Privacy Policy – Reef Customer

Last updated: August 29, 2026

Reef Customer ("the App", package co.il.reeflogistics.customer) is the ordering application of Reef Bakery (Reef Logistics). Business customers use the App to sign in with the customer account issued by the bakery, browse the product catalog, place and edit orders, manage recurring weekly order templates, view order and delivery history, update their contact details, and receive order-related notifications.

This policy describes only the data the App actually processes. Reef Customer does not use the device location, does not access the camera or the photo gallery, and contains no advertising or marketing analytics SDKs.

1. Information We Collect

Account and authentication information

• Customer number issued by Reef Bakery, used as the login identifier
• Authentication credentials (password) and authentication tokens
• Account status, role and login timestamps

Business and contact information

• Business name and delivery area assigned by the bakery
• Business phone number and email address
• Contact person name and contact person phone number
• Delivery address and drop-off instructions entered for the business
• Free-text notes the customer adds to their profile or to an order

Order information

• Orders, order items, products and quantities
• Requested delivery date and delivery type (delivery or self-pickup)
• Weekly recurring order templates
• Order status, delivery status and related timestamps
• Favorite products and per-product ordering preferences

Notifications

• Push notification registration token, when notifications are enabled on the device
• Notification preferences (order reminders, delivery notifications)
• In-app notification records and their read/dismissed state

Device and technical information

• Application version and basic device / operating-system information
• Connectivity state, used for offline handling
• Diagnostic, crash and error information generated by the App
• Application usage events required to operate and troubleshoot the ordering flow

Reef Customer does not collect location data, does not access contacts, files, the camera or the photo gallery, and does not collect persistent hardware identifiers.

2. How We Use Information

• Authenticate the customer account and keep the session secure
• Display the catalog, prices and ordering rules applicable to the customer
• Receive, edit, schedule and process orders
• Plan, execute and document deliveries to the customer's business
• Send operational notifications such as order reminders and delivery confirmations
• Provide customer support and resolve order or delivery issues
• Maintain accounting, delivery and dispute-resolution records
• Maintain application security and detect and troubleshoot technical problems
• Comply with applicable legal requirements

We do not sell or rent personal information, and we do not use customer information for advertising or profiling.

3. Sharing of Information

Information is accessible to authorized Reef Bakery personnel (back office, production and delivery drivers) as required to prepare and deliver orders, and to the infrastructure providers listed in section 8, only as required to run the service. Information may also be disclosed when required by law or legal process, or to protect the rights, property or security of Reef Bakery, its customers or other persons.

4. Data Storage and Security

• Data is stored in a managed cloud database hosted in the European Union region of our infrastructure provider
• All communication between the App and backend services uses encrypted HTTPS/TLS connections
• Passwords are stored only as salted hashes by the authentication service; they are never stored in plain text
• Database access is restricted with row-level security policies, so a customer account can read and write only its own records
• Role-based access controls limit what bakery staff can access
• Operational monitoring and error reporting are handled by our own backend services

No method of electronic storage or transmission is completely secure, so absolute security cannot be guaranteed.

5. Data Retention

We keep information only as long as reasonably necessary for:

• Operating the customer's account and ordering activity
• Fulfilling and documenting orders and deliveries
• Accounting, tax and audit obligations
• Resolving disputes and supporting claims
• Security and fraud prevention

When the information is no longer required, it is deleted, anonymized or securely disposed of.

6. Account Deletion

Customers can delete their account at any time, directly from inside the App: open Profile (פרופיל) in the bottom navigation and use Delete my account (מחק את החשבון שלי) at the bottom of the screen. The action requires re-entering the account password and an explicit confirmation, and it cannot be undone. A public web page is also available at reeflogistics.co.il/customer/delete-account.

When an account is deleted, the following data is deleted immediately:

• The login account and its authentication credentials
• The user profile and role assignment
• Push notification registrations and device tokens
• In-app notifications and announcement records
• Favorite products, per-product preferences and weekly recurring order templates
• Drop-off instructions and related media
• Contact details on the business record (contact person, phone numbers, email, notes)
• Application usage and diagnostic events linked to the account

The following data is retained, because Reef Bakery is required to keep it for business, accounting, tax and dispute-resolution purposes: past orders and order items, delivery and delivery-note records, and shortage or surplus reports. These records remain linked to a business record that no longer contains personal contact details and is no longer connected to any login account. They are retained for the period required by applicable law and are then deleted or anonymized.

After deletion, the account can no longer be used to sign in to Reef Customer.

7. Your Rights

• Access the personal information held about your account
• Correct inaccurate contact details, directly in the App profile screen or by contacting us
• Delete your account and associated personal information, as described in section 6
• Withdraw consent for push notifications, in the App or in the device settings
• Object to or restrict certain processing, subject to our legal obligations
• Ask questions or file a complaint using the contact address in section 11

8. Third-Party Services

• Supabase — authentication, database and backend functions
• Google Firebase Cloud Messaging — push notification delivery on Android
• Cloudflare-based hosting used by the Lovable platform — serving the web application

Reef Customer contains no third-party advertising SDKs and no third-party marketing analytics SDKs.

9. Permissions

• Notifications (POST_NOTIFICATIONS) — order reminders and delivery notifications; optional and can be declined or revoked at any time
• Internet and network state — communication with backend services and offline handling
• Wake lock — reliable delivery of push notifications

Reef Customer does not request location, camera, photo/media, contacts or storage permissions.

10. Children's Privacy

Reef Customer is a business-to-business application for authorized adult representatives of business customers. It is not directed to children, and we do not knowingly collect personal information from children.

11. Contact Us

For privacy questions or account deletion assistance, contact us at:

Privacy contact: office@reefbakery.co.il

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the application, technology or legal requirements. When material changes are made, the "Last updated" date above is updated.

Reef Customer is operated by Reef Bakery (Reef Logistics), operator of the website reeflogistics.co.il.