Privacy policy

1. Who we are

Dhawaq (ذواق) is developed and operated by Cyberboost LLC, a company licensed in the Qatar Financial Centre under QFC Licence No. 03085 ("Cyberboost", "we", "us").

In this policy, a "merchant" is a restaurant, café or other business that subscribes to Dhawaq, "staff" are the people a merchant gives a login to, and a "guest" is anyone who opens a merchant’s menu, orders or pays a bill.

2. Our role

For data about merchants and their staff, and for data sent through this website, Cyberboost decides how the data is used and is the controller.

For data about guests (orders, table bills, payments, tips and ratings), the merchant whose menu the guest uses is the controller, and Cyberboost processes that data on the merchant’s behalf and on its instructions. If you are a guest and have a question about your order data, please contact the restaurant or café first. We will help them answer you.

3. What we collect

When you fill in the get-started or contact form on this website:

• business name, your name, email address, phone or WhatsApp number, city, number of branches and any message you write;
• the IP address the form was sent from, used to limit abuse and spam.

When you are a merchant or staff member:

• account details: usernames, names, email addresses and passwords (stored only as a secure hash, never in readable form), roles and the branches you can access;
• business details: branches, tables, waiters, opening information, billing and payment records of your subscription;
• if you connect it, the Gmail address and Google app password used to email your reports (the password is stored encrypted and never shown again);
• the content you add: menus, products, prices, descriptions, nutrition and allergen information, photos, logos, theme designs and custom domains;
• an audit log of important actions (for example sign-ins, settings changes and voided bills), with the time and the user who did them.

When you are a guest:

• you do not need an account. We record the orders you place, the table and table session they belong to, the bill and its payment status;
• if a merchant asks for it on an order (for example for a takeaway order), the name, email or phone number and note you choose to give;
• any tip you add and any waiter rating and comment you choose to leave;
• questions you ask the AI menu assistant, by text or voice (see section 5).

We do not ask for, and do not want, sensitive data such as health, religious or biometric information. Please do not put it in free-text fields.

4. Why we use it

• To provide the service: show menus, send orders to the kitchen, keep one bill per table, take payments and produce reports. The legal basis is the performance of our contract with the merchant, and the merchant’s own basis for serving its guests.
• To answer a get-started or contact request and to set up an account. The legal basis is the steps you asked us to take before a contract, and our legitimate interest in replying to business enquiries.
• To bill merchants and send account notices, such as payment reminders, daily and monthly reports and security messages.
• To keep the service secure: sign-in protection, rate limits, audit logs and fraud prevention. The legal basis is our legitimate interest, and the merchant’s, in a safe service.
• To meet legal obligations, for example accounting records and requests from competent authorities.

We do not sell personal data, we do not use it for advertising and we do not build profiles of guests across merchants.

5. The AI menu assistant

When a guest asks the AI assistant a question, the question (and, for voice questions, the audio recording) is sent with the merchant’s menu to our AI provider, Groq, Inc., to be transcribed and answered. Dhawaq does not keep the conversation or the recording after the answer is returned. We keep only a daily count of assistant requests per merchant, for usage limits, and delete those counts after 120 days.

Please do not tell the assistant personal or sensitive information. Answers are generated automatically and can be wrong: always confirm allergens and dietary needs with the staff.

6. Cookies and local storage

We use only the cookies and browser storage needed to make the service work. We do not use advertising, tracking or third-party analytics cookies, so we do not show a cookie banner.

• __Host-jwt: keeps merchant staff signed in to the panel and kitchen screen, for up to 12 hours.
• __Host-platform_jwt: keeps Dhawaq administrators signed in.
• __Host-table_session: links a guest’s phone to the table bill it joined, for up to 24 hours. Only a hashed form of the token is stored on our servers.
• table_ctx: remembers the table number from the QR code, for up to 24 hours.
• Local storage on your device keeps your cart, your chosen language, the selected branch and the assistant language. You can clear it at any time in your browser settings.

This marketing website itself sets no cookies.

7. Payments

Online payments of table bills are processed by SkipCash, under the merchant’s own SkipCash account. When you pay, you enter your card details on SkipCash’s payment page, not on Dhawaq. We never receive or store card numbers. We receive the payment result, amount, reference and time, so the bill can be marked as paid. SkipCash’s own privacy terms apply to what you give them.

Merchants’ SkipCash keys are stored encrypted (AES-256-GCM) and are only used to create payments and check their status.

8. Who receives the data

We share personal data only with the service providers we need to run Dhawaq, each under a contract that limits their use of it:

• Cloudflare, Inc.: DNS, network protection, custom domains and storage of images (Cloudflare R2);
• Groq, Inc.: transcription and answers for the AI menu assistant;
• SkipCash: card payments of table bills, for merchants who turn them on;
• our hosting and server providers, where the application and its databases run;
• Google (Gmail): reports and other emails for a merchant are sent from that merchant’s own Gmail account, which the merchant connects in its settings; Google’s terms apply to that account.

Staff of a merchant can see the data of their own business, within the permissions the owner gives them. We may also disclose data when the law requires it, to protect our rights or users’ safety, or to a buyer of our business that agrees to this policy.

9. International transfers

Some of the providers above process data outside Qatar, for example in the United States or the European Union. When data leaves Qatar, we rely on the provider’s contractual commitments and security measures to protect it to the standard this policy describes.

10. How long we keep data

• Get-started and contact requests: for as long as needed to follow up, and for up to 24 months if no account is created.
• Merchant accounts and their content, orders, bills and reports: for as long as the subscription is active. If a merchant cancels, the data is kept so the account can be reopened, until the merchant asks us to delete it, except records we must keep by law (such as billing records).
• Unused media: images removed from a menu and not used anywhere are deleted after 30 days.
• Design versions: the last 30 published versions of a menu design are kept.
• AI assistant usage counts: 120 days. Conversations and recordings are not stored.
• Guest session cookies: up to 24 hours on your device.

11. Security

We protect data with encrypted connections (HTTPS), passwords stored as argon2 hashes, encrypted payment keys and email app passwords, host-only secure cookies, two-factor authentication for Dhawaq administrators, separation of each merchant’s data, rate limits and audit logs. No system is perfectly secure; if a breach affects your data, we will inform the affected merchants, and the authorities where the law requires it.

12. Your rights

Depending on the law that applies to you, you can ask to access the personal data we hold about you, correct it, delete it, restrict or object to its use, or receive a copy. You can also withdraw any consent you gave.

To use these rights, write to [email protected]. We may ask you to confirm your identity. For guest data, we pass your request to the merchant concerned, which decides on it as controller. If you are not satisfied with our answer, you may complain to the QFC Data Protection Office, or to the competent authority in the State of Qatar.

13. Children

Dhawaq is a service for businesses. Merchant and staff accounts are not intended for anyone under 18. Guests of any age may view menus, but we do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy when the service or the law changes. We will change the date at the top of this page and, for significant changes, tell merchants by email before they take effect.

15. Contact

Cyberboost LLC, Qatar Financial Centre, Doha, Qatar. Email: [email protected].