Privacy Policy

1. Definitions

For the purposes of this policy, the following terms have the meanings set out beside them:

• The Platform (Ahlan): the technical service that enables restaurants to receive their customers' orders over WhatsApp, comprising the automated assistant in the conversation, the dashboard, and the website.
• The Operator (we, us): مؤسسة مفاهيم الرقمية, an establishment registered in the Kingdom of Saudi Arabia that owns and operates the Platform.
• The Restaurant (subscribing establishment): any food establishment that subscribes to the Platform in order to receive its customers' orders through it.
• The Customer: any person who messages a subscribing restaurant's WhatsApp number in order to enquire or to place an order.
• The User: any person who uses the Platform in any capacity, whether as a customer, a restaurant, or a dashboard user.

2. Who We Are

Ahlan is a technology platform owned and operated by مؤسسة مفاهيم الرقمية. The Platform provides restaurants with a channel for receiving their customers' orders through the WhatsApp application.

Ahlan is not a restaurant and does not sell food products. We provide the technical channel that carries the order from the customer to the restaurant, while the restaurant remains responsible for the products, prices, availability, quality, and fulfilment of the order.

When you use the service as a customer, the restaurant you message is the party responsible for the data that reaches it as part of the order, and Ahlan acts as the operator of the channel and as a data processor on the restaurant's behalf.

3. Data We Collect

We collect only what is necessary to operate the service, namely:

a. Restaurant customers' data

• WhatsApp number: the mobile number you message us from, which is the primary identifier of the conversation and the order.
• WhatsApp display name: the name shown by your account, used to address you and to identify the order.
• Order message content: the text of the conversation between you and the assistant while the order is being created.
• Order details: the products and modifiers selected, the branch, the collection method, the amount, and the time and status of the order.

b. Subscribing restaurants' data

• Registration data: the establishment's name, the responsible person's name, the email address, and the mobile number.
• Commercial registration data: the commercial registration number and its scanned copy, and the tax number where one exists.
• Operational data: branches, product and price lists, and user accounts within the dashboard.

We do not request or store payment card data, we do not collect your precise geographic location, and we do not read your conversations with any other party on WhatsApp — we access only the messages sent to the restaurant's service number.

4. How We Use Data

• Operating the order-taking service: understanding your message, presenting the products, prices and available options, and building the order summary before confirmation. Assistant replies are generated automatically by natural-language processing systems using artificial intelligence technologies.
• Passing the order to the relevant restaurant: delivering the confirmed order and its details to the selected branch, and sending order status updates to you.
• Improving the service: measuring reply quality, addressing errors and faults, and improving the accuracy with which orders are understood. Aggregated or scope-limited data is used for this purpose as far as possible.
• Legal obligations: retaining transaction records and responding to lawful requests where a legal obligation exists.

We do not use the content of your conversations for advertising purposes, and we do not build marketing profiles from it.

5. Data Sharing

• With the restaurant you message: the restaurant sees the conversation content, the order details, your mobile number and your display name, because this is necessary to prepare the order and to contact you about it. Your data is not shared with other restaurants you have not messaged.
• With Meta / WhatsApp: messages are carried over the WhatsApp Business API, so the data passes through Meta's systems in its capacity as the messaging channel provider, and is subject to its own privacy policies.
• With artificial intelligence model providers: order messages are processed through automated natural-language processing systems in order to understand the order and construct the reply, under agreements that restrict use of the data to operating the service and do not permit its use for any other purpose.
• With technical infrastructure providers: the hosting and database services required to run the Platform, under agreements obliging them to protect the data and to use it for operational purposes only.
• Where legally required: in response to an official request from a competent authority in the Kingdom of Saudi Arabia.

We do not sell your data, rent it, or share it with third parties for marketing purposes.

6. Messages and Contacting You

The messages we send you by default are operational messages related to your order: order confirmation, status updates, and replies to your enquiries during the conversation.

We do not send marketing messages or promotional offers without obtaining your prior consent. If you do consent, you may withdraw it at any time by sending the word “STOP” (إيقاف) in the same conversation, or by writing to us at the contact address below. Non-essential messages are stopped without affecting your ability to place orders later.

7. Data Retention and Deletion

We retain order and conversation data for as long as it is necessary to provide the service and for the related accounting and regulatory purposes. Once it is no longer needed, the data is deleted or anonymised so that it can no longer be linked to you.

You may request deletion of your data at any time. The detailed steps and the expected timeframe are set out on the data deletion page.

Note: the copy of the conversation held within the WhatsApp application on your device or by the restaurant is governed by each party's own settings, and you may need to delete it from the application yourself.

8. Data Protection

We apply reasonable technical and organisational measures to protect data, including encryption of connections, separation of each establishment's data from every other establishment's within the Platform, and restricting access to data to those who need it to perform their work. Nevertheless, no method of electronic transmission or storage can be absolutely secure.

9. Cookies

The Ahlan website and dashboard use essential operational cookies for session management and for remembering basic preferences (such as language). We do not use advertising cookies or third-party tracking tools for marketing purposes.

10. Your Rights

Under the Personal Data Protection Law of the Kingdom of Saudi Arabia, you have the right to:

• know what data we hold about you and the purpose for which it was collected;
• obtain a copy of your data;
• request correction of inaccurate or incomplete data;
• request deletion of your data, unless a legal obligation to retain it applies;
• withdraw your consent to non-essential messages at any time.

To exercise any of these rights, contact our data protection officer by email at [email protected]. We respond to requests within a maximum of thirty days from the date the requester's identity is verified.

11. Children's Privacy

The service is not directed at anyone under the age of eighteen. If we become aware that we have collected data belonging to a minor, we take prompt steps to delete it.

12. Changes to This Policy

We may update this policy whenever the service or regulatory requirements change. The last-updated date appears at the top of the page, and where we make a material change to how data is used we will notify you through the same channel before the change takes effect.

13. Contact Us

For any enquiry or complaint relating to privacy, contact the data protection officer at مؤسسة مفاهيم الرقمية by email at [email protected] or through the contact page.