Retail
The Retail app lets you order from Joe Market, one shop in Lebanon, for delivery or to collect yourself. Inside the app the shop is shown under the app's name, “Retail”, so wherever the app says “Retail” about the shop, it means Joe Market. The app is published by Yaso, Lebanon, for Joe Market (on the App Store the seller is shown as Hassan Yassin, Yaso's owner). Yaso builds and runs the app and the servers that hold the data below. This page says, in plain words, what the app collects, why, who sees it, and how to close your account. It describes what the app really does — not what it might do later.
The short version. We collect your phone number, your name, your delivery addresses (including the map pin of your door), your orders, and a notification address for your phone. They are used to take your order and bring it to you. Nothing is sold, there is no advertising, and no advertising or analytics company is inside the app; crash reports and six simple usage counts go to Yaso's own server only. What Joe Market sees is in section 3, and it depends on one choice you make: Joe Market always sees the order and a code for you; it sees your name, phone number and written address only if you say yes, and only on orders you place after saying yes. One thing can happen before any order: when you sign in, a screen tells you that Joe Market will see your name and phone number, and Joe Market can then see them on its list of people who signed in, until you order from Joe Market (section 3). If you use the extras some shops turn on (notes on an order, ratings, saved items, points, a credit tab), those are covered in section 1 too.
Your phone number is your account. You sign in by sending a one-time code over WhatsApp; WhatsApp shows the number the message came from, and that number becomes the account. It is kept so the app recognises you next time and so support can find your orders. No SMS is ever sent and your contacts are never read. The WhatsApp message travels through WhatsApp (Meta), so that step is also covered by WhatsApp's own terms.
You type a name when you first sign in. It greets you in the app and helps support find you. It goes to Joe Market only under the rules in section 3.
You can turn on a PIN that protects your account at sign-in. It is kept only in scrambled (hashed) form, so nobody can read it back. There is no PIN reset: changing or removing it needs the current PIN, and Yaso has no reset button either. At sign-in, five wrong tries lock it for 15 minutes. If you forget it, the only way back in is the app's Forgot PIN? Start a new account button: it opens a brand-new, empty account on your number, and the old account is set aside — signed out everywhere and unreachable, but not erased. Its orders and addresses stay on it; to have it closed and its details erased, ask Yaso on WhatsApp +961 71 009 590 or by email at brasmela@gmail.com.
To have an order delivered you save at least one address: the street text, building, floor, apartment, a contact phone for that address, an optional landmark, and the exact map pin you drop on the map. The pin is what lets the driver find the right door. When you place an order, the written address and the pin are copied onto that order, so the order keeps the address it was delivered to even if you later change or remove the saved address.
Each order is kept: the items and quantities, the prices and totals, the delivery fee, the times, the status as it moves along (accepted, ready, on the way, delivered), and any change, cancellation or return. An order is the record of a purchase, so it is kept as a business record.
When you order you can add a note for the whole order, a short note on an item, a landmark that helps find your door (“near the pharmacy”), and what the shop should do if an item is missing. If the shop has ratings turned on, you can give a delivered order 1 to 5 stars and an optional comment. If an order did not arrive or was wrong, you can report it, with an optional short note. All of this is kept with the order. Who sees it is in section 3.
If the shop has these turned on, you can save items you like and ask to be told when a sold-out item is back. The app keeps which items you picked, against your account, so it can show them and send you that one message. An unsent “tell me” request is dropped after 90 days. Both are deleted when you close your account.
If Joe Market runs a points scheme or keeps a credit tab for you, the app shows your balance and its history and can use them at checkout. To join your account to a credit tab, the app shows you a short code that you give to the cashier; the shop's till then records the link. Points and credit are Joe Market's own books, kept at the shop.
Once you sign in, this app marks you as following Joe Market. That only lets you choose its offers later; it is not a yes to offers (see “The offers switch” below). It is deleted when you close your account.
If you move to a new number, you send a new WhatsApp code from the new number, and your account moves to it.
The app has one switch: Offers from Retail (on the Profile screen). It is off until you turn it on. Section 4 explains what Joe Market can send when it is on.
The app asks you whether Joe Market may see your name, your phone number and your written address with your orders. Your answer and the exact time you gave it are kept, because the rule in section 3 depends on that time. You can change the answer in the app whenever you like.
Firebase (Google) gives your phone an address for push messages (a token) and it is kept on your account, one per phone. It carries order updates — Joe Market changed your basket, your order is on the way — and, only if you switched offers on, Joe Market's offer messages. The token identifies the app on this phone, not you personally. It is issued and kept on both Android and iPhone whenever your phone is given one, even if you refuse notification banners: refusing stops the banners from showing, not the token from existing. It is removed when your account is closed.
The app asks your phone for its location in one place, never in the background: when you tap the “my location” button (the target sign) while picking an address on the map. It asks for a rough location only. That drops the pin where you stand — and if you save that address, the pin is kept as your delivery pin and shared as section 3 describes. You never have to use that button: you can drag the pin or search for a street instead. The Lebanon map is drawn on your phone from map data the app fetches, as you pan, from Yaso's own map server (maps.brasmela.com) — that server sees your IP address and which parts of the map you load, as any web server does, and no outside map company is involved.
