Privacy policy

Yalla Kabbes (“we”, “us”) provides feedback pages and rewards cards that restaurants, hotels, cafés and other businesses (“Venues”) offer to their guests (“you”). This policy explains what personal data we collect, why, who receives it, how long we keep it, and your rights. It applies to our website, the feedback and rewards pages, the Venue dashboards and the emails we send.

For any privacy question or request, contact us at yallakabbes@gmail.com.

• Rewards accounts: we are the controller of your account and card data. When you join a Venue’s program, that Venue also receives your details and becomes a separate, independent controller of the copy it receives, responsible for its own use of it.
• Feedback: ratings and private messages are collected for the Venue you rate. The Venue decides how to use them; we process them to run the Service and are responsible for how we do so.
• Venue accounts: we are the controller of the account details of Venue owners and staff.
• Staff records: a Venue that uses our stock or scheduling tools decides, as the employer, what its staff record there (shifts, clock times, stock records) and how it uses them; we process those records on its behalf to run the Service.

When you leave feedback (no account needed): your star rating, the time, which of the Venue’s cards or codes you used, and whether you chose to open Google’s review page. If you send the Venue a private message: what you write, the topics you pick, and the name, phone number and email you choose to give.

When you create a rewards account: your name, email address and phone number; your password, stored only as a one-way hash we cannot read; the time you accepted the terms and which version; and whether you confirmed your email. If you sign in with Google or Apple, see section 5.

When you add a purchase: the order number, the date and the amount you type, and the photo you take of the receipt. A receipt may show items, prices and the Venue’s details — please do not photograph payment-card numbers or other people. At a Venue where staff give you a rewards code instead, we record that a valid code was used (never which member of staff gave it), and a receipt photo and amount only where the points depend on what you paid. We also record your phone’s location at that moment (coordinates and their accuracy) and the distance to the Venue.

When you redeem a reward: the reward, the time, and your location at that moment in the same way.

Your card’s history: stamps and points earned, rewards redeemed, and any that were refused automatically or revoked by the Venue or by us, with the reason.

When you tap a venue’s Instagram tag or scan its QR code: we count the tap (which venue, and when) and send you straight on to the venue’s Instagram. Nothing about you is stored with it. What happens on Instagram is governed by Instagram’s own privacy policy.

When you tap a venue’s menu tag or scan its QR code: we count the tap (which venue, and when) and open the menu the venue uploaded. Nothing about you is stored with it.

When you ask us for a demo on our website: the name, venue name and email address you type, and, only if you give them, your phone or WhatsApp number, city, the type of venue, the features you are interested in and your message. Only Yalla Kabbes staff see it. We use your email address and phone number to answer your request; we do not add you to a mailing list, and we do not email you anything you did not ask for.

Technical data: your IP address and basic request details, used to limit abuse (for example too many attempts from one address) and kept in short-lived server logs by our hosting provider.

Venue owners and staff: name of the business and its contact details, the email and hashed password used to sign in, role, and the report email address.

Staff of a Venue that uses scheduling: your name, email and job roles; the limits the Venue sets (days a week, shifts a day); the shifts you pick or are given, your days off, swap requests and your in-app notifications; and each clock-in and clock-out: the time and, if the Venue requires it, your phone’s location at that moment (coordinates, their accuracy and the distance to the Venue). Corrections a manager makes are recorded with their name and reason.

Staff of a Venue that uses stock: what you record (deliveries, what was used or wasted, counts and corrections), with your name and the time, and any photo you take of a product or delivery. When you scan an unknown barcode, only the barcode number is sent to Open Food Facts, a free public product database, to suggest the product’s name; nothing about you is sent.

We do not ask for payment-card details, government ID numbers, or health, religious or other special-category data. Please do not include them in messages or photos.

We ask your browser for your location only when you tap to add a purchase or to redeem a reward, to check that you are at the Venue. We do not track your location at any other time, in the background, or on the feedback page. The reading taken at that moment is stored with that purchase or redemption, as evidence the Venue can check.

In the rewards app, Explore and the Map also use your location, but only inside your browser, to show how far each place is, sort places nearest first and draw your position: it is not sent to us. Your browser keeps the latest reading for up to 10 minutes, in that browser tab only, so switching tabs does not ask again; it is gone when you close the tab.

You can refuse or withdraw location permission at any time in your browser or phone settings; you then cannot add purchases or redeem rewards, but everything else still works.

Venue staff: when your Venue requires it, your location is read once, when you tap Clock in or Clock out, to check you are at the Venue, and stored with that clock time. It is never read at any other time. The staff app uses your camera only while you scan a barcode; no picture is kept unless you take a product photo yourself.

If you choose “Continue with Google” or “Continue with Apple”, we receive from that provider only your name, your email address, whether the provider has verified it, and an account identifier. We do not receive your password, contacts, files, calendar or anything else, and we cannot post in your name.

We use this information only to create and sign in to your rewards account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: we do not sell it, use it for advertising, or transfer it to anyone except as needed to provide the Service or as the law requires. You can remove our access at any time from your Google or Apple account settings.

