Cartello Privacy Policy
Last updated: October 4, 2026
Cartello ("we", "us") runs the Cartello app and the website cartelloapp.com. The operator is Marylee El Amine, Lebanon. You can contact us at contact@cartelloapp.com.
This policy explains what we collect, why, who sees it, and how you can delete it.
1. What we collect
From everyone who has an account (Shoppers and Agents):
- Your phone number, used to sign you in with a code sent by SMS.
- Your email address, if you give one.
- Your device's push notification token, so we can send you order updates.
- Your orders, quotes, carts, messages to support and any photos you attach to a report.
From Shoppers: your delivery address.
From Agents: your full name, your government ID number, photos of the front and back of your ID, your pickup address, and the stores you service. We use these to check who you are before we approve you.
Collected automatically: basic app activity events and error reports, so we can fix bugs and keep the service safe. Our error reports do not include your name or account ID.
2. Why we use it
- To create your account and keep it secure.
- To match Shoppers with Agents, take payment, hold it until delivery, and settle disputes.
- To verify Agents and prevent fraud, including people who have been suspended returning under a new account.
- To send you service messages: order updates, approvals and support replies.
- To keep the records we are required to keep for accounting and tax.
We do not sell your data and we do not use it for advertising.
3. Who sees it
- The other person in your order. Other users do not see your name, phone number or address. An Agent sees what is in the cart: the store, item links, sizes, colours and any note you write. A Shopper sees each Agent's quote as an anonymous offer. Please do not put personal details in notes, because the Agent can read them. Our staff pass your delivery address, and only what is needed to deliver, to the courier who delivers your order. We do not show your ID or ID photos to other users.
- Our staff, through a private admin portal, only as needed to run the service and handle support and disputes.
- Service providers that process data for us: Bird (SMS codes), Resend (email), Expo (push notifications), Sentry (error reports), Supabase (database and file storage) and Vercel (website hosting). We will add our payment provider here when payments go live. They only receive what they need to do their job.
- Authorities, where the law requires it.
4. Where it is stored
Our database and files are hosted by Supabase, a cloud provider. Your data may therefore be stored on servers outside Lebanon.
5. How long we keep it
- Agent ID photos, ID details and your address are deleted when you delete your account.
- Order, payment and commission records are kept after deletion, without your personal details, for as long as the law requires us to keep accounting records.
- Other data is kept while your account is active and cleared when you delete it.
- Our service providers and backups may keep copies for a short time after deletion.
6. Your choices and rights
- Delete your account in the app (Profile, then Delete account) or follow the steps at cartelloapp.com/delete-account. You confirm by typing DELETE. We cannot delete an account while it has an active order.
- Access or correct your data by emailing contact@cartelloapp.com. We will respond as soon as we can.
- Turn off notifications in your phone settings.
When you delete your account, we remove your phone number, email, address, ID photos, ID details and push token. Your past orders stay in our records as "Deleted user".
7. Security
Data travels over encrypted connections and is stored in private databases and private file storage. No system is perfectly secure, so please keep your phone and login codes safe.
8. Children
Cartello is for people aged 18 and over. We do not knowingly collect data from children.
9. Changes
If we change this policy in a meaningful way, we will tell you in the app before the change applies.