Privacy Policy
In short. We collect the details needed to deliver a gas cylinder to your door: your name and mobile number, your delivery address and its map location, and your order history. We share your delivery details with the distributor and driver fulfilling your order, and nothing more. We never store your full card number, we do not sell your data, and we do not use advertising or analytics trackers in our apps.
1. Who we are
Jarra is an on-demand LPG gas cylinder delivery platform operated by RAFAD ADVANCED DIGITAL SOLUTIONS COMPANY L.L.C., a company registered in the Hashemite Kingdom of Jordan under commercial registration no. 81570, with its registered office at Al Shaab Street 24, Jandaweel, Amman, Jordan.
In this policy, "we", "us", and "Jarra" mean that company. We are the controller of the personal data described here. "You" means anyone who uses the Jarra consumer app, the Jarra driver app, or this website.
2. What we collect
We collect only what the service needs to function. We do not buy personal data from third parties, and our apps contain no advertising, analytics, or cross-app tracking software development kits.
Everyone who creates an account
| Data | Why we need it |
|---|---|
| Full name | To identify you to the driver at the door and on your invoices. |
| Mobile number | It is your login identity. We send a one-time passcode by SMS to verify it, and the driver may call you about a delivery in progress. |
| Password | Stored only as a salted cryptographic hash. We cannot read your password and no member of our team can retrieve it. |
| Language preference (Arabic or English) | To show the app, notifications, and SMS messages in your language. |
| Device push token | To send order notifications. Created only if you allow notifications, and deleted when you turn them off or log out. |
| Sign-in records | Login timestamps and failed-attempt counts, used to lock out password guessing and to investigate account misuse. |
Customers placing orders
| Data | Why we need it |
|---|---|
| Delivery address: street, building number, floor, apartment, and any access notes you add | So the driver can find your door rather than only your street. |
| Map coordinates of the address | To determine which distributors serve your neighbourhood and to guide the driver by navigation. See section 5. |
| Building or doorman phone number, if you provide one | An optional alternative contact for the driver when you cannot be reached. Provide it only if the person concerned agrees. |
| Order history: items, quantities, prices, delivery day, payment method, and order status | To fulfil and bill your order, show you past orders, handle refunds and disputes, and meet Jordanian tax and invoicing obligations. |
| Payment card token, card brand, last four digits, expiry month and year | To let you reuse a saved card. The full card number never reaches us. See section 6. |
| Ratings and review comments you submit | To show distributor and driver ratings to other customers. Your first name may be visible alongside a review you write. |
| Support tickets, their messages, and any images you attach | To answer your question and keep a record of the resolution. |
Drivers using the Jarra driver app
If you are a delivery driver, we also process, on behalf of and as agreed with the distributor that employs or contracts you: your national identity number, driving licence number, vehicle type, plate number, and truck capacity, in order to verify that you are licensed to transport LPG and to assign you to delivery zones. While a delivery run is active, the app also shares your live position as described in section 5.
Delivery records
When a delivery is completed we record the time, the outcome, the short delivery code you give the driver to confirm handover, and, where a proof of delivery photo is taken, that photograph. Please do not include people in a proof of delivery photo.
This website
This website sets no cookies, runs no analytics, and does not profile visitors. Our web server keeps standard technical request logs, including IP address, requested page, and timestamp, for security and troubleshooting, for no longer than 90 days. Fonts on this site are loaded from Google Fonts, which means Google receives your IP address when a page loads.
3. How we use it
- To create and secure your account, and to verify your mobile number.
- To route your order to a distributor that serves your area, and to plan the driver's delivery run for your neighbourhood and delivery day.
- To take payment, issue invoices, and process refunds.
- To send you service messages about your order: confirmation, assignment, out for delivery, completion, failure, and cancellation. These are part of the service and are not marketing.
- To answer your support requests.
- To detect and prevent fraud, abuse, and unsafe delivery practices, and to enforce our terms.
- To understand demand in aggregate, for example how many orders a neighbourhood places in a week, so distributors can plan capacity. Aggregate reporting does not identify you.
- To comply with Jordanian law, including tax and electronic invoicing rules.
We do not use your personal data to make automated decisions that have a legal or similarly significant effect on you, and we do not profile you for advertising.
We will only send you marketing messages if you ask us to, and you can stop them at any time without affecting your ability to order.
4. Our legal basis
We process personal data in accordance with the Jordanian Personal Data Protection Law No. 24 of 2023 and the regulations issued under it. Depending on the data, we rely on:
- Performance of a contract. Most processing exists because you asked us to arrange a delivery; without your name, number, and address we cannot do it.
- Your consent. For access to your device location, camera and photo library, push notifications, and any marketing. Each of these is optional, is requested by a separate device prompt, and can be withdrawn in your device settings at any time.
- Legal obligation. For invoicing, tax, and accounting records we are required to keep.
- Legitimate interest. For security, fraud prevention, and keeping the service working, weighed against your privacy.
5. Location data
Location is the part of this service people ask about most, so we set out exactly what happens.
In the consumer app
When you add or edit a delivery address, the app may ask for your device location so the map can centre on where you are. Granting this is optional; you can always drop the pin manually. What we store is the coordinate of the delivery address you save, not a history of where your device has been. We do not access your location in the background.
In the driver app
While a driver has an active delivery run, the driver app shares the driver's position so that customers waiting for that run can see the approaching vehicle on a map. These positions are relayed live to the customers concerned and are not stored as a location history. Sharing stops when the run ends.
