Privacy Policy

1. Our Privacy Philosophy

Mutfaaq helps hospitality businesses create digital menus, manage orders and run their operations. We collect only the data necessary to provide this service, and we never sell your information. Your business data belongs to you.

2. Data Controller

The data controller for information processed through Mutfaaq is:

For privacy-related inquiries, contact contact@mutfaaq.com.

3. Information We Collect

3.1 Account and venue data

When you create an account, we may collect:

• Your name, email address and password
• Venue name, address and contact details
• Menu content, prices, descriptions and images
• Modifier groups and customization options
• Team member names, email addresses and roles

3.2 Order and table data

• Order items, quantities, modifiers and special instructions
• Table assignments and session information
• Order timestamps and status history

3.3 Payment information

Stripe processes payments. We do not store full card numbers, expiry dates or CVVs. We may store the last four digits, billing address, and Stripe customer or subscription identifiers.

3.4 Automatically collected data

• IP address and approximate country or region
• Browser, device and operating system
• Pages visited, features used and time spent
• Referring URL and search terms

4. Guest Data

Guests do not need an account to view a menu or place an order. We collect only the technical data required to serve the menu. Orders are linked to a table session rather than a personal profile. We do not use third-party advertising trackers on guest-facing menu pages.

5. How We Use Your Data

• Provide, maintain and improve the Service
• Process subscriptions and guest payments
• Display menus and process table orders
• Send transactional emails
• Provide support and prevent fraud or abuse
• Analyze aggregate, anonymized usage patterns

6. Legal Basis for Processing

• Contract: providing the Service you use
• Legitimate interest: improving and securing the Service
• Legal obligation: complying with applicable laws
• Consent: where required, including optional marketing

7. Data Sharing

We do not sell your data. We share information only with service providers that help us operate, when legally required, during a notified business transfer, or when you explicitly authorize it.

8. Data Retention

We retain data while your account is active. Following deletion, account and venue data is deleted within 30 days and backups within 90 days. Billing records may be retained where required by law. Anonymous aggregate analytics may be retained indefinitely.

9. Data Security

We use reasonable safeguards including TLS/HTTPS, encryption at rest, secure password hashing, access controls, security reviews and dependency updates. No system is perfectly secure; report vulnerabilities to contact@mutfaaq.com.

10. Your Rights

Depending on your jurisdiction, you may request access, correction, deletion, portability, restriction, or object to certain processing. Contact contact@mutfaaq.com. We aim to respond within 30 days.

11. GDPR Compliance

We are committed to GDPR compliance. Our primary infrastructure is hosted by Infomaniak in Switzerland, which provides data protection safeguards aligned with European standards. Contact us if you need a Data Processing Agreement or wish to reach our data protection contact. You may also complain to the relevant EU supervisory authority.

12. Third-Party Services

We use the following third-party services to operate Mutfaaq:

13. Cookies

We use essential cookies for sessions, authentication and security, plus preference cookies for settings such as language. When you open the Crisp support chat, Crisp may set a functional crisp-client/* cookie to maintain the chat session and conversation history. No Crisp cookie is set before you interact with the chat. We do not use advertising or third-party tracking cookies.

14. International Data Transfers

Our primary infrastructure is hosted in Switzerland by Infomaniak. Some service providers may process data in other countries. Where required, transfers use appropriate safeguards such as Standard Contractual Clauses.

15. Children’s Privacy

Mutfaaq is intended for business users aged 18 or older. We do not knowingly collect personal information from children. Contact us if you believe a child has provided personal data.

16. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or through the Service, and update the date shown above.

17. Contact

For questions about this policy or our data practices, contact contact@mutfaaq.com.