Privacy Policy
This policy explains the personal data tawlah handles when you use it inside a venue, why we handle it, and the rights you have over it under Saudi Arabia’s Personal Data Protection Law and the equivalent laws that apply elsewhere.
Who we are
tawlah is a thin ordering and online-payment layer that a guest uses on-site after scanning a venue’s QR code. It is not a reservations or booking service · it simply carries your order from your phone to the venue you are seated in.
Our role depends on whose data it is. For a guest’s ordering data at a venue — your chat, cart, and order — the venue is the controller (it decides why the data is collected during your visit) and tawlah acts as its processor, handling that data on the venue’s behalf. For a restaurant owner’s own account (email, name, phone, sign-in) tawlah is the controller. Either way, the venue you order from is responsible for preparing and serving your order.
What data we collect
The messages you send in the ordering chat, your order and payment records, a device identifier that keeps your session and cart together, and an optional phone number if you choose loyalty rewards or leave a review.
We ask for no more than the order needs, and we do not collect sensitive identity data.
Why we collect it
To take and fulfil your order, to process your payment, to personalize offers and remember your preferences, and to improve the service. We do not use your data for any other purpose without telling you.
Legal basis and consent
We rely on your consent, captured when you start a chat after scanning the QR code at your table, and on our legitimate interest in delivering the order you asked for and meeting legal obligations.
Your consent is optional and you can withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Who we share it with
The venue you ordered from, so it can prepare and serve your order.
A small, named set of service providers that process data on our behalf, each under a data-processing agreement: Moyasar (a Saudi payment provider) to take and reconcile your payment, without ever storing your full card number; Google Vertex AI / Gemini to run the AI ordering assistant over the minimized chat text (we do not send full order or identity data); ZATCA — the Saudi tax authority’s Fatoora e-invoicing system — to issue the tax invoice, as a legal obligation; and an S3-compatible object-storage provider for encrypted backups.
We never sell your personal data, and we do not share it for advertising.
How long we keep it
We keep each kind of data only as long as it is needed, then delete or anonymize it, on the following schedule:
Guest sessions: pruned shortly after your visit — idle after 90 minutes, and no later than 6 hours.
Ordering chat: kept for 365 days, then purged.
Orders, payments, and tax invoices: kept for the statutory accounting and tax period; if you ask us to erase your data we sever the link to you but keep the lawful business record.
Security, rights-request, and data-breach logs: kept long-term as security and compliance evidence.
Your rights
Under Saudi Arabia’s Personal Data Protection Law (PDPL) and equivalent laws elsewhere, you can access your data, correct it, export it, delete it, and withdraw your consent at any time.
To exercise any of these rights, email [email protected] and we will respond within the period the applicable law allows.
Serving many countries
tawlah operates across several countries. We follow the PDPL inside the Kingdom of Saudi Arabia, and the equivalent data-protection law of every country where the venue you order from operates.
Contact
For any question about this policy or your data, email [email protected].
This policy is current as of the date above; its final wording is pending review by our legal counsel and may be updated.