Privacy Policy

This policy explains what personal data CharZy ("we", "us") collects when you use our power bank rental stations, the CharZy mobile app and this website, why we use it, who receives it, how long we keep it, and the rights you have over it under Jordan's Personal Data Protection Law No. 24 of 2023.

CharZy is the controller of your personal data. Our office is at Methaq Tower, Abdoun Corridor, Amman, Jordan. For anything about your data, write to ten.yzrahc@olleh with "Data protection" in the subject line.

Our Data Protection Officer is Yousef, who can be reached on 67 777 10 97 269+ or at ten.yzrahc@olleh with "Data protection" in the subject line.

When you create an account: your mobile number and, if you give them, your name and email address.

When you rent and return a power bank: which station and unit, the start and end times, where it was returned and what you were charged.

When you pay: card payments are made in our payment provider's own secure screen. We receive a payment reference, the card type and its last four digits, never the full card number, and we record your agreement to be charged.

When the app connects to our servers: your device model, operating system, app version, IP address and, if you allow notifications, a push-notification token.

When you contact us: the content of your messages, including website enquiries (the name, email address, phone number, company or venue, and message you enter in our contact or partner forms).

When the app crashes or hits an error: a crash report with your device model, operating system, app version, the error itself, and the screens you opened and features you used leading up to it. Crash reports do not include your name, mobile number or email address. The app contains no advertising or analytics tools.

If you allow it, the app uses your phone's location to show nearby stations and give directions. Your location is used on your phone and by the map provider named below to draw the map; it is not sent to or stored on our servers.

You can withdraw this permission at any time in your phone's settings, and the app keeps working: you simply search the map yourself. The app does not use your location in the background.

Our website is built to work with as few cookies as possible. The only cookie we set ourselves is "charzy-locale", which remembers whether you chose English or Arabic for up to 12 months. It is strictly necessary for that preference and contains no personal data.

Where we use Google Analytics, its cookies ("_ga" and "_ga_<ID>", lasting up to 13 months) are set only if you choose "Accept analytics" in our cookie banner. If you choose "Essential only", or make no choice, no analytics cookies are set. Your choice is stored in your browser's local storage ("charzy-consent-v1") so that we do not ask again.

You can change your choice at any time with "Cookie settings" at the bottom of every page, and you can delete or block cookies in your browser settings. Blocking cookies does not stop you from using the website or renting a power bank.

We use Cloudflare Web Analytics to understand how many people visit the website and which pages they view. It sets no cookies, uses no local storage and does not fingerprint your device. Cloudflare processes your IP address and request details (page viewed, referring site, browser and device type, approximate country) to produce aggregated statistics, and does not use this data to follow you across other websites.

We may also use Google Analytics 4, provided by Google Ireland Limited and Google LLC. It runs only after you give consent. When it does, it collects the pages you view, time on page, the site that referred you, your device and browser type, approximate location derived from your IP address (Google Analytics 4 does not log or store IP addresses) and a random identifier held in its cookies. We keep Google signals and all advertising features switched off, and analytics data is retained for 14 months. Google may process this data in the United States under the EU-US Data Privacy Framework and standard contractual clauses.

We use analytics only in aggregate, to improve the website. We never use it to identify individual visitors, for advertising, or to sell data. You can withdraw consent at any time with "Cookie settings", or install Google's opt-out browser add-on from tools.google.com/dlpage/gaoptout.

Our pages carry Open Graph and similar metadata (a title, a description and a preview image) so that when someone shares a link to our website on WhatsApp, Facebook, Instagram, X, LinkedIn, Telegram or iMessage, the app can show a preview card. To build the card, that platform's servers fetch this public information from our website. No personal data about you is involved, and we do not track who shares or opens a link.

We do not place social media buttons, pixels or tracking tags on our website. When you follow a link to a social platform, that platform's own privacy policy applies.

To provide the service: creating your account, unlocking power banks, running and closing rentals, and charging you correctly. Without this data we cannot provide the service.

