Legal
Privacy policy.
What this website collects, what the point of sale holds on behalf of the restaurant that runs it, and what you can ask us to do about either.
1. Who this is about
delEat is restaurant software: a point of sale and the modules around it, sold as a subscription per outlet. It is operated by The Hungry Inc. Global L.L.C-FZ, a free zone limited liability company licensed by the Meydan Free Zone, Dubai (licence 2649234.01), with its registered address at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. In this policy, we and delEat mean that company, you means whoever is reading, and Operator means a restaurant business that subscribes to delEat and runs it in its own outlets.
There are two quite different relationships in one product, and the rest of this page keeps them apart:
- This website. We decide what it collects and why, so we are the controller of it.
- The point of sale. An Operator decides what goes into it and what happens to it. The Operator is the controller of that data and delEat is its processor, acting on the Operator's instructions under the subscription agreement.
2. What this website collects
2.1 Forms. Two pages carry a form. The trial form on start.html asks for your business name, the kind of venue, the number of outlets, the city, the plan you are interested in, your name, your role, your email address, your phone number, and whether you are moving off another point of sale. The contact form on contact.html asks for your name, your business, your email address, your phone number and your message. Only the business name, your name and your email address are required; the rest is there because it saves a round of questions.
2.2 What we do with it. We use what you send to reply to you, to set up a trial if that is what you asked for, and to keep a record of the conversation. We do not sell it, we do not rent it, and we do not use it to build a profile of you.
2.3 Server logs. Our hosting provider records the ordinary technical detail of a web request: the IP address it came from, the time, the page asked for, the response, and the browser's own description of itself. That is how a web server works, and it is what lets us tell a real visit from an attack.
3. Cookies and tracking
3.1 This website sets no cookies. It carries no analytics, no advertising tags, no pixels, no session recording and no third-party trackers of any kind. That is why you were not asked to accept anything when you arrived: there is nothing to consent to.
3.2 The one thing the site does store on your device is a single flag in your browser's session storage, so that the short opening animation plays once rather than on every page you open. It holds no personal data, it is readable only by this site, and your browser discards it when you close the tab.
3.3 Our typefaces are served from this site, at deleat.io. Nothing on a page of this site is fetched from a third party, so no third party is told that you visited, and none of them sees your IP address.
3.4 If this ever changes, this section changes with it, and it will say so before the tracking starts.
4. What the point of sale holds
4.1 An Operator's delEat installation holds that Operator's own business records: orders, tickets, payments and refunds, shifts and cash declarations, menu and recipe costings, stock movements, expenses and their receipts, and the reports built on all of it.
4.2 It also holds personal data that the Operator puts there:
- Guests. A guest record, contact details, order history, loyalty points and tiers, tags, bookings and waitlist entries, survey answers, and messages the Operator sends from the outbox.
- Staff. People, roles and permissions, PINs, home outlet, rosters, and attendance clocked from a registered phone with its location checked against the outlet's geofence.
- Payroll. Salaries, advances, service charge, gratuity and settlements, and, for the salary file a bank accepts, a person's labour card number, bank routing code and IBAN.
- Compliance. The staff matrix of occupational health cards, food hygiene training, person-in-charge certificates and medical insurance, together with the certificates and policies behind them.
4.3 We do not decide any of that. The Operator chooses what to record, for how long, and who on its team may see it, and delEat checks those permissions on the server rather than on the screen. If you are a guest or a member of staff at a restaurant that runs delEat, the restaurant is the right first place to ask, and we will help it answer you.
4.4 delEat is not a payment service provider and never holds the money. The detail is on Payments and settlement.
5. Who else is involved
5.1 We share personal data with a third party only where the product genuinely needs it, and then only what that party needs:
- Payment providers. Where an Operator connects one, delEat passes the amount and the order reference to the provider's hosted payment page and reads the result back. Card-terminal integration is coming soon; when it is available, only the amount and the order reference will be passed to the terminal. The providers the product supports are Stripe, Telr and Network International (N-Genius). The Operator holds the merchant agreement; we are not a party to the payment.
