Privacy Policy

Last updated: 28 October 2026

This policy explains what information is collected when you order food for delivery on basad.app and in the BASAD app, what it is used for, who it is shared with, and how to exercise your rights over it.

BASAD is a service of RAZ GAZ DELIVERIES LTD ("the Company"), which also runs the RazGaz courier network. The website and the app run on one system, so one policy covers both. The policy for couriers and businesses is at raz-gaz.com/en/privacy.

Who we are

Service and app name
BASAD
Website
basad.app
Developer name on the App Store
Erel Biran
Developer name on Google Play
RazGaz Ltd
Legal entity
RAZ GAZ DELIVERIES LTD (רז גז משלוחים בע״מ), company number 517367033
Company number
517367033
Registered address
Pardes Meshutaf 37, Ra'anana, Israel
Privacy contact
erel@raz-gaz.com

What we collect

We collect only what the order, the delivery and the service itself have a use for.

Identity and contact
Mobile phone number (it is also how you sign in, by SMS code), name, and an email address if you gave one. If you sign in with Apple or Google, the identifier and email address they provide.
Order information
The delivery address, floor/apartment/entrance and the entrance point you marked on the map, the recipient's phone number, order items, notes, payment method and amount, coupons and credit, and any rating you gave the order.
Payment
Card payments are made on the secure page of the card processor, Grow. Your card details never reach us; if you chose to save a card, we keep only a token Grow issues for charging it again, its brand, last four digits and expiry; the card number itself is held by Grow alone.
Location
The location of the delivery address, and your device's location only when you ask — set out in full in the next section.
Images
A photograph you choose to attach to a support message. Camera or photo access is requested only at the moment you attach one.
Notifications
In the app, your device's push token, so we can send an update on your order or a message from support.
Technical and diagnostic
Device or browser model, OS and app version, and error and crash reports. The app additionally collects install identifiers, to measure where an install came from — see the sharing section.
Support messages
The content of support chat messages and any files attached to them.

Location, in detail

In the BASAD app, location is used to find and pin your delivery address on the map. It is collected only while the app is open, never in the background.

On basad.app, the browser is asked for your location only when you press the location button on the entrance map, to centre the map; the location itself is not stored — only the point you marked.

During an active delivery you are shown the courier's position on the map, so you can follow your order. Your delivery address's position is shown to the courier and the restaurant for the delivery only.

What it is used for

Running the service
Passing the order to the restaurant, assigning a courier, order tracking, putting the parties in touch, and support.
Payment and billing
Charging the order, refunds, coupons and credit, and issuing an invoice.
Security and abuse prevention
Verifying identity at sign-in, and limiting how often codes and requests can be sent.
Reliability
Finding errors and crashes, and measuring how the website and the app are used.
Legal obligations
Keeping accounting records as Israeli tax law requires.

Who it is shared with

We do not sell personal information. It goes only to the parties an order, a payment or measuring use and arrival actually requires — and the list here is the whole of it:

The parties to an order
The restaurant receives the order, your name and phone number for the order. The courier sees the recipient's name, address and phone number. You see the courier's name, vehicle type and position on the map during an active delivery — not their phone number.
Infrastructure providers
Google Firebase (authentication, database, file storage and notifications), Google Maps, Google Routes and LocationIQ (finding addresses and measuring distance), Expo (notifications and app updates), Sentry (crash and error reports from the app: the device model, versions, the error's details, the screens before it and your account identifier — never your name, phone number or email), and OpenStreetMap (the website's maps and address search; their servers receive your browser's IP address and the area of map shown).
Payments
Grow — card processing, saved cards and the invoice, in the app and on the website.
Install attribution and marketing
The BASAD app — and only the app — runs AppsFlyer, a service that measures where an app install came from and which advertising led to orders. It receives device and install identifiers, your account identifier and usage events: signing in and signing up, viewing a restaurant or a dish, adding to the cart, starting checkout, searching, rating, and placing an order — its amount, its breakdown and how it was paid (never the card's details). On Android it also receives your email address, phone number and name, each one-way hashed (SHA-256) on the device before it is sent; on iPhone, only if you allow tracking when the system asks. When an order is cancelled or delivered, our servers tell AppsFlyer so. A campaign link passes the app a language, a coupon code and a screen to open; the coupon code is kept on the device alone. On iPhone, Apple sends AppsFlyer a copy of its SKAdNetwork attribution notice, with no identifier of you or your device. AppsFlyer may share this with advertising networks to attribute installs and orders to advertising. The website does not run it.
Website and app analytics
basad.app runs Google Analytics: it records which pages were viewed and the same usage events as the app, using Google's cookies, and receives your account identifier when you are signed in and how you arrived (a campaign, for example). The app runs Google Analytics for Firebase, which receives the same events, which screens were opened, an install identifier, your account identifier and how the install arrived — never the device's advertising identifier. When an order is cancelled or delivered, our servers tell them so. Neither receives your name, phone number or email.
Order analysis
For internal business analysis, order details — the restaurant, the town, the amounts, how it was paid, any coupon or credit, the timings and how you arrived — are also kept in Google BigQuery, in our own cloud account, identified by account identifier only, without your name, phone number or address.
Authorities
Where the law requires it, or to establish or defend a legal claim.

Where it is held

Our database and servers run on Google Cloud in the me-west1 region (Tel Aviv, Israel). Uploaded files are stored on Google Cloud in the United States, and some operational data also passes through the europe-west1 region (Belgium). Some of the providers listed above also process data outside Israel, including in the United States, under their own transfer arrangements.

How long we keep it

Order and payment records are kept for as long as Israeli tax law requires — seven years from the end of the tax year.

You can delete your account yourself, from the Profile tab in the app. What is deleted and what is kept is set out at basad.app/en/delete-account. What the law requires us to keep is kept, and the rest is deleted.

Your cart, chosen address and favourites on the website are kept in your browser alone, and are erased when you clear the site's data.

Security

Traffic is encrypted, permissions are enforced on the server rather than only on the screen, and only you can see your orders, addresses and credit. Your card details are not stored by us.

No system is proof against everything. If a security incident occurs that requires notification, we will act as the law requires.

Your rights

Under Israel's Protection of Privacy Law, 5741-1981, you may inspect the information held about you, ask for information that is wrong to be corrected, and ask for it to be deleted subject to the retention duties above. Residents of the European Union may also request a portable copy and object to certain processing.

To exercise any of these, write to erel@raz-gaz.com. We reply within 30 days.

Location, camera and notification permissions can be withdrawn at any time in your device or browser settings.

Children

BASAD is intended for people aged 14 and over, and we do not knowingly collect information about children younger than that. The terms set out how minors may order.

Changes to this policy

We will update this page when what we do with information changes, and the date at the top will change with it. A material change will also be shown on the website and in the app.

Contact

RAZ GAZ DELIVERIES LTD, Pardes Meshutaf 37, Ra'anana, Israel

Company number 517367033

erel@raz-gaz.com