Maps
Maps and address search are provided by Google Maps. When a map is displayed, Google processes the data needed to serve it under its own privacy policy.
6. Payment data
Card payments are processed by HyperPay, a licensed payment service provider. Your card details are entered into HyperPay's secure payment page and are sent directly to it. We never receive, see, or store your full card number or its security code.
If you choose to save a card, HyperPay returns a token, which is a reference that only works for Jarra payments. We store that token together with the card brand, the last four digits, and the expiry date, so you can recognise the card. You can remove a saved card in the app at any time.
If you pay cash on delivery, we record only that the order was paid in cash.
7. Who we share it with
We do not sell personal data, and we do not share it for anyone else's advertising. We share it only in the following cases.
| Recipient | What they receive | Why |
|---|---|---|
| The gas distributor fulfilling your order | Your name, mobile number, delivery address, and order contents | To prepare and dispatch your delivery |
| The assigned delivery driver | Your name, mobile number, delivery address with access notes, and order contents | To reach your door and complete the handover |
| HyperPay | Payment amount, order reference, and your card details, entered directly by you | To process card payments |
| Access2Arabia | Your mobile number and the message text | To deliver one-time passcodes and order SMS messages |
| Google (Firebase Cloud Messaging, Google Maps) | Your device push token and notification content; map requests | To deliver push notifications and display maps |
| Alibaba Cloud | All service data, as our hosting provider | To run the servers and databases behind Jarra. See section 8 |
| Jordanian tax and e-invoicing authorities | Invoice data required by law | To meet national electronic invoicing obligations |
| Courts, regulators, and law enforcement | Only what a valid legal request requires | Where we are legally obliged to disclose |
Distributors and drivers receive your details for the sole purpose of fulfilling your order and are contractually required not to use them for anything else, including their own marketing.
If our business is ever sold or reorganised, personal data may transfer to the acquiring entity, which would remain bound by this policy until it gives you notice of any change.
8. Where your data is stored
Jarra's servers and database are hosted on Alibaba Cloud in the Riyadh region of the Kingdom of Saudi Arabia. Backups are held in the same region. This means personal data collected in Jordan is transferred to and stored in Saudi Arabia.
Some of the service providers listed in section 7, in particular Google and HyperPay, operate globally and may process data outside the Middle East.
Where we transfer personal data outside Jordan, we do so subject to the cross-border transfer requirements of the Personal Data Protection Law No. 24 of 2023, and under contracts with our providers that require them to protect the data and to process it only on our instructions.
9. How long we keep it
| Data | Retention |
|---|---|
| Account details | While your account is open, then anonymised on deletion |
| Orders and invoices | Retained for the period Jordanian tax and commercial law requires, which is currently not less than five years, in a form no longer linked to your name or number once your account is deleted |
| One-time passcodes | Stored hashed and expire within minutes |
| Support tickets | Up to two years after the ticket is closed |
| Proof of delivery photos | Up to 12 months, then deleted |
| Web server request logs | Up to 90 days |
| Live driver positions | Not stored; relayed only while a run is active |
10. Your rights
Under Jordanian data protection law you have the right to:
- know what personal data we hold about you and receive a copy of it;
- have inaccurate or incomplete data corrected;
- have your data deleted, subject to records we must keep by law;
- withdraw a consent you gave, such as location or notifications;
- object to processing based on our legitimate interests;
- ask us to restrict processing while a dispute is resolved; and
- complain to the competent supervisory authority.
To exercise any of these, email it@jarra.net from the address or about the mobile number on your account. We will respond within 30 days. We may ask you to verify your identity first, so that nobody else can obtain your data. Using these rights is free, and we will not restrict your service because you did.
11. Deleting your account
You can delete your account yourself from the app: open Profile, then Delete account, and confirm. Deletion is not reversible.
When you delete your account we anonymise it: your name is replaced, and your mobile number, password, and push token are erased, so the account can no longer be identified or used to sign in. Order and invoice records remain in our accounting data for the statutory period described in section 9, no longer linked to your identity. You can also ask us to delete your account by emailing it@jarra.net.
12. Security
We protect personal data with, among other measures:
- encryption in transit using HTTPS across the website and both apps;
- passwords stored only as salted hashes, and one-time passcodes stored hashed;
- authentication tokens held in the device's secure keystore, that is the iOS Keychain or the Android Keystore, with optional biometric unlock;
- role-based access control, so support staff see only what their role requires, with administrative changes recorded in an audit log;
- rate limiting and lockout on repeated failed sign-in attempts;
- network access to our servers restricted to what the service needs.
No system is perfectly secure. If a data breach occurs that is likely to harm you, we will notify you and the competent authority as the law requires.
13. Children
Jarra is not intended for children. You must be at least 18 years old to create an account, because ordering LPG creates a payment obligation and involves handling a pressurised cylinder. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
14. Changes to this policy
We may update this policy as the service develops or the law changes. The effective date at the top always shows the current version. If a change materially affects how we use your data, we will tell you in the app or by SMS before it takes effect, and where the law requires it we will ask for your consent again.
15. Contact and complaints
For any privacy question or to exercise your rights:
- Email: it@jarra.net
- Post: RAFAD ADVANCED DIGITAL SOLUTIONS COMPANY L.L.C., Al Shaab Street 24, Jandaweel, Amman, Jordan
If you are not satisfied with our response, you may complain to the Personal Data Protection Council at the Ministry of Digital Economy and Entrepreneurship in Amman, Jordan, which supervises compliance with the Personal Data Protection Law No. 24 of 2023.