Privacy Policy

Data about kitchens (we are the controller). When a kitchen signs up, we decide what to collect and why: the owner’s name, work email, kitchen name, country and billing records. This policy governs it, and the rights in clause 8 are exercised directly with us.

Data about a kitchen’s own customers (we are the processor). A kitchen uploads details about the people it feeds — names, phone numbers, delivery addresses, dietary preferences and allergies. We only ever act on that kitchen’s instructions. The kitchen is the controller; we never use it for our own purposes, never sell it, and never contact those people except to deliver a message the kitchen asked us to send.

If you are a diner and want your data corrected or deleted, contact the kitchen you order from — they control it. If you cannot reach them, write to us at info@mealroh.com and we will help you find them.

• Account: owner name, work email, hashed password, kitchen name, country, preferred language.
• Billing: subscription term, invoices, payment status, and a payment-method reference held by Stripe. We never receive or store full card numbers or security codes — the card fields are served directly by Stripe.
• Usage and technical: log entries, IP address, timestamps and error reports, kept to run and secure the service.
• Support: anything you send us by email or WhatsApp when asking for help.

Processed only on the kitchen’s instructions: name, phone number, email, delivery address and location, meal-plan and subscription details, meal selections, delivery records, invoices, and dietary preferences and allergies.

Allergy and dietary information can reveal something about a person’s health, so we treat it as sensitive: it is used only to produce that kitchen’s own production lists, labels and safety warnings, and it is never used for analytics or shared with anyone outside the kitchen’s own workflow.

• To provide the service — necessary to perform our contract with the kitchen.
• To take payment and issue VAT invoices — contract, and our legal obligations.
• To keep the service secure and prevent abuse — our legitimate interest in a safe service.
• To send service messages (receipts, renewal notices, security alerts) — contract. These are not marketing and cannot be switched off while you hold an account.
• To send marketing — only with consent, withdrawable at any time.

We do not sell personal data, and we do not use a kitchen’s customer data to train models or to build profiles for advertising.

Only the providers needed to run the service, each under a contract restricting them to our instructions:

We may also disclose data where the law requires it, or to establish or defend legal claims. If our business is ever sold, data may transfer with it — you would be told first.

Mealroh runs on cloud infrastructure that may store or process data outside the United Arab Emirates, including in the United States, Europe and the Asia Pacific region. Where data leaves the region it was collected in, we rely on the safeguards required by applicable law — including contractual protections with each provider listed above.

• While your account is active — for as long as you use Mealroh.
• After closure — 60 days, so you can recover it if you return, then deleted.
• Invoices and financial records — retained as long as tax law requires, even after closure.
• Abandoned signups — if you start a signup and never pay, the details you entered are deleted within 24 hours.
• Security logs — kept for a limited period for investigation, then discarded.

Subject to the law that applies to you, you can ask us to:

• access the personal data we hold about you, and receive a copy;
• correct it if it is wrong;
• delete it, where we have no overriding obligation to keep it;
• restrict or object to a particular use;
• withdraw consent where consent is the basis (this does not undo what came before).

Write to info@mealroh.com. We respond within 30 days. Mealroh also has export and deletion tools built in, so a kitchen owner can act immediately without waiting for us.

If you are unhappy with our answer, you may complain to the data protection authority where you live — in the UAE, the UAE Data Office; in Saudi Arabia, SDAIA.

Passwords are hashed, never stored in plain text. Traffic is encrypted in transit. Access is separated by kitchen at the database layer, so one kitchen cannot read another’s data. Access to billing is limited to the owner role. Card details never touch our servers.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

Our website uses only what is needed to work: a session token so you stay signed in, and preferences such as your chosen language. We do not use advertising or cross-site tracking cookies. Stripe sets its own cookies on the payment step to prevent fraud.

Mealroh is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child’s data has reached us, tell us and we will remove it.

If we change this policy materially we will tell you by email or in the dashboard before it takes effect. The date at the top always shows the current version.

Epic World FZE (trading as Mealroh), info@mealroh.com