• To run your rewards card and the feedback pages — create your account, add stamps and points, show your balance, let you redeem, and pass your feedback to the Venue. Basis: performing our contract with you (the Terms).
• To share your details with the Venues whose cards you hold, so they can honour your rewards and contact you about them. Basis: performing the contract, and your agreement when you join each Venue’s program.
• To prevent fraud and keep the Service secure — location checks, receipt photos, one-use order numbers, rate limits, and keeping records of refused or revoked receipts. Basis: our and the Venues’ legitimate interest in a fair, secure program.
• To send service emails — confirming your email, password resets, and the Venue’s daily summary. Basis: performing the contract.
• To use your location at the moment you add a purchase or redeem. Basis: your permission, which you can withdraw at any time.
• To answer a demo request — read what you sent and reply to you. Basis: taking steps at your request before a contract, and our legitimate interest in answering the people who contact us.
• To comply with the law and to establish, exercise or defend legal claims. Basis: legal obligation and legitimate interest.

When you add a purchase, the Service automatically refuses it if you are too far from the Venue, if the receipt is dated more than a day ago, if its order number has already been used, if a rewards code is wrong, used or expired, or if you have reached the daily limit. These checks only decide whether a stamp or point is added; they have no legal effect on you. If you think one was wrong, contact the Venue or us and a person will review it.

We do not sell your personal data, and we do not use it for advertising. We share it only with:

• The Venue concerned — the Venue you rated sees your rating and any private message and contact details you gave it; each Venue whose card you hold sees your name, email, phone number, balance, history, receipt photos and the location distance recorded with them. A Venue never sees your cards at other Venues, and never sees you again after you delete your account.
• Service providers that work for us under contract and only on our instructions: Vercel (hosting), Supabase (database and file storage, hosted in the European Union), Resend (sending emails), GitHub (running our scheduled tasks and keeping our encrypted backups), Google or Apple when you choose to sign in with them, and OpenStreetMap, whose servers send the map pictures on the rewards Map (like any website, they see your IP address when they do).
• Authorities or others where the law requires it, or where needed to investigate fraud, protect the rights and safety of Guests, Venues or us, or enforce our Terms.
• A buyer or successor if Yalla Kabbes is reorganised or sold, under this same policy.

Our providers may process data outside the country where you live, including in the European Union and the United States. Where the law requires it, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses included in our providers’ terms.

• Rewards account and cards: for as long as your account is open.
• After you delete your rewards account: you can no longer sign in, your stamps and points are gone, and Venues stop seeing you. We keep a record of the deleted account — name, email, phone number, card history and receipt photos — marked as deleted, for 90 days, to prevent and investigate fraud, handle disputes and complaints, and meet legal obligations. It is then erased automatically. You can ask us to erase it sooner (see section 12); we will do so unless we must keep part of it by law or for a legal claim.
• Demo requests: until we have answered and no longer need the request, then we delete it. You can ask us to delete it sooner (see section 12).
• Feedback: for as long as the Venue uses the Service, then as set out in our agreement with the Venue.
• Venue accounts: while the service is active, and for up to 30 days after it ends to allow an export, unless the law requires longer.
• Staff records (shifts, clock times, stock records): while the Venue uses the Service, as its working records; a staff account the Venue closes keeps its history for the Venue. They are deleted when the Venue asks, or up to 30 days after its service ends.
• Backups: an encrypted copy of our database is made every night and kept 14 days, so anything deleted is gone from backups within 14 days.
• Server logs: kept briefly by our hosting provider under its own policy.

We use encrypted connections (HTTPS), encrypt our nightly backups, store passwords only as salted one-way hashes, sign sessions and email links cryptographically, lock our database so that only our application can reach it, limit repeated attempts, and restrict each Venue to its own data. No system is perfectly secure; if a breach affects your data in a way the law requires us to report, we will notify you and the relevant authority. We describe in plain language what the product does with your data on our Security page.

Depending on the law that applies to you, you have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• have your data erased;
• restrict or object to our use of it, including use based on legitimate interest;
• receive it in a portable format;
• withdraw any permission you gave (such as location) at any time;
• complain to a data-protection authority.

You can delete your rewards account yourself at any time from the bottom of your card. For anything else, email yallakabbes@gmail.com from the address on your account. We may need to confirm your identity, and will reply within 30 days. Requests about the copy a Venue holds can also be made to that Venue directly.

We handle personal data in line with Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data and, where it applies, the EU General Data Protection Regulation. If you are in the European Union or the United Kingdom, you may complain to your local supervisory authority.

We use only cookies that are strictly necessary for the Service to work:

• a sign-in cookie for your rewards account (up to 180 days);
• a short-lived cookie that protects signing in with Google or Apple (10 minutes);
• a cookie on a venue’s Instagram link, so tapping it twice within 30 minutes counts once (30 minutes, holds no information about you);
• the same kind of cookie on a venue’s menu link (30 minutes, holds no information about you);
• sign-in cookies for Venue dashboards and our own administrators;
• a cookie that remembers whether you chose English or Arabic (one year);
• a cookie on a Venue’s own counter phone or tablet, once unlocked with its counter PIN, so it can show the rewards code (up to 180 days).

The feedback page may also keep an unsent message on your own device, so you do not lose it if the page reloads; it is removed once sent. We use no advertising, analytics or tracking cookies, and no third-party trackers.

Rewards accounts are not for anyone under 16. We do not knowingly collect data from children under that age; if you believe a child has created an account, contact us and we will delete it.

We send only service emails (confirming your email address, password resets). We do not send marketing on our own behalf without your separate consent. A Venue whose card you hold may contact you about your rewards there; our Terms forbid Venues from sending you marketing unless you separately agree to it. To stop hearing from a Venue, tell the Venue or delete your account.

If we change this policy we will update the date at the top of this page. If we make a significant change to how rewards data is used, we will show a notice on the rewards page or email you before it applies. The Terms and conditions explain the rules for using the Service.