Privacy Policy

This policy explains what personal data Jamah4U ("Jamah4U", "we", "us") collects when you use our restaurant point-of-sale platform, why we collect it, how we protect it, and what control you have over it. It covers our website, the staff web app, and the guest ordering pages served from our domain.

Two kinds of people appear in this policy. Subscribers are restaurants that hold an account with us, along with their staff. Guests are the restaurant's own customers who scan a QR code to order. For subscriber data we are the data controller. For guest data the restaurant is the controller and we act as its processor — we only handle that data to run the service on the restaurant's behalf.

Information we collect

From subscribers and their staff

• Account details — business name, business address, phone number, and the name, email and role of each staff account.
• Operational records — orders, menus, stock movements, waste logs, sales and cashflow entries, shifts, attendance, leave and claims that your team enters into the system.
• Billing records — the plan you are on, billing cycle, amounts paid and payment dates.
• Technical logs — IP address, browser type, timestamps and error traces, kept so we can secure and debug the service.

From guests ordering at a restaurant

• Items ordered, table or QR code used, order notes, and the amount paid.
• For delivery orders, the name, phone number and address needed to fulfil the order.
• Payment status returned by the payment gateway. We do not receive or store card numbers.

How we use your information

• To provide, operate and support the platform and the features your plan includes.
• To process subscription payments and issue receipts.
• To pass an order and its payment to the restaurant, and to a delivery partner where the restaurant uses one.
• To keep the service secure — detecting abuse, investigating incidents and maintaining audit trails.
• To contact you about service changes, outages, billing and support requests you raise.
• To produce aggregated, de-identified statistics that help us improve the product. These cannot identify a person or a business.

We do not sell personal data, and we do not use your operational or guest data to advertise to you or to anyone else.

Who we share it with

We share data only with service providers who help us run the platform, and only with what they need:

• Payment gateways — to take payments and confirm them.
• Hosting and infrastructure providers — to run our servers, databases and backups.
• Delivery and food ordering partners — only where a restaurant has connected such an integration, and only for the orders concerned.

We may also disclose data where the law requires it, or where it is necessary to establish or defend a legal claim. If our business is ever transferred, we will tell affected subscribers before their data moves.

How we protect your data

In transit and at rest

Every connection to the platform is encrypted with HTTPS (TLS) — the staff web app, the guest ordering pages and every call to our payment gateway. We do not serve the application over plain HTTP. Data is then held in a managed database with encrypted storage and access restricted to the application itself. Passwords are never stored in readable form; they are hashed with bcrypt, a one-way function, so nobody at Jamah4U can read or recover your password. If you lose it, it is reset, not looked up.

Separation between businesses

The platform is multi-tenant, and every record belongs to exactly one company. Company scoping is enforced at the data layer on every query rather than being left to individual screens, so one restaurant cannot read, list or search another restaurant's orders, staff, menu or sales — even by manipulating an address in the browser.

Access control

• Every staff member has their own account. Roles and per-user permissions decide what each person can open.
• Restaurants can enable or disable whole modules, and access is checked on the server on every request, not just hidden in the interface.
• Deactivating a staff member immediately ends their access.
• Sensitive operations such as order changes and cancellations are written to an event log that shows who did what and when.

What we deliberately never hold

The strongest protection for a piece of data is not to store it. Card numbers, CVV codes and banking logins are entered on our PCI-DSS compliant payment gateway's own pages and never reach our servers — all we receive back is the outcome: amount, date and a reference. A breach of our systems could not expose your customers' card details, because we never hold them.

Application hardening and backups

• Forms are protected against cross-site request forgery, and all database access goes through a query builder that parameterises input, guarding against SQL injection.
• File uploads are validated by type and size before they are accepted.
• Framework, language runtime and dependency updates — including security patches — are applied as part of routine maintenance.
• The database is backed up regularly, with backups stored separately from the live system so an incident affecting the running service does not take the backups with it. Restores are tested periodically.

What we ask of you

Most breaches start with a password, not a server. Please:

• Give every staff member their own login instead of sharing one account across a shift.
• Use a password that is not reused from another service, and change it if you suspect it has been seen.
• Remove accounts for staff who have left, on the day they leave.
• Grant each role only the modules it genuinely needs.
• Sign out of shared or public devices, and lock the terminals your team uses on the floor.

How long we keep it

Operational records are kept for as long as your account is active, because your business needs its own history. After an account closes we keep records for up to 12 months so the account can be restored on request, then delete or anonymise them, except where tax and accounting law requires us to keep billing records for longer.

Your rights

You may ask us to give you a copy of your data, correct anything inaccurate, delete data we no longer need to hold, or restrict how we use it. Subscribers can export most of their own records directly from the app at any time. Guests should raise requests with the restaurant they ordered from; if they contact us instead, we will pass the request on to that restaurant.

To make a request, contact us using the details below. We will respond within 30 days and may ask you to verify your identity first.

Cookies

We use cookies only to keep you signed in, to protect forms against cross-site request forgery, and to remember interface preferences. We do not use advertising or cross-site tracking cookies. Blocking cookies will stop you from signing in.

Children

The platform is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child's data has reached us, contact us and we will delete it.

Reporting a vulnerability

If you believe you have found a security flaw in Jamah4U, please tell us before telling anyone else. Email [email protected] with enough detail to reproduce the issue — the address involved, the steps you took and what you saw.

We will acknowledge your report within 2 business days, keep you informed while we investigate, and credit you when the fix ships if you would like us to. We will not pursue legal action against researchers who report in good faith, stay within the boundaries below, and give us a reasonable chance to fix the problem before publishing. While testing, please do not access, modify or delete another restaurant's data (if you reach it, stop and report it), run denial-of-service or load tests against production, or use social engineering against our staff and customers.

If a breach occurs

If we confirm a breach affecting your data, we will notify affected subscribers without undue delay and in any case within 72 hours of confirming it. The notice will tell you what happened, what data was involved, what we have done to contain it, and what you should do at your end. We would rather send an early notice that turns out to be cautious than a late one that is complete.

Changes to this policy

We may update this policy as the product changes. The date at the top always reflects the current version, and we will notify subscribers in the app before any material change takes effect.

Contact us

Questions about this policy? Reach Jamah4U at:

• Email: [email protected]
• WhatsApp: +601154071220