Lawaen Privacy Notice

Effective date: 4 October 2026 1. Who we are This notice explains how personal data is handled when you use Lawaen. Lawaen covers: - the Lawaen mobile app; - the Lawaen website; - the Lawaen Business Centre. Lawaen is operated by Sevda Company, a Syrian single-person limited liability company registered in Damascus under Commercial Registration No. 0111020279 ("we", "us"). We are responsible for the personal data described here. You can contact us at support@lawaen.com. Please read this notice together with the Lawaen Terms of Use. 2. Information you give us Account: - your name; - the phone number or email address you register with; - a recovery email address if you add one; - your password, which we store only in a one-way protected (hashed) form that cannot be read back; - a profile photo, and your gender and birth date, if you choose to add them. Content you share: - ratings and comments; - photos you upload; - place suggestions; - claims for a business, with your note and an optional contact phone number. Business information, if you use the Business Centre: - business applications; - business details and photos; - menus and services, prices, offers and events; - requests to send notifications to users. Support: - the messages you send us; - the category and subject of each request; - our replies; - your name and phone number, which are copied from your account into each request; - for a callback request, the phone number and the time you prefer. Account deletion requests: your name, your email address or phone number, and the reason you give, if any. 3. Information we collect when you use Lawaen Sign-in and security: - the device identifier and sign-in time of each signed-in session; - requests for one-time codes (the codes themselves are not stored in readable form); - records of failed sign-in attempts. These records help us keep your account secure. Failed-attempt records use protected identifiers derived from your account and your network address, and are kept only for a limited time to stop password guessing. Activity in Lawaen: - the places, offers and events you save; - your ratings, comments and shares; - your visits to place pages, recorded with a protected visitor key. From your saves, ratings, comments and visits we build an interest profile of the categories, places and cities you interact with. We use it to order recommendations for you when you are signed in. Your search text is not stored on our servers. The app keeps your recent searches on your device. Device and notifications (app): - the push notification token; - the platform, app version and build; - your language; - your notification permission; - an installation identifier; - the city you chose; - if you allowed location access, the device location the app last reported. We use these to send you notifications, including notifications about places in your city or near you. Location: - When you search near you or around a point on the map, the coordinates are used to answer that request. - The website rounds your browser location to about 110 metres before using it. - The app shows the weather for your location or your chosen city. To do this, your device sends those coordinates directly to a weather service. Website analytics: - The website uses its own analytics. Data goes to Lawaen only, not to analytics companies. - It stores a random identifier in your browser, renewed every 180 days, and a session identifier. - It records the pages you view (the page address only, not search text) and your device category. - If your browser sends a Do Not Track or Global Privacy Control signal, website analytics are switched off. App installs and campaign measurement: - If you install the app through one of our campaign links, we record: - the campaign details; - a random installation identifier; - the install referrer from the app store; - your language and app version; - a few in-app milestones: first open, registration completed, a search made (without the search text), a place viewed, directions requested, and a place saved. - The app also includes Meta's App Events tool. It measures app installs and advertising campaigns using events such as registration completed, a search made (without the search text), a place viewed, directions requested and a place saved. - The app does not collect your device's advertising identifier. Cookies and similar storage: - The website and the Business Centre use secure session cookies to keep you signed in. - A language cookie remembers your language for up to a year. - Your browser also stores your theme and the analytics identifiers described above. - The app keeps your sign-in tokens in your device's secure storage. - We do not use advertising cookies or third-party analytics on the website or the Business Centre. Technical data: - Our servers process your network (IP) address to deliver Lawaen and to protect it, for example by limiting repeated requests. - Error and access logs may contain your network address. They do not contain your passwords, codes or the content of your requests. 4. How we use information We use personal data to: - create and run your account, sign you in and keep it secure, including sending one-time codes by WhatsApp or email; - show search results, maps, recommendations and the weather; - publish your ratings, comments and photos; - review business applications, claims, business changes and notification requests; - publish approved business information; - send notifications, for example: - about your account and your support requests; - about replies to your comments; - about events from places you saved; - notifications requested by businesses and approved by our team; - tell business owners about the decision on their application, by notification and, if the account has a phone number, by WhatsApp; - answer support requests and callback requests; - give businesses statistics about their listing, such as visit, save, share, comment and rating counts; - understand how Lawaen is used and measure our campaigns; - prevent fraud and abuse, enforce the Terms of Use and the Community and Content Guidelines, and meet legal obligations. 