Privacy policy

This policy explains what data the Al Tazaj apps and website collect, why, who it is shared with, and how you control it. One policy covers all three apps and this website:

1. Who is responsible

Al Tazaj is run by Al Tazaj restaurant in Riyadh, Saudi Arabia; its owner, Abdullah Albadi, is responsible for the data described here. Privacy questions: abdullah.sa.albadi@gmail.com.

2. Data we collect

Customers (Al Tazaj app)

• Account: name, mobile number, email, and password (stored hashed — nobody can read it), plus one-time sign-in codes if you sign in with a code.
• Addresses: the address text and the map pin you set for each saved address.
• Orders: items, sizes, add-ons and notes, amounts and VAT, payment method, status and dates; how you collect it (delivery, pick-up at the restaurant, at your car, or at a table by its code), the time you choose if you order for later, your instructions for the door, and a description of your car if you choose pick-up at the car.
• Messages: what you exchange with the driver about an order, and the photos you choose to send in it from the camera or your photo library. The app reaches the camera or your photos only when you pick one to send.
• Ratings: your rating of the driver after a delivery (stars and an optional comment), and the driver's rating of the delivery with you.
• Loyalty: loyalty points earned and spent.
• Device: a push-notification token and the platform (iOS or Android), to notify you about your orders. Your favourites are kept on your account so you find them on any device; your language, theme and recent searches stay on your device.

Delivery drivers (Tazaj Driver app)

• Application and account: name, mobile number, email, vehicle type and password (hashed).
• Location while working: your current location only while you are “online” — see section 3.
• Deliveries: orders you accepted and their status, proof of delivery (recipient name or delivery code), and the reason when a delivery fails.
• Messages and ratings: the messages and photos you exchange with the customer about an order, your rating of the customer after a delivery, and the customer's rating of you.
• Earnings and cash: delivery fees owed, withdrawal requests, and cash collected from customers and handed in to the restaurant.

Restaurant staff (Tazaj Manager app)

• Account: name, email, mobile number, password (hashed), role and permissions, and a push token. Staff accounts are created by the restaurant owner; there is no public sign-up.
• Audit log: sensitive management actions (such as changing an order, a product or a staff member) are recorded under the name of whoever made them.
• Photos: pictures a staff member picks from their photo library or takes with the camera (dish and category photos, the restaurant logo, offer banners) are uploaded so they appear in the apps. The app reaches no other photo.
• What staff can see: the app shows staff the customer, driver, order and payment records their work needs, each within their permissions only. Those records are described above; the manager app collects nothing new about them.

3. Location

• Customers: the app reads your device location only while you add a new address, and only while the app is open: the map opens where you are if you allowed it, and “My location” takes you back there, to put the delivery pin where you are. You can refuse the permission and place the pin by hand instead.
• Drivers: your location is sent while you are “online” and the app is open, so the restaurant can see available drivers and the customer can see you on the map while you deliver their order. The app does not ask for background location, and sending stops when you go offline.
• Restaurant staff: the manager app never asks for location.
• You can withdraw location permission at any time in your device settings.

4. Payments

Available payment method today: cash on delivery. The system does not collect or store any banking details. If another payment method is added later, we will update this policy first.

5. How we use data

• To prepare your order, deliver it to your address, and tell you its status.
• To let the driver and the restaurant contact you about your order.
• To run your account and loyalty points, and to pay drivers.
• To run the restaurant: receive and prepare orders, manage the menu, offers and staff, and follow sales.
• To protect the service from misuse, fix problems and answer your questions.
• To meet legal obligations, including keeping sales and VAT records.

6. Who we share it with

• The driver delivering your order sees your name, mobile number, delivery address, the items and the amount to collect, for the duration of the delivery.
• Restaurant staff (through Tazaj Manager) see orders and the contact details needed to fulfil them (including the car description for pick-up at the car), drivers' details and earnings, and the ratings customers and drivers give each other, each within their permissions. Restaurant staff do not see the messages between a customer and a driver.
• Service providers we rely on:

  Provider	Purpose
  Hostinger	Hosting the server and database.
  Google (Google Maps)	Maps and address lookup in the apps. Map requests go to Google under the Google Privacy Policy.
  Firebase Cloud Messaging (Google) and Apple Push Notification service	Delivering order notifications to your device using its push token.

• We may disclose data when a competent authority requires it under applicable law.

7. How long we keep it

• Account data is kept while your account exists.
• When you delete your account, your personal data (name, mobile, email, addresses, locations, push tokens) is erased, together with the messages and photos you sent in chats, the comments on your ratings, your favourites, and the car description and door instructions on your orders; sign-in is disabled permanently.
• Order, payment and VAT records keep their amounts for accounting and for as long as the law requires, but without anything linking them to you. The stars of your ratings stay, without the comment, because they count towards the other side's average.

8. Your rights and deleting your account

• Access and correction: see and edit your account details in the app (Account → Profile), or ask us for a copy.
• Delete your account:
  • Al Tazaj: Account → Delete account.
  • Tazaj Driver: Settings → Delete account.
  • Tazaj Manager: the restaurant owner switches a staff account off when the job ends, which signs it out of every device at once; staff can ask us to delete their data.
  • Or see Delete your account for any of the three apps.
• Notifications and location: turn them off at any time in your device settings.

We process your data under the laws in force in Saudi Arabia, including the Personal Data Protection Law. Questions or requests: abdullah.sa.albadi@gmail.com.

9. Security

Data travels between the apps and the server encrypted (HTTPS), passwords are hashed so they cannot be recovered, your sign-in session is kept in your device's secure storage, and staff access is limited to their permissions. No protection is perfect; if an incident affects your data we will tell you as the law requires.

10. This website

The website uses no cookies and no analytics. Your browser stores your dark-mode choice locally. The hosting server records the usual connection data (IP address, browser type, time of request) for security.

11. Children

Our services are not aimed at children, and we do not knowingly collect data from anyone under 18 without a guardian's consent.

12. Changes and contact

If we change this policy we update the effective date above, and tell you in the app when the change is significant. Contact: abdullah.sa.albadi@gmail.com.