Data Controller

The data controller is قصة F&B — operator of the Ali Food platform, commercial registration No. 7054007310, Al Khobar — Eastern Province, Saudi Arabia. For any question about your personal data, or to exercise your rights under the Personal Data Protection Law (PDPL), contact us at privacy@alifood.co.

Our Role: Controller or Processor

We are the controller of your account and subscription data (the owner and the restaurant team as platform users). For the data a restaurant enters about its guests and employees (orders, reservations, loyalty, online ordering, HR and payroll), the restaurant is the controller and we process it on its behalf and only on its instructions — never for any other purpose. Guests and employees should send requests about their data to the restaurant first, and we help it fulfil them.

Data We Collect

We collect information you provide directly at signup: restaurant name, email, mobile number, commercial registration number, and tax information required by the Saudi Zakat, Tax & Customs Authority (ZATCA). We also log operational data generated by your use of the platform: order activity, payments, e-invoices, and login records. When you fill in the "Get started" form we receive your name, phone, restaurant name and anything else you choose to add (email, city, branch count, message). Depending on the add-ons a restaurant turns on, we also process:

Restaurant guests — QR menu and online ordering: name and phone (and an address for delivery orders) stored with the order.
Restaurant guests — reservations and waitlist: name, phone, party size and notes, to send confirmations and reminders.
Restaurant guests — loyalty: phone number, points balance and history, and rewards used. Joining loyalty does not mean consenting to marketing messages.
Restaurant employees — HR & payroll: employee details and contact info, attendance and schedules, leave and requests, documents, salary components and deductions, and IBAN and national ID / iqama number (stored encrypted) to prepare payroll, the Mudad file and end of service.

How We Use Your Data

Data is used exclusively to operate the platform: to issue ZATCA-compliant (Phase 1) tax invoices, to show you performance reports for your own restaurant (these reports are yours alone), to run the add-ons a restaurant turns on (such as booking and order confirmations, loyalty points and payroll), and to send essential operational notifications. We do not sell data and do not share it with third parties for marketing or advertising.

Security

All data is encrypted in transit over the network using TLS 1.3 and encrypted at rest at the database-provider level (AES-256), and sensitive employee data (IBAN and ID number) is additionally encrypted inside the application. Passwords are bcrypt-hashed at 12 rounds. We apply rate limiting and temporary account lockout against password-guessing attempts. Each restaurant's data is isolated from every other restaurant at both the application and database level. Every sensitive action (permission changes, data deletion, settings edits) is recorded in an audit log with who did it and when.

Data Location & Cross-Border Transfer

Platform data is currently hosted in the European Union, not inside the Kingdom: the API server runs on Railway in the Netherlands and the database on Neon in Frankfurt, Germany. When the AI assistant add-on is used, questions are processed by Anthropic outside the Kingdom. This involves transferring personal data outside the Kingdom of Saudi Arabia, which we do under the cross-border transfer provisions of the Personal Data Protection Law (PDPL) and its implementing regulations, and only to the extent needed to run the service. We choose providers that comply with the EU General Data Protection Regulation (GDPR); any security attestations (such as SOC 2) are the providers' own, not certifications of Ali Food.

Service Providers (Sub-processors)

We use the following service providers to run the platform; each processes data only as needed for its role:

Railway — API server hosting (EU, Netherlands — region europe-west4).
Neon — PostgreSQL database (Frankfurt, Germany).
Vercel — hosting for the website and dashboard front-ends (Frankfurt).
Upstash — cache (Redis) and job queues.
Cloudflare — CDN, DNS, bot protection (Turnstile), and file storage (R2) for things like item images and logos.
Resend — operational email delivery (staff invites, reminders, reports).
Anthropic — processes questions for the AI assistant add-on ("Ask about your sales") only when it is turned on: the question text and aggregated sales figures are sent, without guest names or phone numbers and without employee names or salaries.
Meta (WhatsApp Business — WhatsApp Cloud API) — only if a restaurant connects its own WhatsApp Business account: sends order and booking confirmations and reminders to its guests from the restaurant's number, including the guest's phone, name and order or booking details.
Sentry — error monitoring, with personal data scrubbed before sending where possible.
PostHog (EU servers) — product usage analytics, loaded only after you accept analytics cookies. Includes session recording with everything typed into form fields masked.
Google Analytics — website traffic analytics, loaded only after you accept analytics cookies.

Data Retention

We keep data while the account is active and only as long as its purpose requires:

Account and operational data: for the life of the subscription, and deleted after the account is closed on request, except what the law requires us to keep.
Tax invoices: for the period required by ZATCA (5 calendar years).
Reservations: the guest's name, phone and notes are erased automatically 12 months after the booking date; aggregate figures (party size, times) stay for reports.
Restaurant customers: when a restaurant deletes a customer, their personal data is erased; orders and invoices remain without their identity.
Employee and payroll data: the restaurant, as controller, sets the period under the Labour Law; we delete it at its request or when the account is closed, except what the law requires us to keep.

Your Rights Under PDPL

Under the Saudi PDPL you have the right to be informed of how your data is processed, to access it and obtain a copy, to correct it, to request its deletion, and to withdraw consent where processing relies on it. To exercise any of these rights, email us at privacy@alifood.co — we commit to responding within 30 days. If you are a guest or employee of a restaurant that uses Ali Food, contact the restaurant first, as it controls your data; we help it fulfil your request. You may also lodge a complaint with the competent authority (the Saudi Data & AI Authority — SDAIA).

Cookies

We use essential cookies to run the site. Analytics tools (Google Analytics and PostHog) load only if you accept analytics cookies in the cookie banner, and we do not use cookies for ad tracking. If you choose "Essential only", no analytics tool is loaded.

Policy Updates

We may update this policy from time to time. Material changes are communicated by email or via an in-app notice at least 30 days before they take effect. The latest publication date is shown at the top of this page.

Privacy Policy