Privacy Policy

1. Who is responsible for your data

• If you order from or book a restaurant through AwaMenu, that restaurant decides how your order details are used. It is the data controller, and AwaMenu processes the data on its behalf to run the ordering, payment and booking service.
• If you run a restaurant on AwaMenu, AwaMenu is the data controller for your account and billing information.

2. What we collect

Customers

• Name, phone number and, if you give it, email address.
• Delivery address, for delivery orders.
• What you order or book: items, notes, table, party size, times and amounts.
• Ratings and comments you choose to leave.
• If you sign in to see your orders: the phone number or email you verify, and a sign-in session cookie.

Restaurant owners and staff

• Owner name, email and password (stored only as a one-way hash).
• Restaurant details, menu, opening hours and branding.
• Bank account details for payouts, verified with the payment provider.
• Staff names and staff IDs, and a record of actions taken (for example, who recorded a payment).

Everyone

• Technical data needed to keep the service secure and working: IP address, browser and device type, and error reports.
• Usage analytics about how the app is used, to improve it.

We never see or store your card details. Card payments are entered on, and processed by, the payment provider (Paystack, Monnify or Flutterwave).

3. Why we use it, and on what basis

• To provide the service you asked for: placing and tracking orders, taking payments, making reservations, sending order and booking updates, running restaurant accounts (performance of a contract).
• To keep the service secure: preventing fraud and abuse, rate limiting, investigating errors (legitimate interests).
• To meet legal obligations: keeping financial and tax records (legal obligation).
• To improve the service: aggregated usage analytics (legitimate interests).

We do not sell personal data, and we do not send marketing messages to customers.

4. Who we share it with

• The restaurant you order from or book with.
• Payment providers (Paystack, Monnify, Flutterwave) to take and settle payments.
• Messaging providers: Twilio (WhatsApp and SMS) and Resend (email), to send order updates and sign-in codes.
• Infrastructure providers that host and run the service: Vercel (hosting), Neon (database), Upstash (rate limiting), Cloudinary (images), Cloudflare (security), Sentry (error reports), PostHog (analytics).
• Authorities, where the law requires it.

Some of these providers store data outside Nigeria (our database and hosting are in the European Union). Where data leaves Nigeria we rely on the safeguards the NDPA allows, including contractual protections with each provider.

5. How long we keep it

• Sign-in codes: 10 minutes.
• Queued messages (email, WhatsApp, SMS): deleted 14 days after sending.
• Orders, payments and refunds: as long as needed for accounting and tax purposes, typically six years.
• Restaurant accounts: while the account is active, then as required for the records above.

6. Your rights

Under the NDPA you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct data that is wrong;
• delete your data, where we are not required to keep it (for example for financial records);
• restrict or object to how we use it;
• move your data to another service.

Signed-in customers can update their profile from the account menu on any restaurant page. For anything else, email hello@awamenu.com. We reply within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (NDPC).

For order data held on a restaurant's behalf, we may pass your request to that restaurant, as the controller.

7. Cookies

We use cookies that keep you signed in (owner, staff and customer sessions) and keep the service secure. These are necessary for the service to work. We also use analytics to understand how the app is used.

8. Security

Data is encrypted in transit. Passwords are hashed, sign-in codes and staff PINs are stored only as hashes, and payment gateway keys are encrypted at rest. Access is limited to people who need it.

9. Children

AwaMenu is not intended for children under 18 to create accounts.

10. Changes and contact

If we change this policy we will update the date above, and tell restaurant owners of significant changes. Questions: hello@awamenu.com.