Privacy Policy

Last updated: 8 November 2026

This policy explains how Lebsa collects, uses and protects personal data when you use the Lebsa app and the lebsa.ly website. “Lebsa”, “we” and “us” mean the operator of the Lebsa service. You can reach us at [email protected]. The Arabic version of this policy prevails if the two versions differ.

In short: we collect only what the service needs. We do not sell personal data, show ads from ad networks, or track you across other apps and websites. You can delete your account at any time in the app or by email.

1. Data we collect

Type	What it includes	Required?
Account	Phone number, password (stored hashed; nobody can read it), name, email, profile photo and city.	Phone and password are required; the rest is optional.
Gender	Male, female or “prefer not to say”. Used to show the right sections, including women-only sections, and to word texts.	Asked once; “prefer not to say” is allowed.
Location	Approximate location (about 1 km) when you allow it, to show nearby shops and improve the service. Before this, the app shows a notice that your approximate location is sent to Lebsa; if you choose «ليس الآن» (Not now), nothing is sent. Precise location only when you drop a pin for a delivery address or a shop location.	Optional.
Addresses	Saved delivery addresses: city, area, street, landmark and a contact number.	Only for delivery.
Bookings and orders	Pieces booked or bought, dates, fitting appointments, amounts, deposits and security amounts, notes and receipts.	When you book or buy.
Payments	Card details are entered directly on the payment page of our payment provider, Moamalat; card numbers never reach or stay with Lebsa. We keep the amount, the transaction reference and its result.	Only for card payments.
Content	Chat messages and images with shops, reviews and their photos (with your height and usual size if you add them), handover and return photos, reports, and support correspondence.	Optional.
Referrals	Your referral code, who joined through it, and the resulting credit.	When you use referrals.
In-app activity	Pieces and shops opened, search terms, and taps on contact and share. Used to improve the service and for aggregated shop statistics, never for ads.	Collected automatically.
Device	A random per-install identifier, device model, notification token and app version. Crash reports are not linked to your identity.	Collected automatically.
Shop data	Shop and branch details, hours and location; staff (phone numbers and permissions); the shop's customer records; bank accounts for payouts; verification documents (commercial register, licence, owner ID).	For shop owners.
Technical logs	Server request logs (request type, result, duration, user number) and actions of Lebsa administrators.	Collected automatically.

We do not collect your contacts, advertising ID or date of birth.

2. How we use data

To run the service: accounts and sign-in, showing shops and pieces, and handling bookings, orders, payments and delivery.
To verify your phone number with an SMS code when you sign up, when you reset your password, and when you are invited to join a shop's staff.
To send notifications and SMS about bookings, orders, appointments and shop messages.
To send notifications about offers and what is new on Lebsa, which we may target by city, gender and the departments that appear in your favourites, bookings and orders. You can turn them off at any time: side menu → «إعدادات الإشعارات» (Notification settings) → «العروض والإعلانات» (Offers and ads).
To show content suited to your city and gender.
For security, fraud and abuse prevention, and handling reports.
For customer support.
To improve the service and give shops aggregated statistics about their products.
To meet legal and accounting obligations.

We do not sell personal data, share it with ad networks, or track you across other apps or websites. The app may show paid promotions from shops registered on Lebsa, without using any data from outside Lebsa.

3. What other users see

The shop you book or buy from sees your name, phone number, the booking or order details, your delivery address when you request delivery, and your chat with it. Shops keep their own customer records to run their business.
Reviews are public, with your first name or without a name depending on the display setting, with any attached photos, and with your height and usual size if you add them.
Receipts: a shop can share a receipt link showing the customer's name and number, which may be partly masked.
Shop pages: the shop's name, logo, phone numbers, address and map location are shown to customers.

We share data with service providers working for us, only as much as they need:

Provider	Purpose	Data
SMS gateway (Almasafa)	Verification codes and alerts	Phone number and message text
Google Firebase	Push notifications and crash reports	Notification token and content; crash reports not linked to identity
Google Maps and the device's location services	Maps and turning a pin into an address	The map area shown and the chosen pin
Moamalat	Card payments	Amount and transaction reference; card details are entered with them directly
Couriers (such as Darb Assabil), when used	Delivering orders	Recipient name, phone, address and cash-on-delivery amount
Cloudflare	Protecting and speeding up the site and service	Technical connection data such as IP address

We may disclose data when a competent authority requires it by law, or to protect the rights and safety of Lebsa and its users. When you open WhatsApp, the dialler or your calendar from the app, that happens at your request through those apps under their own policies.

5. Device permissions

Location (only while using the app): nearby shops, and setting a delivery address or shop location.
Camera: scanning piece QR codes and photographing a piece's condition at handover and return.
Photos: choosing profile, shop, product and chat images.
Notifications: booking, order and message alerts.
Calendar (iPhone): adding pickup and return dates when you ask.

You can turn off any permission in your device settings at any time; the rest of the app keeps working.

6. How long we keep data

Account data, chat messages and reviews are kept while the account exists. The following are deleted automatically after these periods:

Server request logs: 30 days.
Verification codes: 7 days.
Approximate location history: 90 days.
Detailed in-app activity: 90 days; after that, aggregated statistics remain, plus a short record of the days you used the app, used to count users.
Notification inbox: 180 days; notification send log: 120 days; sent SMS: 30 days.
Shop activity log (what staff do inside the shop): one year.
Shop verification documents: 90 days after the review decision.
Booking, order, payment and receipt records: as long as needed for accounting, disputes, fraud prevention and legal obligations.
Reports and the administrators' action log: as long as needed to handle abuse and keep the service secure.

7. Deleting your account

Delete your account in the app: side menu → «حسابي» (My account) → «حذف الحساب» (Delete account), or request it by email. Details are on the Delete account page.

Deletion immediately erases your profile, photo, password, addresses, favourites, alerts and location history, ends your sessions and stops notifications. Reviews remain without your name; chat messages are replaced with “message deleted” and their images removed. Booking, order, payment and receipt records stay with the shop and with Lebsa for the accounting and legal reasons above, no longer linked to a profile. Deleted data leaves backups within their normal cycle.

8. Security

The app and website use encrypted connections (HTTPS) throughout. Passwords and session tokens are stored hashed so they cannot be read, sign-in is temporarily locked after repeated wrong attempts, access to data is limited to those who need it, and private files such as documents and chat images are served through protected links. No system is perfectly secure, so never share your password or verification codes with anyone.

9. Your rights

View and correct your data from your profile in the app.
Request a copy of your data, or its deletion, at [email protected].
Withdraw location, notification or camera permission in your device settings.
Object to a particular use of your data; we reply within 30 days.

10. Age

Lebsa is intended for people aged 18 and over. We do not knowingly collect children's data, and we delete an account if we learn it belongs to someone under 18.

11. Where data is processed

Lebsa's data is stored on servers operated by Lebsa. Data may be processed outside Libya, whether on these servers or by some of the providers above, such as Google and Cloudflare, and it stays protected under this policy and those providers' data-protection commitments.

12. Changes and contact

We may update this policy as the service changes. The new version is published here with its date, and we notify users in the app of any material change.

Privacy questions: [email protected].