- The delivery-platform connector. Where an Operator sells through delivery platforms, orders, menus and availability move through a delivery-platform connector between those platforms and the till.
- Our hosting provider. Amazon Web Services holds the servers the software runs on, in its Mumbai (India) region. Nightly backups are held by Cloudflare in the European Union.
- Our website and its forms. Cloudflare serves deleat.io. What you send through the free-trial or contact form is stored by Cloudflare and emailed to our own inbox, which Google Workspace hosts. We use it only to set up your trial or to answer you.
5.2 We also disclose data where the law requires it, to a court or an authority acting within its powers, and to our own professional advisers under a duty of confidence.
5.3 We do not sell personal data, and we do not share it for anyone else's advertising.
6. Where the data is
6.1 delEat is built and run from Dubai. Where an installation, its backups or a sub-processor sits outside the United Arab Emirates, we transfer personal data only where the destination gives it an adequate level of protection, or under contractual terms that carry that protection with it, as Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data requires.
6.2 Nightly backups are taken and can be restored. Sign-in attempts are throttled, payment provider keys are held encrypted, and the system keeps an audit log of what was changed and by whom.
7. How long we keep things
7.1 We keep what you send through a form for as long as we are talking, and then for as long as we need it to show what was agreed and to meet our own tax and accounting obligations.
7.2 Data inside an Operator's installation is kept for as long as the Operator keeps a subscription. When the subscription ends, it stays available read-only for thirty days so the Operator can export it, and is then deleted. We keep only our own record of the subscription, our invoices to the Operator and the Operator's acceptance of our terms.
8. Your rights
8.1 Under Federal Decree-Law No. 45 of 2021 you may ask us to tell you what personal data we hold about you and why, to give you a copy of it, to correct it if it is wrong, to delete it, to restrict or stop a particular use of it, and to hand it over in a portable form. You may also withdraw a consent you gave, without that affecting anything done before you withdrew it.
8.2 Where the data sits inside an Operator's installation, the Operator answers the request and we support it. Where it is data this website collected, we answer it ourselves.
8.3 Ask at [email protected]. We will acknowledge you and tell you what we need to identify you, which is usually nothing more than the address you wrote from.
9. Marketing email and how to stop it
9.1 This website sends no email. delEat itself sends two kinds: messages about an account, which are part of the service, and marketing email, which is news about delEat, offers, event invitations and announcements of new modules.
9.2 We send marketing email to an address only on one of two grounds: you asked for it, or you are a customer or started a trial and it is about the same service you use, which is our legitimate interest in telling you about it. On either ground you can stop it at any time, and it costs nothing.
9.3 Every marketing email we send carries an unsubscribe link. The unsubscribe page does the same thing for any address, and so does writing to [email protected].
9.4 We stop marketing email to an address as soon as the request is processed. What we keep afterwards is the address on a suppression list, so that it is not written to again by mistake, and nothing else.
9.5 Unsubscribing does not stop messages about an account while it is open: billing and invoices, security and sign-in, and outages or planned maintenance. Those end when the account does.
10. If you are not satisfied
10.1 Tell us first. Most of what goes wrong is a misunderstanding about which of the two relationships in section 1 your data sits in, and that is quick to sort out.
10.2 If we cannot settle it between us, you may complain to the competent data protection authority in the United Arab Emirates.
11. Children
This website and the point of sale are sold to and used by businesses. Neither is directed at children, and we do not knowingly collect a child's personal data through either.
12. Changes to this policy
We revise this page when the product changes, and the revision date at the top of it moves when we do. If a change matters to you, for example if we start using a tracking technology or add a sub-processor, we will say so here plainly rather than quietly editing a sentence.
13. How to reach us
Write to [email protected], or use the form on contact.html. It reaches the team directly, not a ticket queue.