To keep you informed: service notifications about your rentals, returns and charges, which cannot be switched off while a rental is open; and offers and promotions only if you turn them on in the app's notification settings, which you can undo at any time.

To support you: answering questions, investigating failed rentals and issuing refunds.

To fix problems: using crash reports to find and correct errors in the app.

To run and protect the network: keeping stations stocked and working, preventing fraud and abuse, and keeping our systems secure.

To improve the service: analysing rental and station records in aggregate (for example, which stations run short of power banks) to plan the network.

We rely on your consent, which you give when you create an account and can withdraw at any time, and where the law allows, on what is necessary to perform our agreement with you, to meet a legal obligation, or to protect the service from fraud and misuse.

Hostinger (Hostinger International Ltd.): hosts our servers and database in Düsseldorf, Germany. It stores all the account, rental, payment and device data described above.

Cloudflare (Cloudflare, Inc., United States; global network): carries all traffic between you and our app servers and websites, so it sees IP addresses and request contents in transit. It also stores our encrypted backups in Western Europe, hosts our email (messages you send to our @charzy.net addresses and our replies are stored in Europe), and provides our cookieless website analytics.

Google Firebase Cloud Messaging (Google LLC, United States): delivers push notifications. It receives your device's notification token and the text of the notification.

Google Maps (Google LLC, United States): draws the map in the app. Your phone contacts Google directly, sending your IP address, the map area you view and, if you allow it, your location.

OpenFreeMap: supplies the map on phones without Google Play services. Your phone contacts it directly and it receives your IP address and the map area you view. If OpenFreeMap cannot be reached, the app draws the map from OpenStreetMap (OpenStreetMap Foundation, United Kingdom) instead, which receives the same information.

Sentry (Functional Software, Inc., United States): receives the app's crash reports so we can fix errors. Its data is stored in the European Union (Germany), and it does not store your IP address.

WhatsApp (Meta Platforms, Inc., United States): delivers your sign-in codes. It receives your mobile number and the one-time code.

Our card payment provider: a licensed payment gateway that processes your card details, the cardholder name and payment amounts in Jordan to take, hold and refund payments. We will name the provider here before card payments start.

Venue partners who host a station see only aggregate figures, such as how many rentals their station produced, never who rented. We do not sell your personal data or share it for advertising.

We may disclose data when a court, the public prosecution or another competent Jordanian authority requires it, or when needed to establish or defend a legal claim.

Our servers are in Germany, and several of the providers above process data in the United States and other countries. The protection given to personal data in those countries may be lower than under Jordanian law.

We therefore transfer your data abroad only with your consent. By accepting this Privacy Policy when you create an account, you consent to your data being transferred to and processed in the countries and by the recipients described in this section and in "Who receives your data", and you acknowledge that data protection there may be lower than under Jordanian law. Card payments are processed in Jordan and are not transferred abroad. Before using any provider we check the protection it offers, and each provider may use your data only to deliver its service to us.

You can withdraw this consent at any time, but we would then be unable to provide the service and would close your account.

You can delete your account at any time in the app, under You → Account → Delete my account. We confirm the request with a one-time code sent to your mobile number, and the account is deleted immediately. You can also ask us to do it by writing to ten.yzrahc@olleh or through support in the app.

We cannot delete an account while a power bank is still out on rental, while a rental's charge is still being settled, or while a payment, hold, refund, payment review or dispute on it is still open. Return the power bank or wait for the open item to settle, then try again.

Erased immediately: your name, mobile number, email address and the devices registered to your account, which also signs you out everywhere.

Kept, separately from your identity: your rental and payment records, for 10 years after the end of the financial year they belong to, as Jordan's Commercial Law requires; evidence of card payments (your agreement to be charged and transaction references), for 15 months; and a one-way fingerprint of your mobile number, which cannot be turned back into the number, for as long as those records, used only to handle disputes and to stop welcome offers being claimed twice.

Our encrypted backups are not edited, but they expire on a fixed schedule, so your erased details are gone from every backup within 180 days.

