold an account, because an order is a contract and it is paid in cash at the door.
- We do not knowingly collect data from anyone under 18. We do not verify age at sign-up beyond asking — a check we could not perform honestly is worse than the one we describe — so if you believe a child has an account, tell us and we will delete it.
- The app is not directed at children, carries no advertising and has no child-directed content.
Security
- Traffic is encrypted in transit. Passwords are hashed with argon2id and are never stored in a form anyone — including us — can read.
- Signing out, deleting your account, or a sign-in token being reused all revoke access immediately rather than at the end of a session.
Contact
Questions about this policy, or a request to access or delete your data:
WhatsApp (0770 995 2717)