Who we are
menup.me is a software platform operated by Digital Software Co. ("menup", "we", "our"). We provide restaurants with menu, ordering, payments, and customer-experience tools. This Privacy Policy explains what Personal Data we collect when you use the platform — whether as a restaurant owner, an employee, a guest diner, or a casual visitor.
We are committed to handling your Personal Data in line with the Sultanate of Oman's Personal Data Protection Law (Royal Decree No. 6/2022) and equivalent international standards.
What we collect
We only collect what we need to run the platform. The categories of Personal Data we collect depend on how you use menup:
- Account data — name, email, phone, password hash (via Firebase Authentication), and language preference.
- Restaurant data — for restaurant operators: business name, address, working hours, payment provider account references, and uploaded menu content.
- Order data — for diners: items ordered, delivery address (if applicable), special instructions, the table you scanned, and order timestamps.
- Payment metadata — we do NOT store full card numbers. Payment providers (PayPal, and Stripe where available) handle card data directly. We retain only the provider transaction reference, last four digits of the card (where the provider exposes them), and amount.
- Device & log data — IP address, browser user-agent, and request timestamps, kept in operational logs for security and abuse prevention.
- Cookies — see "Cookies & similar technologies" below.
How we use your data
We use Personal Data only for the purposes you would reasonably expect from a restaurant ordering platform:
- To create and operate your account, take and fulfil your orders, and process payments.
- To send order receipts, status updates, and (with your opt-in) push notifications.
- To prevent fraud and abuse — for example, rate limiting accounts that submit thousands of requests.
- To improve the product — we look at aggregated usage patterns (e.g. how many orders flow through the kitchen display per hour) but never sell or share your individual order history with third parties.
- To respond to legal requests where we are obliged to do so under Omani law.
Who we share it with
We share Personal Data only with service providers that make the product work. Each is bound by a Data Processing Agreement that limits them to the scope below. We do not sell Personal Data.
- Firebase / Google — authentication (we hand them email + password during sign-in only).
- PayPal — payment processing for online card and PayPal-wallet orders. They receive only the amount, currency, your email, and an order reference.
- Stripe — same scope as PayPal, applies only when Stripe Connect is enabled for your region.
- Cloudflare — traffic routing, DDoS protection, and image CDN. Cloudflare sees request headers and IP only.
- Restaurants whose menus you order from — when you place an order, the restaurant's staff see the order details (items, customer name, phone, address) to prepare and fulfil it. This is unavoidable for the service to work.
Your rights
Under Oman's PDPL and applicable international law you have rights over your Personal Data. We honour all of them:
- Access — request a copy of the Personal Data we hold about you.
- Correction — ask us to fix data that is inaccurate or out of date.
- Erasure — close your account and have your Personal Data deleted, subject to retention obligations (e.g. completed orders we have to keep for tax records).
- Objection — tell us to stop processing your data for marketing or any non-essential purpose.
- Withdraw consent — for anything we asked you to opt into (push notifications, marketing emails) at any time, without affecting the lawfulness of prior processing.
- Lodge a complaint — with the competent Omani authority if you believe we have not handled your rights properly.
How long we keep it
We keep Personal Data only as long as we need it to run the service. Specifically: account data while your account is active and for 12 months after closure; order data for 7 years (Oman tax record retention); operational logs for 90 days; payment metadata as required by the payment provider and Omani financial regulations.
Where we store it
menup.me runs on infrastructure located in the European Union and protected by Cloudflare's global edge. We have not yet completed migration to Oman-hosted infrastructure. Any cross-border transfer of Personal Data is performed under appropriate safeguards (Standard Contractual Clauses with our processors, encryption in transit and at rest).
Security
We protect Personal Data with industry-standard controls: TLS 1.2+ for all traffic; encryption at rest for the database; HttpOnly + Secure cookies for sessions; least-privilege access for staff; an audit log of every administrative action. No system is impenetrable — if a breach involving your data ever occurs, we will notify you and the relevant authority within 72 hours as PDPL requires.
Cookies & similar technologies
We use a small number of cookies, all strictly necessary or functional:
- Session cookie (HttpOnly, Secure) — keeps you signed in for up to 7 days after login.
- Guest cookie (HttpOnly, Secure) — identifies an anonymous diner so their cart survives a page refresh and the order page loads after checkout.
- Locale cookie — remembers your language choice (en / ar / fa).
- Theme cookie — remembers your dark / light mode choice.
Children
menup is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has provided us with Personal Data, contact us and we will delete it.
Changes to this policy
We will update this page when we change how we handle Personal Data. Material changes will be notified to account holders by email before they take effect. The "Last updated" date at the top tells you when the current version came into force.
Contact us
For any privacy question or to exercise the rights above, email [email protected]. We respond within 30 days as PDPL requires.