پرائیویسی پالیسی

1. Who we are

DishRoute is developed and operated by ABT Dev Services, Lahore, Pakistan ("ABT", "we", "us"). This policy explains how we handle personal data on our website, during signup and billing, in support, and when restaurants and their guests use DishRoute.

2. Our role

For the data a restaurant collects in DishRoute about its guests and staff (orders, contact details, reservations, loyalty, feedback and messages), the restaurant decides why and how the data is used (it is the controller) and we process the data on its behalf under the Data Processing Terms. Guests and staff should contact the restaurant about that data.

For website visitors, people who ask for a demo or contact us, restaurant owners who sign up, and billing and support records, we decide how the data is used.

3. What we collect

Website: technical data needed to deliver pages securely (IP address, browser type, pages requested, time), and what you type into the contact, demo or signup forms (name, restaurant, city, phone, email, message).

Signup and billing: the restaurant name and workspace handle, country, currency and time zone, the owner's name, email, phone and password (stored only as a one-way hash), the plan chosen, the version of the terms accepted, invoices and payment status. Card details are entered on the payment provider's page and never reach our servers.

Support and security: messages you send us, records of support access granted by a restaurant, sign-in history and security logs.

Restaurant data (processed for the restaurant): menus, tables, orders and their timeline, payments and invoices, staff accounts and their activity, and the guest details the restaurant collects. Guests can order without an account. A guest's name, phone number or email is collected only when the restaurant asks for it or the guest chooses to give it, for example for a takeaway order, a reservation, a receipt by email, loyalty or WhatsApp ordering. Card details for guest payments are entered on the payment provider's page and never reach our servers.

4. Why we use it

To provide and secure the Service, create and manage restaurant accounts, process payments and send invoices, answer questions and give support, send service messages (such as trial and renewal reminders, security alerts and changes to terms), meet legal and tax obligations, and prevent fraud and abuse.

We send marketing emails only to people who asked for them or who are existing customers, and every marketing email has a way to stop receiving them. We never use guest data for our own marketing or advertising. A restaurant may send its own messages to guests who opted in, and is responsible for that consent.

5. Who receives data

We use carefully chosen providers to run the Service: hosting and backup providers, a network and security provider (content delivery, DNS and attack protection), an email delivery provider, a PDF rendering service, and payment gateways and banks for our own billing. They receive only what they need and may use it only to provide their service to us.

When a restaurant connects its own services (WhatsApp Business, SMS, email, payment gateways or cloud storage), data is sent to those providers on the restaurant's instructions. When a restaurant uses AI or OCR features, only the minimum content needed is sent to the AI or OCR provider, and guest contact details are not sent for AI insights.

We may disclose data when required by law, a court order or a lawful request by an authority, after checking the request and, where the law allows, telling the restaurant. We may also share data with a successor if our business is transferred, under the same protections.

We do not sell personal data.

6. Where data is stored

The cloud Service is hosted in data centres that may be outside the country of the restaurant or its guests, and some providers operate worldwide. We choose providers that protect data with security measures at least as strong as ours. On-premise and desktop server editions keep restaurant data on the restaurant's own computer or server.

7. How we protect data

Each restaurant's data is separated from every other restaurant's. Sensitive settings such as payment gateway and messaging credentials are encrypted. Passwords are stored as one-way hashes. Connections use HTTPS. Guest invoice links and private files are served only through signed links. Two-step sign-in is available for every staff account, and money actions and order changes are recorded in audit logs.

Our staff can open a restaurant account only when the restaurant grants support access, for a limited time, and each session is recorded. Access to production systems is limited to staff who need it and protected with two-step sign-in.

No system is perfectly secure. If a breach affects personal data we hold, we will tell the affected restaurants without undue delay and in any case within 72 hours of becoming aware of it, with the information they need to meet their own duties.

8. Children

DishRoute is a business service for restaurants and is not directed at children. Guests order without an account, and restaurants should not ask children for contact details or send them marketing messages. We do not knowingly collect data directly from children for our own purposes.

9. How long we keep data

Restaurant data: while the subscription is active, then as described in the Terms of Service: at least 90 days after it ends, and deleted after 180 days following 30 days' notice. Backups are overwritten within a further 35 days. A restaurant can delete a guest's profile on request at any time.

Website enquiries: up to 24 months after the last contact. Billing and tax records: as long as tax and company laws require (normally 6 years). Security logs: up to 12 months. In-app notifications: 90 days.

10. Cookies

We use cookies that are needed for the Service to work: a session cookie to keep staff signed in, a security cookie that protects forms, a cookie that remembers the chosen workspace, and a cookie that remembers your language. The guest app may store the current table visit and cart on the guest's device so an order is not lost. None of these are used for advertising.

On our public website only (never inside a restaurant account, the guest app or the mobile app), we may use analytics and advertising tools such as Google Analytics, Google Ads, Meta (Facebook and Instagram), Microsoft Clarity, TikTok and LinkedIn to count visits and measure our advertising. They run only after you accept the cookie notice. When you send the contact form or start a free trial after accepting, a scrambled (hashed) copy of your email and phone number may be shared with Meta to measure our adverts.

You can withdraw that consent at any time: clear this website's data in your browser and choose "No thanks" in the cookie notice.

11. Your choices and rights

You may ask us for a copy of personal data we hold about you, ask us to correct it, ask us to delete it where we no longer need it, or object to marketing. We will answer within 30 days. We may need to confirm your identity first.

Guests and staff should send requests about restaurant data to the restaurant. Guests can also stop marketing messages by replying STOP or using the opt-out link in the message. If the restaurant asks us to help with a request, we will.

Write to [email protected]. If you are not satisfied with our answer, you may complain to the authority responsible for data protection in your country.

12. Law that applies

We handle data in line with the laws of Pakistan, including the Prevention of Electronic Crimes Act, 2016, widely accepted data protection principles, and the mandatory data protection laws of the countries where we serve restaurants. When a new data protection law applies to us, we will update our practices and this policy to meet it.

13. Changes

We will post updates on this page with a new effective date. Material changes are announced to restaurant owners by email at least 30 days in advance.

14. Contact

ABT Dev Services, Lahore, Pakistan. Email: [email protected].

Related policies

• Terms of Service
• Data Processing Terms
• Acceptable Use Policy
• Refund Policy