5. What other people can see The following are shown publicly: - your ratings and comments, with your name and profile photo; - business replies to comments, shown as coming from the business; - business listings, including the contact details and links the business chooses to show. Business owners: - When you save, rate or comment on a business, its owner may receive a notification that includes your name. - Owners can see the names and photos of the people who rate and comment on their business. 6. Who we share information with We use service providers who process data for us: - a WhatsApp messaging provider and an email provider, to send one-time codes and messages; - Google Firebase, for push notifications and app configuration; - map services: - Google Maps in the Android app; - Apple Maps in the iOS app; - OpenStreetMap map tiles in the Business Centre; - the map app you choose when you ask for directions; - a weather service (Open-Meteo), which receives the coordinates the app uses for the weather; - Meta, for the app measurement described in section 3; - a route service (OpenRouteService), which receives the start and end points when it is used for driving directions. Our current production infrastructure also uses Hostinger for hosting and email transport. WhatsApp messages are delivered through Lawaen's configured WhatsApp transport provider. The other named providers above are used only for the functions described there. Lawaen's own production servers store account data and uploaded photos on Hostinger infrastructure in Manchester, United Kingdom. We may also disclose information when the law requires it, or when it is necessary to protect the rights and safety of people using Lawaen. 7. How long we keep information Some information expires automatically: - one-time codes and sign-in sessions; - failed sign-in records; - website analytics records. When you delete your account: - After you confirm with a one-time code, your account is closed, you are signed out on every device and your push tokens are removed. - You can recover the account by signing in within 13 days. - After 13 days the deletion is completed: - your name, phone number, email address, password, profile photo, gender, birth date and location are removed from the account; - your saved items, visits, interest profile, notifications, sessions, acceptance records and website analytics records are deleted; - businesses you managed are released from your account; - pending claims are rejected, and the notes and phone numbers on your claims are removed. - Your ratings and comments stay on Lawaen, shown under the name "Deleted account" and without your photo. - Some records are kept, such as: - support requests and messages; - place suggestions; - business applications and change records; - offers and events you published; - security and audit records. We keep other information according to the current product rules: - website analytics events: 90 days; - website analytics sessions: 180 days; - acquisition raw records, when acquisition measurement is enabled: 90 days; - acquisition click tokens: 14 days; - two-step-verification audit records: 90 days; - failed sign-in records: 24 hours; - remembered trusted-source records used for sign-in protection: 30 days; - container logs: rotated at 10 MB, keeping up to 5 files. The current product does not enforce a fixed automatic expiry period for support requests and messages, comments and ratings that remain after account deletion, place suggestions, business applications and change records, or security and audit records. 8. How we protect information - Passwords are stored only in hashed form. - Sign-in tokens are stored in protected form. - Two-step verification secrets are encrypted. - Connections to Lawaen use encrypted HTTPS. - Staff access to tools is limited by role. - When you upload a photo, we re-encode it and remove the metadata stored in the file, such as location tags. No system is completely secure. Please keep your password and codes private. 9. Your choices and requests You can: - allow or block location access and notifications in your device settings; you can use Lawaen without location by choosing a city; - update your name, photo and other profile details, change your phone number, and add or change your recovery email; - change a rating by rating the place again; - delete your account from your account settings in the app, on the website or in the Business Centre; - block website analytics by turning on Do Not Track or Global Privacy Control in your browser, or by clearing your browser storage. To ask about your data, to correct something you cannot change yourself, or to ask us to remove a comment, contact us. Use Help Centre → Contact options or write to support@lawaen.com. 10. Children Lawaen is intended for people aged 16 or older. You must be at least 16 to create an account, submit ratings, comments, photos or other content, suggest places, make business claims, or use Business Centre features. If you are under 16, do not create an account or provide personal information through Lawaen. Public place information may still be browsed without an account. 11. Changes to this notice We may update this notice. Each version has a version number and an effective date. When we make an important change, we will ask you to review the new version in the app or on the website. 12. Contact For privacy questions and requests: Help Centre → Contact options in the app, on the website or in the Business Centre, or support@lawaen.com.