Privacy Policy

1. Who is responsible for the data

We are responsible for the account data of the restaurants that use the Platform. A restaurant is responsible for the data of its own customers (their names, numbers and the messages exchanged with them); we process that data on the restaurant's behalf and only on its instructions, to provide the service to it.

If you are a customer who received a message from a restaurant through the Platform, please contact that restaurant first about your data; you can also write to us at [Contact email] and we will help.

2. Data we collect

• Account data: name, email address and password (stored only as a one-way hash we cannot read).
• Business data: name, city, time zone, currency, and team members and their roles.
• WhatsApp connection: the WhatsApp Business Account and phone number identifiers at Meta, and the access token, which we store encrypted.
• The restaurant's contacts: the customer names, numbers, emails and tags a restaurant adds or imports, and whether each has agreed to receive messages or opted out.
• Messages: the text of messages sent and received, and their delivery and read statuses as reported by Meta.
• Templates and images: message template text and the images a restaurant uploads for them.
• Google Business Profile data: locations, reviews, replies and performance statistics, when a restaurant connects its Google account.
• Billing data: subscriptions and wallet top-ups and charges. We do not store card numbers.
• Technical data: IP address and request logs, used to protect accounts from repeated sign-in attempts and to investigate faults, and an audit log of important actions in an account.

3. How we use the data

• To provide the service: sending the messages and campaigns a restaurant asks for, and showing it replies, reviews and statistics.
• For billing: calculating subscriptions and message costs and charging the wallet.
• For security: protecting accounts, preventing abuse and spam, and meeting our legal obligations.
• For support: helping you when you ask us to.

We do not sell data, we do not use it for advertising, and we never message a restaurant's customers for any purpose of our own.

4. Legal bases for processing

Under the EU General Data Protection Regulation (GDPR), we process account holders' data on the following bases:

• Performance of a contract: to create the account, provide the service and bill for it.
• Legitimate interests: to secure the Platform, prevent abuse and improve the service, where this does not override your rights.
• Legal obligation: to keep financial records and respond to lawful requests from authorities.
• Consent: where we ask for it explicitly; you may withdraw it at any time.

We process a restaurant's customers' data as a "processor" on the restaurant's behalf (GDPR Article 28); the restaurant determines the legal basis for messaging them, such as their consent to marketing messages.

5. WhatsApp and Meta

Messages are sent and received through Meta's WhatsApp Business Platform, so their content and the recipients' numbers pass through Meta, which processes them under its own terms and policies.

A restaurant must have its customers' consent before messaging them. Any customer can stop marketing messages at any time by replying "STOP", "unsubscribe" or "إيقاف", or by tapping the unsubscribe button in a message. The Platform records this automatically and sends that customer no further marketing messages from that restaurant.

6. Google user data

When a restaurant connects its Google account we request only: management of its Business Profile (business.manage), to read its locations, reviews and statistics and to reply to reviews when it asks; and its email address and name (email, profile), to identify the connected account.

The Platform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use this data only to provide the Platform features visible to the restaurant; we transfer it only to provide those features, for security, or as required by law; we do not use it for advertising or to train generalized AI models; and no one on our team reads it except with the restaurant's consent, for security, or as required by law.

Google access can be revoked at any time from the Platform, or from the Google account permissions page: myaccount.google.com/permissions.

7. Who we share data with

• Meta: to send and receive WhatsApp messages and manage templates.
• Google: to manage the Business Profile on Google Maps, when connected.
• Google Cloud: where the Platform, its database and uploaded images are hosted.
• Authorities: when the law requires us to.

We share data with no one else.

8. International transfers

Data may be processed outside the country where you live, including outside the European Economic Area: in the United States by Meta and Google, and in the country where the Platform is hosted. When data leaves the EEA we rely on European Commission adequacy decisions (including the EU-U.S. Data Privacy Framework) or on the Standard Contractual Clauses approved by the Commission.

9. How we protect data

• All connections to the Platform are encrypted (HTTPS).
• WhatsApp access tokens are stored encrypted with AES-256-GCM; passwords are stored as bcrypt hashes.
• Each restaurant's data is isolated from every other, and the account owner decides what each team member may do.
• We limit repeated sign-in attempts and record important actions in an audit log.

10. How long we keep data

We keep data for as long as the account exists. When an account is closed we delete its data, or make it impossible to link to anyone, within 30 days — except records the law requires us to keep, such as financial records, which we keep only for the period required (in France, up to ten years for accounting documents).

11. Your rights

Under the EU General Data Protection Regulation (GDPR) and, where they apply, other laws such as the Personal Data Protection Law of the Kingdom of Saudi Arabia, you may ask to access, correct, delete, restrict or port your data, object to its processing, or withdraw your consent. Write to us at [Contact email] and we will reply within one month.

You also have the right to complain to a data protection authority: in France, the Commission Nationale de l'Informatique et des Libertés (CNIL) at cnil.fr; in Saudi Arabia, the Saudi Data & AI Authority (SDAIA).

12. Data deletion requests

For restaurants (account holders):

• Email [Contact email] from the address registered on your account, with the subject "Delete my data", and name the restaurant.
• We will confirm you own the account, then delete the account and its data within 30 days and confirm by email.
• To disconnect the Platform from your Meta account, remove the Platform's app in your Meta Business settings (Business settings → Apps). To disconnect it from Google, use the permissions page mentioned above.

For restaurants' customers:

• To stop messages: reply "STOP" or "إيقاف" to the restaurant's message.
• To delete your data: write to [Contact email] with your mobile number and the restaurant's name; we will delete your data from that restaurant's account within 30 days and let the restaurant know.

13. Cookies and browser storage

We use your browser's local storage to keep you signed in, remember preferences such as language, and keep templates you are writing from being lost. We use no advertising cookies and no third-party trackers. Fonts are loaded from Google Fonts.

14. Children

The Platform is for businesses and is not directed at anyone under 18.

15. Changes to this policy

We may update this policy; the "last updated" date at the top will change. If a change is material, we will tell account holders in the Platform or by email before it takes effect.

16. Contact us

• Company: [Company legal name]
• Registration number: [Registration number (SIRET)]
• Address: [Address]
• Email: [Contact email]