Privacy Policy

This policy applies to horecas.io, our dashboard applications, our APIs, and any guest-facing pages generated for a venue (menus, one-pagers, ordering, reservations, shop, and review pages). By using Horecas, you agree to the collection and use of information as described here.

Venue Account data: name, email address, phone number, password (stored as a salted hash), business/venue details (name, category, location, brand assets), team member roles and permissions, and billing/plan information.

Guest data: when you order, reserve a table, shop, or leave a review through a venue's Horecas page, we collect the details needed to fulfil that request, such as name, phone number, email address, delivery or table preferences, order/reservation history, and review content or ratings.

Payment data: payments are processed by Stripe. We do not store full card numbers on our servers; we retain limited billing metadata (such as invoice history, plan, and renewal dates).

WhatsApp & messaging data: phone number, message content, delivery/read status, and opt-in status when a venue sends order updates, reservation confirmations, or marketing campaigns through the WhatsApp Cloud API.

Content you upload: menu photos, logos, one-pager images, and other files uploaded to a Venue Account.

Usage & device data: IP address, browser and device type, pages viewed, and similar diagnostic data collected automatically when you use our sites and apps.

We use the information we collect to:

• Create and administer Venue Accounts and team access.
• Process and fulfil orders, reservations, shop purchases, and reviews.
• Send transactional communications (order confirmations, reservation reminders, receipts) and, where you have consented, marketing campaigns.
• Process payments, subscriptions, and billing renewals.
• Generate and host guest-facing pages (menus, one-pagers, offers) on behalf of a venue.
• Maintain the security of our platform and prevent fraud or abuse.
• Provide customer support and respond to inquiries.
• Improve and develop our products and services.
• Comply with legal obligations.

Venues may use our platform to send messages through the WhatsApp Cloud API (operated by Meta) and email, including transactional updates and opt-in marketing campaigns. Marketing messages are only sent to guests who have opted in, and every marketing message includes a way to unsubscribe or reply "STOP." Message content and delivery status are shared with Meta and our email-delivery provider solely to deliver the message.

All card payments on Horecas are handled by Stripe, a PCI-DSS compliant payment processor. Stripe's use of your information is governed by Stripe's own privacy policy. We receive limited information back from Stripe (such as payment status and invoice details) to manage subscriptions and orders.

We use essential cookies and similar technologies to keep you signed in, remember your preferences, and keep our sites secure. We may also use analytics cookies to understand how our sites are used so we can improve them. You can control cookies through your browser settings; disabling essential cookies may affect the ability to sign in or place orders.

We share information with:

• The venue you interact with — a venue can see the orders, reservations, reviews, and messages associated with its own guests.
• Service providers — including Stripe (payments), Meta/WhatsApp Cloud API (messaging), our email delivery provider, and cloud hosting and storage providers, each acting on our behalf to operate the platform.
• Legal & compliance — where required to comply with the law, enforce our terms, or protect the rights, property, or safety of Horecas, our users, or others.

We do not sell personal information.

We retain personal information for as long as an account is active or as needed to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Guest data associated with a venue is retained for as long as the venue retains it, subject to any deletion request submitted directly to us.

We use technical and organizational safeguards to protect information, including encryption in transit, password hashing, and role-based access controls limiting who can view Venue Account and guest data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you are located, you may have the right to access, correct, delete, or export your personal information, to withdraw consent to marketing communications, and to object to or restrict certain processing. To exercise these rights, contact us using the details below, or use the unsubscribe link included in marketing messages. We will respond to verified requests in accordance with applicable data protection law, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where applicable, the EU/UK GDPR.

Horecas and our service providers may process and store information in countries other than your own, including the United Arab Emirates. Where we transfer personal information internationally, we take steps to ensure it receives an adequate level of protection consistent with this Policy.

Horecas is not directed to children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please contact us so we can remove it.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify Venue Account holders directly.

If you have questions about this Privacy Policy or how we handle your information, contact us at support@horecas.io.