Shubbak Privacy Policy

Who we are

Shubbak (formerly Lokal) is a food ordering app by Nexara, the trading name of الخدمة الذهبية للاستشارات الحاسوبية, commercial registration 83800, tax number 178201189, Amman, Jordan. Founder: Issa Al-Dalu. We handle your data under Jordan’s Personal Data Protection Law No. 24 of 2023. Contact: [email protected] or WhatsApp +962 79 594 3016.

Ordering with Shubbak is covered by the Shubbak Terms of Use.

What we collect

Your phone number, to sign you in with a one-time code sent by SMS.

Your name.

The app language you choose, if you are signed in: it is saved with your account so your notifications arrive in it.

The delivery addresses you save: the address, apartment, floor and landmark you type, and the pin you place on the map.

Your location, only if you allow it and only while you use the app, never in the background: the app uses it to find the food hall that delivers to you, to quote delivery and to place your address pin. It is sent with those requests and kept, with your name and number, only as part of an address you save or an order you place. Without your name or number, map positions are also kept for up to 7 days in our address-lookup cache, and can appear in our servers’ technical logs and error reports.

Your orders: the dishes, choices and notes, the amounts, any tip, the delivery address and the order’s progress.

Your ratings: the stars you give an order after it arrives, and, on a past order, whether you would order again from each kitchen and from the courier. For those answers the app sends us one score for the whole order, 5 stars if you would order again from every kitchen and 1 star otherwise, with a thumbs up or down for the courier; your answer for each kitchen stays on your phone. On a Mix, the score is recorded for every kitchen in it. Only the first rating of an order is kept. Ratings have no written comment.

What you search for. Each search is sent to our server to find dishes and kitchens, and we keep a record of it (its first 120 characters, the number of results, its language and the install id below) to improve search. Anything shaped like a phone number or an email address is left out of that record.

How the app is used: when it opens, when you view Home or a dish, add a dish, start checkout and place an order, with the dish or order id, quantity and total involved. These events carry a random id created for this install of the app, not your phone number or name, and are sent without your sign-in. The event for a placed order includes that order’s id, so through the order these events, and your searches, can be linked to you.

If you allow notifications, a notification token for your phone, with its platform, language and app version. If your iPhone shows your order on its Lock Screen, a token for that live view too.

Technical logs on our servers (IP address, time and request, including any search words or install id the request carries), kept for security.

Payments

Shubbak takes cash on delivery only: you pay the driver when your order arrives. Shubbak does not ask for, see or store any card details.

Kept only on your phone

Your list of recent searches (each search also reaches our server, see above), the dishes and kitchens you save, the kitchens you opened lately, the choices of your last Mix, an address you pick before signing in, and a copy of the menus so the app opens fast. The names you enter for the people you order for, with any allergies or dislikes you note for them, and your “order again” answers for each kitchen are kept on your phone too and are never sent to us. Your sign-in is kept in the phone’s encrypted storage.

How we use it

To sign you in, take your order, pass it to the kitchens that cook it, deliver it, tell you where it is, answer you when you contact us, prevent fraud and meet our legal obligations.

To suggest dishes to you. Picked for you on Home, and the order of the best sellers you see, come from the orders placed with your phone number at the kitchens on Shubbak in the last 180 days, including orders you placed with those kitchens outside Shubbak, for example by phone or on their own website.

Your notification token also lets us send, now and then, news and offers from Shubbak. You can turn notifications off in your phone’s settings.

Your searches and the usage events show us what works in the app, so we can improve it. We do not show ads, we do not track you for advertising and we do not sell your data.

Who we share it with

The restaurants that cook your order: your name, phone number, delivery address, the order and the ratings recorded for it.

The courier who delivers it, who may be the kitchen’s own driver or a delivery company the kitchen works with, such as Careem Express, TopDeliver or Nashmi: your name, phone number, delivery address and pin, the dishes, the cash amount to collect and your note for the courier.

Companies that provide services to us, only to provide those services:

The companies that host our servers, in data centres in Germany.

Cloudflare, which carries all traffic between the app and our servers and keeps encrypted backups of our database.

NovaCloud (Tech Tide Portugal), which keeps nightly backup copies of our servers, including our database, in a data centre in the Netherlands.

JoSMS (JorMall, Jordan), which sends the sign-in code to your phone number by SMS.

Google Firebase Cloud Messaging, and Apple’s push service on an iPhone, which deliver our notifications to your phone’s notification token.

Google Maps Platform, which suggests and names addresses: our server sends it the address you type and the map position around it, or your pin’s position. Your phone does not contact Google for this.

Mapbox, which draws the map. Our server fetches the map images, so Mapbox sees which part of the map is shown, not who is looking.

Sentry, which receives reports of errors on our servers, and in the app if we turn its crash reporting on, and timing samples of a small share of all requests to our servers: what failed or was timed and the request involved, including any search words, typed address or map position in the request’s address, without your sign-in or IP address.

Authorities, when the law requires it.

Where your data is

Our servers are in Germany and our nightly backup copies are also kept in the Netherlands, so your data is stored outside Jordan. Several of the companies above are based outside Jordan too, among them Google, Apple, Cloudflare, Mapbox and Sentry (United States), NovaCloud (Portugal) and Careem (United Arab Emirates). Jordan’s Personal Data Protection Law sets conditions for sending personal data abroad: we send it only to run Shubbak as this policy describes, and only to the kinds of recipients described here.

How long we keep it

Your account, saved addresses, ratings and notification tokens: until you delete your account. A phone’s token also goes when you sign out on that phone, or when Firebase tells us it no longer works. A Lock Screen live view’s token: at most 12 hours.

Sign-in codes are stored only in scrambled form, and they are deleted, with the IP address that asked for them, after 7 days. A sign-in session is deleted 30 days after it ends.

Backups of our database are overwritten within about 30 days.

Deleting your account

In the app: Account → Delete account → Delete my account, once any order on its way has been delivered. If your account has been suspended, write to us to delete it. Your name, your sign-in, your saved addresses, your ratings and your phones’ notification tokens are deleted right away; a Lock Screen live view’s token expires within 12 hours. Records of orders you placed stay, with the name, phone number and address on them: the kitchens keep theirs, and we keep ours of each Mix. Search and usage records stay too; they carry the install id, which the event for a placed order links to that order. Copies in our backups are overwritten within about 30 days. If you, or anyone who later has your number, sign in with it again, that is a new, empty account: it never shows orders placed before it was created. Without the app, see Delete your Shubbak account.

Your rights

You can ask to see, correct or delete your data, or object to how we use it, by writing to [email protected] from the phone number or email we know you by. We answer within 30 days.

Security

The app talks to our servers only over encrypted connections (HTTPS), and access to your data on our side is limited to the people who need it to run Shubbak.

Children

Shubbak is not directed at anyone under 18, and we do not knowingly collect their data. If we learn we have, we delete it.

Changes

If we change this policy we update the version below and, for a material change, tell you in the app. Current version: 2026-10-23.