Privacy policy

The public site (ishtirak.me)

You can use the tariff page and the bill checker without an account. The bill checker runs in your browser; the numbers you type are not sent to us.

The site sets no cookies and uses no analytics or advertising trackers.

Like any website, our hosting provider (Cloudflare) processes your IP address and basic request details to deliver the pages and protect them from attacks. The page font is loaded from Google Fonts, so Google also receives your IP address when you open a page.

The app (app.ishtirak.me): what we collect

From your Google account, when you sign in with Google: your name, email address and Google account ID. We ask for nothing else: no contacts, no Gmail, no Drive, no files.

What you enter about your business: business name and contact phone number.

What you enter about your subscribers: names, mobile numbers, addresses, the service and package, meter readings, bills and whether they are paid.

Plan payments: the plan and amount you chose and your payment reference code. You pay through Whish; we never see or store your Whish, card or bank details.

Technical data: a session record (a hashed token and its expiry) so you stay signed in, and request logs kept by Cloudflare for security and troubleshooting.

How we use it

Only to run the service: sign you in, store your subscribers and bills, calculate generator bills at the official tariff, build the WhatsApp messages and bill links you choose to send, manage your plan, and keep the service secure (for example rate limits and bot checks).

We do not sell personal information, do not use it for advertising, and do not send messages to your subscribers. WhatsApp messages are sent by you, from your own WhatsApp, when you tap “Send on WhatsApp”.

Ishtirak’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your subscribers’ information

For the subscriber data you enter, you (the operator) decide what is collected and why; we store and process it on your behalf, only to provide the service to you. You are responsible for having your subscribers’ agreement to keep their details and to contact them on WhatsApp.

A bill link (for example app.ishtirak.me/i/…) shows one bill to anyone who has the link, without signing in: business name and phone, subscriber name, month, service, readings and amounts. Links are long random codes that cannot be guessed, and they are excluded from search engines. Share them only with the subscriber concerned.

Cookies in the app

Only cookies needed for the app to work: a session cookie that keeps you signed in (up to 30 days, removed when you sign out), a short-lived cookie used during Google sign-in (10 minutes), and a cookie that remembers your language (1 year).

The “I’m not a robot” check on the sign-in page is Cloudflare Turnstile, which processes information about your browser to tell people from bots.

Who processes data for us

Cloudflare: hosting, database, security and bot checks. Google: sign-in and fonts. Whish: plan payments, under its own terms. We share personal information with no one else, unless the law requires it.

Data is stored by Cloudflare. Its network is global, so data may be processed outside Lebanon.

How long we keep it

Your account, subscribers and bills are kept while your account exists. Sessions are deleted automatically when they expire.

To delete your account and all its data, email support [at] ishtirak.me from the address you sign in with. We delete it within 30 days, except what we must keep by law.

Your choices and rights

You can see and edit your business and subscriber data in the app at any time. To get a copy of your data, correct something you cannot edit, or delete your account, email support [at] ishtirak.me. You can also remove Ishtirak’s access to your Google account at any time from your Google Account settings (Security → Third-party connections).

Security

Connections are encrypted (HTTPS only). Sign-in uses Google with protection against forged requests; session tokens are stored only in hashed form; each operator can only ever see their own data. No system is perfectly secure; if we learn of a breach affecting you, we will tell you.

Children

The app is for businesses and people aged 18 or over.

Changes

If we change this policy, we update it here and change the date below. For important changes we will also tell signed-in users in the app.