Privacy Policy

This page explains what data the Al-Medhyaf Al-Arabi Restaurants & Kitchens Company for Catering platform ("Al-Medhyaf Al-Arabi") collects, why we collect it, who we share it with, how long we keep it, and the rights the Saudi Personal Data Protection Law gives you. Last updated: 6 September 2026.

1. Who we are The operator of this service and the controller of your data is Al-Medhyaf Al-Arabi Restaurants & Kitchens Company for Catering, based in Makkah, Saudi Arabia, unified national number 7009513792. This policy covers the ordering app, the website, the point-of-sale terminals in our branches, and the driver and kitchen apps our staff use.

2. What we collect Mobile number. It is your identity with us: you sign in with your number and a one-time code sent by SMS. There is no password anywhere in the system. Name. Asked for at your first sign-in. Email address. Entirely optional. If you add one we send it a verification link, and an unverified address receives nothing from us except that verification. Addresses. The address text you write, plus the map pin's coordinates (latitude and longitude), the district, and any note you leave for the driver. Order history. Items, quantities, preparation notes and amounts, together with the delivery address as it was at the time of the order. Vehicle details. On car-pickup orders only, and all optional: model, colour and plate number. Saved cards. See section 4 — we do not store your card number. Loyalty points balance and the transactions behind it. Your reviews after delivery: stars, tags and any written comment. Push notification tokens for your device, if you allow notifications in our mobile apps, used only to deliver them. A record of messages sent to you: the channel, the outcome, and the address it went to.

3. Location We do not track you. The app uses your device's location in two situations only, and asks each time: to suggest the branch nearest to you, and to place your delivery pin on the map. It does not run in the background or after you close the app. Delivery drivers are different: their location is recorded while a delivery is in progress, never while they are off shift, and that trail is deleted after seven days.

4. Payment cards We do not store your card number or its security code (CVV) anywhere in our systems. Where card payment is available, the details are entered with our payment provider directly, and all that reaches us is a secure token, the card scheme, the last four digits and the expiry date — which is all you see under "Saved cards". The charge itself is made by the payment provider, not by us.

5. Why we use this data To fulfil your order: preparing it, delivering it, contacting you about it and invoicing it. To run your account: signing you in, your saved addresses, your order history and your loyalty points. To meet our legal obligations: tax invoicing and keeping accounting records. To improve the service: measuring kitchen performance and preparation times, and reading reviews and handling complaints. For marketing and measurement: see section 7.

6. Who we share it with We do not sell your personal data to anyone. We share it only as narrowly as running the service requires: Our SMS provider — your mobile number and the message, for every sign-in code. Google Firebase — your device token and the notification text, where you have enabled push notifications. Our payment provider, where card payment is available — card details are entered with them directly; the order amount and its reference reach them. Mapping services — for address lookup and displaying the map. Our cloud storage provider — for uploaded images, such as proof-of-delivery photos. The driver assigned to your order — your name, mobile number and delivery address, for the duration of that delivery only. The advertising measurement networks named in section 7, where they are enabled. We may also disclose data where a law or a competent authority requires it.

7. Cookies and measurement We use local storage in your browser for strictly operational things: keeping you signed in, remembering the branch you chose and your interface language, and keeping your conversation with the assistant on your own device. We may also use advertising measurement tools from Meta, TikTok, Snapchat and Google Analytics to understand how our campaigns perform. Where they are enabled, the browsing and purchase events sent to them do not include your name, mobile number, email address or delivery address, and IP anonymisation is enabled for Google Analytics. You can control ad tracking from your device or browser settings.

8. The assistant If you message the assistant in the app or on the website, we keep the conversation for ninety days to improve the service and follow up on orders, after which it is deleted. Please do not send sensitive information to it, and note that the assistant will never ask you for your card details.

9. How long we keep things Sign-in codes: deleted within 24 hours. A driver's location trail during a delivery: seven days. The record of messages sent: ninety days. Assistant conversations: ninety days. A deleted account: thirty days, then permanently de-identified — see section 10. Invoices and financial records: kept for as long as tax and accounting law requires.

10. Deleting your account You can delete your account from within the app, confirmed by a code sent to you by SMS. The moment you confirm, the account is deactivated and every one of your sessions is revoked on every device. After thirty days your data is de-identified permanently and irreversibly: your name and mobile number are replaced with placeholders, your email address is cleared, your addresses are erased and removed, your saved card tokens are deleted, your favourites are detached, your review comments are blanked, and your name, mobile number, delivery address, its coordinates and your vehicle details are stripped from your past orders. What remains afterwards — and no longer identifies you — is the financial record of your orders and their invoices for tax purposes, proof-of-delivery photos, the loyalty ledger, and star ratings without their comments, because those feed our drivers' average ratings.

11. Your rights The Personal Data Protection Law gives you the right to: access the data we hold about you and obtain a copy of it, have inaccurate data corrected, request its destruction, withdraw consent where our processing rests on consent, and lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA). To exercise any of these, reach us through the "Contact us" page in the app or at support@almedheaf.com. We may ask you to verify your identity first, to protect your account.

12. Security All data travels over an encrypted connection, access to customer data is limited to the staff whose work requires it and is governed by defined permissions, and sensitive administrative actions are written to an audit log. That said, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children's privacy The service is not directed at anyone under eighteen and we do not knowingly collect their data. If you believe a minor has created an account, contact us and we will delete it.

14. Transfers outside the Kingdom Some of the providers named in section 6 may process data outside Saudi Arabia, subject to the conditions required by the Personal Data Protection Law and its implementing regulations.

15. Changes to this policy We may update this page; the date at the top shows when it last changed. Where a change is material we will tell you in the app or through the contact details we hold for you.

16. Contact us For any question about your privacy or your data: the "Contact us" page in the app, support@almedheaf.com, or +966 55 685 0720.