You can sign up again later with the same mobile number. It will be a new account: your previous rentals, receipts and settings are not restored, and welcome offers you already used cannot be claimed again.

Account details (mobile number, name, email): for as long as your account is open, and erased immediately when you delete it (see "Deleting your account" above). Your rental and payment records are then kept separately from your identity, as described below.

After deletion we keep only a one-way fingerprint of your mobile number, which cannot be turned back into the number. It is used only to stop welcome offers being claimed twice and to handle disputes about past rentals, and is kept for as long as the rental and payment records it relates to (see below).

Devices registered for notifications: until you sign out, or after 90 days without use.

Notifications we have sent you: 90 days.

Rental and payment records: 10 years after the end of the financial year they belong to, as Jordan's Commercial Law requires. After a year's accounts are closed, its records are moved out of our live systems into an encrypted archive that only authorised staff can open, and each year's archive is deleted automatically when its 10 years end.

Card payment evidence (your agreement to be charged and the transaction references): 15 months.

Sign-in code records: up to 90 days.

Crash reports: 30 days.

Server logs, which contain IP addresses and device details: 30 days.

Security and audit logs of staff access: up to 2 years.

Backups: encrypted daily backups are kept for 35 days and monthly backups for 180 days, so data deleted from our systems is gone from every backup within 6 months.

Support cases and messages: 13 months after the case is closed. Website enquiries: up to 24 months after our last correspondence with you.

Some records cannot be deleted on request because the law requires us to keep them; if that applies, we will tell you.

All connections to our app servers and websites are encrypted (TLS) and enforced with HSTS. Our servers accept web traffic only through Cloudflare's network.

Card numbers are entered in the payment provider's secure screen and never reach our servers.

Backups are encrypted before they leave our server, and the key to decrypt them is kept offline.

Only named staff can access our systems, each with multi-factor authentication, and every access is recorded in an audit log.

No system is perfectly secure. If a breach could cause you significant harm, we will tell you within 24 hours of discovering it, explaining what happened and what you should do, and we will notify the Personal Data Protection Unit within 72 hours.

We do not profile you, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automatic steps in the service, such as ending a rental when a power bank is returned or applying the lost power bank fee after 24 hours, follow the published rules in our Terms of Service, and you can ask a person to review any of them.

Under Jordan's Personal Data Protection Law you have the right to:

1. Know and access the personal data we hold about you and get a copy of it.

2. Withdraw your consent at any time. This does not affect what we did before, and withdrawing consent needed to run the service means closing your account.

3. Have inaccurate or incomplete data corrected, completed or updated.

4. Have your data restricted (hidden from use) while a question about it is resolved.

5. Have your data erased when it is no longer needed or you withdraw consent, except where the law requires us to keep it.

6. Object to processing that is not necessary for the purposes it was collected for.

7. Receive your data, or have it sent to another controller, in a structured, commonly used format.

8. Be told of any breach affecting your data, as described above.

Exercising these rights is free and carries no financial or contractual penalty.

To exercise a right or make a complaint, write to ten.yzrahc@olleh with "Data protection" in the subject line, or use support in the app. To protect your account, we confirm your identity with a one-time code sent to your registered mobile number.

We acknowledge every request or complaint within 7 days and give you a full answer within 30 days. If we need longer, we will tell you why.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship.

The service is intended for adults. A person under 18, or who otherwise lacks full legal capacity, may use it only with the consent of a parent or legal guardian, as set out in our Terms of Service. If we learn that we hold personal data about such a person without that consent, we will delete it. If you believe this has happened, contact us.

Our website and app may link to other sites and services. This policy does not cover them, and we are not responsible for their content or privacy practices.

We will tell you about material changes in the app or by email before they take effect. If a change means using your data for a new purpose or sharing it with a new kind of recipient, we will ask for your consent again. The version and effective date of this policy are shown on this page.

This policy is governed by the laws of the Hashemite Kingdom of Jordan, including Personal Data Protection Law No. 24 of 2023, and the courts of Amman have jurisdiction over any dispute arising from it.