These terms explain how Restu Menu handles guests' personal data on behalf of restaurants. They are part of our Terms of Service and apply to every restaurant account.
Who is responsible for what
- The restaurant is the controller of its guests' data: it decides why the data is collected (for example to prepare an order or reply to feedback).
- Restu Menu is the processor: we store and process that data only to provide the service to the restaurant, following the restaurant's instructions and Saudi Arabia's Personal Data Protection Law (PDPL).
What data we process for restaurants
- Order details: items, table or pickup, time and notes.
- Guest contact details the guest enters: name and phone number.
- Feedback: rating and optional private message.
- The restaurant's customer list built from the above.
What we promise
- We use guests' data only to provide the service, never for our own marketing, and we never sell it.
- Only staff who need access to support the restaurant can see it, and they are bound to keep it confidential.
- We protect it with encryption, access controls and separation between restaurants (see our Security page).
- We tell the restaurant without undue delay if we learn of a data breach affecting its guests.
- We help the restaurant answer guests who ask to access, correct or delete their data.
Sub-processors
We use these providers to run the service: Supabase (database and files, Frankfurt, Germany), Vercel (website hosting), Resend (emails), Upstash (abuse protection), Inngest (background tasks) and Anthropic (AI features such as menu import and translation; menu content only, not guests' details). We will update this list before adding a new provider.
International transfers
Data is stored in the European Union. Some providers may process data in other countries; we use providers with appropriate safeguards, as the PDPL requires.
How long we keep it
We keep guests' data while the restaurant's account is open, so the restaurant has its records. When a restaurant deletes its account, we delete its guests' data, except where the law requires us to keep it longer.
The restaurant's part
The restaurant is responsible for having a valid reason to collect guests' data, telling guests about it (for example through its privacy page on the menu), and handling guests' requests.
Contact
Questions about data processing: hello@restumenu.com.