TasteFlow

Privacy Policy

Last updated: October 2026

1. Introduction

Taste Flow, owned by My Click Technologies Company (Al-Khobar, Kingdom of Saudi Arabia), is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data in compliance with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations.

This policy applies to two categories of users:

  • Restaurants (Merchants): businesses subscribed to the Platform.
  • Customers: individuals browsing menus and placing orders via QR codes.

2. Data We Collect

a. Restaurant (Merchant) Data

  • Business name, Commercial Registration, VAT number.
  • Contact person details: name, mobile number, email.
  • Billing and subscription information.

b. Customer Data

  • Name and mobile number (when placing an order or joining a loyalty program).
  • Order details, purchase history, and preferences.
  • Table number or branch associated with the scanned QR code.

c. Automatically Collected Data

  • IP address, device and browser type, operating system.
  • Cookies and usage data to improve the Platform experience.

Note: We do not store card payment data; it is processed entirely by a SAMA-licensed payment provider under PCI-DSS standards.

3. Purposes of Processing

We use your data to:

  • Operate the Platform, process orders, and deliver them to the relevant restaurant.
  • Manage subscriptions and issue e-invoices per ZATCA requirements.
  • Operate restaurant loyalty programs and offers.
  • Improve our services and analyze usage on an anonymized, statistical basis.
  • Communicate with you about your account or material service updates.
  • Comply with legal obligations and requests from competent authorities.

We do not process your data for marketing purposes without your explicit consent, which you may withdraw at any time.

4. Data Sharing

We do not sell your personal data. We may share data only with:

  • The relevant restaurant: to fulfill your order (name, mobile number, order details).
  • Technical service providers: such as cloud hosting and payment processing, under agreements requiring them to protect your data.
  • Competent government authorities: where legally required.

Where data is transferred or processed outside the Kingdom, this is done in accordance with the PDPL's cross-border data transfer requirements.

5. Data Security

We apply appropriate technical and organizational measures to protect your data, including:

  • Encryption in transit (TLS/HTTPS) and at rest.
  • Access restricted to authorized personnel on a need-to-know basis.
  • Regular system monitoring, updates, and vulnerability management.
  • In the event of a data breach affecting your rights, the competent authority and affected individuals will be notified as required by law.

6. Data Retention

We retain your personal data for as long as your account is active or as needed for the purposes above, after which it is securely deleted or destroyed — unless a longer retention period is required by law (e.g., financial records and invoices retained under tax and commercial regulations).

7. Your Rights

Under the PDPL, you have the right to:

  • Be informed: know how your data is collected and the purpose of processing.
  • Access: request a copy of your personal data held by us.
  • Correction: request that inaccurate data be updated or corrected.
  • Destruction: request deletion of your data when no longer needed.
  • Withdraw consent: withdraw your consent to processing at any time.

To exercise any of these rights, contact us at the email below; we will respond within the statutory period.

8. Children's Privacy

The Platform is not directed at individuals under 18 for account creation. If we learn that a minor's data was collected without required guardian consent, we will delete it.

9. Changes to This Policy

We may update this policy from time to time. The updated version will be published on this page with its revision date, and you will be notified of material changes.

10. Contact

For privacy questions or requests:

  • Email: info@taste-flow.com
  • My Click Technologies Company — Al-Khobar, Kingdom of Saudi Arabia
  • Commercial Registration (CR): 7052243479
  • VAT Registration No.: 314336739800003