Plavnt Vendor — Privacy Policy

Last updated: 3 October 2026

This policy explains what personal data the Plavnt Vendor mobile app and the Plavnt servers it connects to collect, why, who receives it, how long it is kept, and how you can have your account deleted. It applies to store owners and store staff who use the Plavnt Vendor app. It does not cover the Plavnt website or the Plavnt customer app.

1. Who we are

Plavnt is the trade name of IMCAN QUMMAM COMPANY, operating in the Kingdom of Saudi Arabia. We are responsible for the processing described in this policy. For any privacy question or request, write to info@plavnt.com.

2. Data we collect and why

Account and profile information

• Email address, name and phone number(s); address and city if entered on the account.
• Account identifiers: your user ID, the ID of the store you belong to, and your role (store owner or store staff).
• Your password, stored only as a one-way hash. We cannot read it.

We use this to create and secure your account, sign you in, identify which store you act for, and contact you about your store's orders. A store owner can create staff accounts from the app (Settings → Users): the owner then enters the staff member's name, email, phone number and an initial password. Owners must inform their staff about this policy.

Store and product information

Store name, description, address, phone, email, location and photo, and the products, prices and product photos you add. This is used to show your store and products to customers and to route orders to your store.

Precise location

• Collected only when you use the order-status function: when you open the form to add a status to an order (for example "delivered"), the app asks for location permission and reads your device's current location once.
• It is optional: if you refuse the permission or turn location off, you can still submit the status, without a location.
• When you submit the status, the location is saved with it as a location stamp of where the status was recorded. It is used for order follow-up, delivery confirmation and dispute resolution, and is visible to your store's accounts and to Plavnt.
• It is not background tracking: the app does not follow your position, and it does not collect location at any other time.

Photos

• Order-status photos you take with the camera when adding a status (for example proof of delivery).
• Photos you attach to order messages (camera or gallery).
• Product photos you add to your store (camera or gallery).

The app only accesses the camera or your photos when you choose to add a picture. Photos are stored on our servers with the order, message or product they belong to.

Messages and notes

Order messages you exchange about an order, and the notes you add to order status updates. They are stored with the order and are visible to the people involved in that order: the customer, your store and Plavnt.

Customer information you see in the app

To fulfil orders, the app shows your store the customer's name, phone number, delivery address and location, and order details. You may use this information only to fulfil the order. Opening a customer's delivery location or a status location in Google Maps is described in section 5.

Device identifiers and push notifications

• Firebase Cloud Messaging (FCM) token: if you allow notifications, we store your device's FCM registration token, with the platform (Android/iOS) and the app language, to send you notifications about your store's orders.
• Firebase identifiers: the Firebase SDKs in the app use app-instance identifiers to deliver notifications and to group analytics and crash data.
• Advertising ID: the app currently includes Firebase Analytics, which can collect the Android Advertising ID. We do not use it for advertising, ad personalisation or tracking across other companies' apps, and we do not sell it.

Analytics — Firebase Analytics

The app uses Google Firebase Analytics to understand how the app is used (app interactions such as screens viewed and app opens, device model, operating system and app version, approximate country, and the device identifiers above). This data is processed by Google as part of Google Analytics for Firebase. We use it only to improve the app, not for advertising.

Crash reporting — Firebase Crashlytics

When the app crashes or hits a serious error, Firebase Crashlytics sends a crash report: crash logs and stack traces, device model, operating system and app version, and diagnostic information such as the date and time of the crash and an installation identifier. We use it only to find and fix errors.

Technical data on our servers

Like any online service, our servers record technical logs of requests (such as IP address, date and time, the requested address and the browser or app identification string, the "user agent") to operate, secure and troubleshoot the service. Sign-in tokens are kept on your device in secure storage.

3. Who receives your data

• Customers see your store's name, products and the messages and status updates you send about their orders.
• Your store: other accounts of your store see the orders, messages and status updates of the store.
• Service providers acting on our behalf: our hosting provider, and Google (Firebase Cloud Messaging, Firebase Analytics, Firebase Crashlytics) under Google's terms for these services.
• Authorities, when required by law.

We do not sell personal data and we do not share it for advertising.

4. Data security

All data between the app and our servers is transmitted over encrypted connections (HTTPS/TLS). Access to our servers and to the administration tools is restricted to authorised staff, and passwords are stored only as one-way hashes. No method of transmission or storage is completely secure, but we work to protect your data and fix problems promptly.

5. External links (Google Maps)

When you tap a delivery location or a status location, the app opens it in Google Maps or your browser. This is an action you start yourself; Google then processes it under Google's own privacy policy and terms, not ours.

6. How long we keep data

• Account and profile data: while your account exists. When the account is deleted, it is deleted or anonymised as described in section 7.
• Order, payment and store records (orders and their status history, messages, photos and location stamps, products, payouts and adjustments): kept as long as we need them for the store's and customers' order history, accounting and tax record-keeping, customer support and disputes, or as long as the law requires.
• Crashlytics crash data: retained by Google for a limited period (90 days according to Firebase's documentation). Analytics data: retained according to the retention setting of our Firebase project.
• Server technical logs: kept for a limited period for security and troubleshooting.

7. Account deletion

You can ask us to delete your Plavnt Vendor account at any time:

• In the app: if your version of the app has the delete-account option in its settings. You confirm with your password and the deletion takes effect at once.
• On the web: at https://app.plavnt.com/vendor/delete-account. Because anyone could type an email address there, we first verify that you hold the account, using the contact details registered on it, before deleting anything.

When your account is deleted:

• You can no longer sign in; your sessions, sign-in tokens and notification registrations (FCM tokens) are revoked.
• Your email, password, name, phone numbers, address, coordinates, device identifiers and profile picture are deleted or replaced by anonymous values; your notifications, reviews, saved occasions and the saved addresses that no order uses are deleted.
• Your account is removed from your store's user list.

Some records are kept, because the store, its customers and Plavnt need them for order history, accounting and tax record-keeping, customer support, disputes and audit: orders, order status history (with its photos, notes and location stamps), order messages, products and payment or payout records, and, if you also ordered as a customer, those orders with their delivery details. They stay attached to the anonymised account (shown as "Deleted user") or to the store, no longer to your profile, but they can still contain what you entered or captured in them yourself, such as message and note text, photos and location stamps. Deleting a store owner's account does not close the store, delete its other staff accounts, or delete its orders and financial history; to close a store, contact us.

8. Your rights

You may ask to be informed about the processing of your data, to access it or obtain a copy, to correct it, and to have it deleted when it is no longer needed, including under the Saudi Personal Data Protection Law (PDPL) where it applies. Write to info@plavnt.com. We may need to verify your identity before acting on a request.

9. Children

The Plavnt Vendor app is intended for businesses and their staff. It is not intended for children.

10. Changes to this policy

We will update this page when the app or our practices change, and change the "last updated" date above.