The app works in English and Arabic. Your choice is kept on your account and on each phone so notifications arrive in the language you read. It is deleted when your account is closed.
When the app crashes or hits an error, it sends a report to Yaso's own server: which app and version, the phone's platform, a scrambled device code (the app makes a random code when it is first opened, and the server stores only a one-way hash of it; the phone's real device id is never read), what went wrong, where in the code, and when. Before anything is stored, the server removes what it can detect of phone numbers, email addresses, long secrets and tokens, GPS coordinates and personal folder names, and blanks the value of any field named like a name, address, phone or PIN. The app also counts six simple events — app opened, shelf loaded, a search was made (never the words you typed), item added to basket, checkout started, order placed. We do not record which account sent a report, and the report has no account-id field — the server takes them with no sign-in and does not add or look up an account. If an error message itself contained an account number, it would be kept like any other text, for 90 days. The usage counts hold no free text at all. A crash report does hold free text, and a name written inside it can slip past the patterns, so we do not promise a crash report never carries one. They are kept for 90 days and then deleted. Yaso staff read them to fix bugs, and Joe Market may be shown crash and usage counts for its own app. No third party receives them, and there is no advertising identifier.
When you search the shop, the words you type are sent to the server so it can find matching items, and the answer comes straight back. They are not saved to your account, and the usage count above records only that a search happened.
The server sees your IP address and standard connection details on every request, as every web server does, and keeps short-lived request logs to keep the service up and stop abuse.
Always: the order it has to prepare — items, quantities, money, times — and a code for you, so it can recognise a returning customer. The code works only for Joe Market. Also always: the notes, item wishes, rating, comment and problem report you write on that order (section 1). They stop being shown to Joe Market by the server when you close your account.
If you link a credit tab: when you give the cashier your link code, the shop's till shows the cashier your name and your phone number with the middle digits hidden, so the right tab is linked. You choose this by handing over the code.
On a delivery Joe Market brings itself: Joe Market also gets the map pin of the delivery address, because its driver has to find the door. We say this plainly: the pin reaches the shop on such orders without a separate consent screen. If a Yaso delivery driver brings your order instead, he gets the pin and Joe Market does not.
Only if you say yes: your name, your phone number and your written address. The app asks you. The rule is forward-only:
One account, one switch. Your sign-in is one account across this app and the other shop apps and shop websites run by Yaso, when you use the same phone number, and the identity switch is one switch on that account: yes here also means yes to any other shop you order from with that account, until you switch it off.
Joe Market is a separate business from Yaso. Once it has your details for an order, it holds them under its own responsibility. What Yaso can do is remove them from Joe Market's till, and does, when you close your account (section 5).
Before you sign in to this app, the sign-in screen tells you that Joe Market will see your name and phone number. After that screen, Joe Market can see you on its “signed in” list of people who signed in but have not ordered from it: your name (or “no name yet”), your phone number, when you signed in, and whether it was in this app or on Joe Market's own website (the website shows the same screen) — so Joe Market can call you.
If the shop sends your order with a delivery company, the shop gives that company what it needs to bring it to you, and the app shows you the company's name and tracking number. That hand-over is the shop's own business.
He is given the delivery pin so he can reach you, and delivery is confirmed with a one-time code you show him at the door. He is not given your name or phone number by the app.
Your data is not sold, rented, or handed to advertisers or data brokers. It would be disclosed only where the law requires it, or where genuinely needed to investigate fraud or abuse.
Joe Market can send you a marketing message only if you switched on “Offers from Retail”. No switch, no message, ever. What Joe Market can send is limited by Yaso, not by Joe Market:
Order updates (“accepted”, “on the way”) are not offers and are not affected by this switch.
No certification is claimed that is not held. No system is perfectly secure. A leak of a customer's home address is treated as the most serious thing that could go wrong here.
Joe Market and Yaso are in Lebanon. We understand Lebanon's Law 81/2018 on electronic transactions and personal data to give you the right to know what is held about you, to have it corrected, and to have it erased, and to require data to be collected only for a clear, stated purpose — which is what this page tries to do. The exact articles, the time allowed to answer you, and which of Joe Market and Yaso is responsible for what, are to be confirmed by counsel; until then every request sent to Yaso on WhatsApp +961 71 009 590 or by email at brasmela@gmail.com is answered as fast as possible, and this paragraph is not legal advice.
The app is for adults shopping for themselves and their household. It is not directed at children and no accounts are knowingly created for them. If you believe a child has an account, contact Yaso on WhatsApp +961 71 009 590 or by email at brasmela@gmail.com, and it will be closed.
The servers are hosted with Amazon Web Services in Europe, and the providers in section 3 operate internationally. Using the app means your data is handled on those servers, outside Lebanon.
If what the app collects or who it is shared with changes, this page and the “Last updated” date at the top change with it. This URL is permanent — it is the address filed with the app stores — so it is the one place to check.
Your data, this policy, deleting your account: Yaso, Lebanon — the publisher of this app, which runs the servers behind it. WhatsApp +961 71 009 590 · email brasmela@gmail.com.
An order, a delivery, a product: Joe Market, the shop. WhatsApp +961 76 789 645.