Chat with us
Legal

Privacy Policy

Last updated: TODO: publish datePlain language. No legalese where we can avoid it.
The short version
We only collect what an order or account needs. Guest orders belong to the restaurant, not to us. We never sell personal information. You can ask for a copy, a fix, or deletion anytime.

1. Who we are and what this covers

Dinelabs (“Dinelabs”, “we”, “us”) provides online storefronts that let restaurants and coffee shops take orders directly from their guests. We are based in Beirut, Lebanon, and you can reach us at team@dinelabs.co.

This policy explains what personal information we collect, how we use it, and the choices you have. It applies to everything we offer, now and in the future (together, the “Services”):

  • our website, dinelabs.co
  • storefronts we host for restaurants, including QR code ordering at tables
  • the owner portal restaurants use to manage menus and orders
  • our mobile apps, and any new product or feature we launch, such as loyalty, online payments or menu analysis

If a new product collects information in a way this policy doesn’t describe, we’ll update this policy before that product launches.

2. Who this policy is for

  • Restaurants: businesses that sign up for Dinelabs, and the people who run their accounts (“Merchants”)
  • Guests: people who view a menu or place an order through a Merchant’s storefront
  • Visitors: people who browse our website

3. Our role

Merchant account data. When you sign up as a Merchant, we decide how your account information is used. For this data we are the data controller.

Guest order data. When a guest orders from a restaurant, the order belongs to the restaurant. The restaurant decides how to use it to prepare, deliver and follow up on that order, and is responsible for it as the data controller. We process that data on the restaurant’s behalf to run the storefront and deliver the order to them. If you’re a guest and have a question about how a restaurant uses your information, contact that restaurant first. We’ll help if they can’t.

4. What we collect

We only collect what we need to run the Services.

From Merchants

  • Account details: your name, business name, email address, phone number, and the branches you manage
  • Menu and store content: products, prices, descriptions, photos, logos, colors and translations you add
  • Billing details: your plan, payment history, and how you paid. Once online payment is available, payments are handled by payment providers, and we never store full card numbers.
  • Usage data: how you use the portal, such as logins, settings and menu changes
  • Messages: anything you send us by email, WhatsApp or other channels

From Guests

Guests don’t need an account to order. We only ask for what the order needs:

  • Dine-in orders: the table number, the items ordered, add-ons and order notes
  • Pickup orders: the items ordered and the contact details needed to reach you about the order
  • Delivery orders: your name, phone number, email address and delivery location, plus the items ordered and any notes
  • Language preference: the language you choose to view the menu in

From everyone who uses the Services

  • Technical data: IP address, device and browser type, pages viewed and the time of your visit
  • Cookies and similar technologies: see section 10

5. How we use it

PurposeWhose dataWhy we’re allowed to
Take orders and send them to the right restaurantGuestsTo provide the service the restaurant and guest asked for
Translate menus and ordersMerchants, GuestsTo provide the service
Create and run Merchant accountsMerchantsOur contract with you
Bill for subscriptions and keep financial recordsMerchantsOur contract, and legal obligations
Support, service messages and account noticesMerchantsOur contract with you
Keep the Services secure and prevent fraud or abuseEveryoneOur legitimate interest in a safe service
Fix problems and improve the ServicesEveryoneOur legitimate interest in a better product
Send Merchants product news and offersMerchantsYour consent or our legitimate interest. You can unsubscribe anytime.
Meet legal requirements and respond to lawful requestsEveryoneLegal obligation

We don’t sell personal information, and we don’t use guests’ details to market to them on our own behalf.

6. Aggregated and anonymized data

We combine information across many restaurants, such as menu items, prices, categories and order volumes, and remove anything that identifies a person or a single restaurant. We use this aggregated data to build insights like menu analysis and price benchmarks, and to improve the Services.

Aggregated data never identifies a guest. It never identifies a Merchant to other Merchants unless that Merchant agrees. Because it no longer identifies anyone, it isn’t personal information.

7. Who we share information with

We share information only as described here:

  • The restaurant you order from: your order and the details needed to prepare, deliver and contact you about it
  • Service providers that help us run Dinelabs, under contracts that limit how they can use your data:
    • Contabo, which hosts our servers and databases
    • Cloudflare, which stores and delivers images and helps protect our website
    • Google, which provides services we use, such as TODO: Google services actually used
    • TODO: translation provider name
    • payment providers, such as MyFatoorah and Whish Money, which will process subscription payments once online payment is available
    • Meta, which provides the Meta Pixel we use to measure our ads
    • Google Ads, which we use to measure our ads
    • Microsoft Clarity, which shows us how visitors use our website so we can improve it
    • WhatsApp, which we use for support chats
    • TODO: email provider (for example Google Workspace), which handles our email
  • Legal and safety reasons: when the law requires it, or to protect the rights, safety or property of our users, the public or Dinelabs
  • Business changes: if Dinelabs is merged, acquired or sells its assets, information may transfer to the new owner, who must respect this policy

When we add a new provider, for example for online payments or our mobile apps, we’ll add them to this list.

8. International transfers

Our providers may store or process information outside your country, including in Europe and the United States. When information leaves your country, we take reasonable steps to make sure it stays protected as this policy describes.

9. How long we keep it

InformationHow long
Merchant account details and contentWhile the account is open. We delete or anonymize them within 90 days after it closes.
Billing and payment recordsAs long as the law requires
Guest order detailsWhile the restaurant’s account is open, up to 3 years from the order. Then we delete or anonymize them. A restaurant can ask us to delete them sooner.
Technical logsUp to 12 months
Aggregated, anonymized dataKept, because it no longer identifies anyone

10. Cookies

We use a small number of cookies and similar technologies:

  • Essential cookies keep you logged in, remember your language, and hold your order while you browse a menu. The Services don’t work without them.
  • Analytics cookies help us understand how people use our website so we can improve it. Where the law requires, we ask for your consent first.
  • Advertising cookies, such as the Meta Pixel and Google Ads, help us measure how our ads perform. Where the law requires, we ask for your consent first.

TODO: how visitors give or withdraw consent (for example a cookie banner and a “Cookie settings” link)

You can block or delete cookies in your browser settings. If you block essential cookies, ordering may not work.

11. How we protect it

We use encrypted connections (HTTPS), access controls, and limits on who in our team can see personal information. No system is perfectly secure. If a breach affects your information, we’ll tell you and the relevant authorities as the law requires.

12. Your rights

You can ask us to:

  • give you a copy of the personal information we hold about you
  • correct information that’s wrong
  • delete your information
  • stop or limit how we use it
  • withdraw consent you gave earlier

Email us at team@dinelabs.co. We’ll reply within 30 days and may ask you to confirm your identity first. If you’re a guest asking about an order, we’ll work with the restaurant, which controls that data, to handle your request.

13. Children

The Services aren’t aimed at children under 13, and we don’t knowingly collect their information. If you believe a child has given us personal information, contact us and we’ll delete it.

14. Changes to this policy

We’ll update this policy as Dinelabs grows, for example when we launch mobile apps, loyalty or online payments. We’ll post the new version here and change the “Last updated” date. If a change is significant, we’ll email Merchants or show a notice in the portal at least 15 days before it takes effect.

15. Contact us

Dinelabs · Beirut, Lebanon · team@dinelabs.co