01 Controller vs. Processor
We distinguish between two types of data:
- Merchant Data: Masil altiqniyah Establishment is the "Data Controller" for this data (e.g., Merchant name, CR, payment info).
- End-User Data: The Merchant is the Controller. Masil altiqniyah Establishment is the "Data Processor". We do not own or sell this data.
End-User Data includes everything a restaurant processes through the platform about its own customers, staff, suppliers and operations — orders, Point of Sale transactions, purchasing and stock records. We process it only to provide the services the restaurant has enabled, on its instructions.
02 Data We Collect
About you, the merchant
- Account Info: Name, Email, Phone, Company Name.
- Billing Info: Payment details (processed via secure, SAMA-certified gateways).
- Technical Data: IP address, performance logs.
What your restaurant processes through the platform
- Orders and customers: orders from the app, web storefront and phone, customer names, phone numbers, delivery addresses and order history.
- Point of Sale transactions: items sold, prices, discounts, VAT, payment method (cash or card) and amount, the register, shift and cashier, cash in and cash out movements, refunds and voids, and opening and closing cash counts.
- Inventory & Procurement: items, recipes and stock levels; supplier names, contact persons, phone numbers, email and addresses; purchase requisitions, purchase orders, deliveries, supplier invoices, payments, and the restaurant's purchasing ledger.
- Staff and activity: staff names, roles and permissions, and an audit log of who approved, received, changed or paid what, and when.
Card payments at the counter are taken by your card terminal or payment provider. The platform records that a card was used and the amount; it does not receive or store full card numbers.
03 How We Use Data
Data is used for the following purposes:
- Account creation and platform setup.
- Running the services you enable — ordering, Point of Sale, kitchen display, fleet and Inventory & Procurement — including sending purchase orders to your suppliers when you approve them.
- Payment processing and compliant invoicing.
- Providing technical support.
- Keeping the service secure, investigating faults and preventing misuse.
We do not use one restaurant's sales, customer, supplier or purchasing data to benefit another restaurant, and we do not market to your customers.
05 Security
- Data is encrypted in transit and kept on access-controlled infrastructure.
- Every restaurant's data is kept separate from every other restaurant's.
- Staff see only what their role allows, and money-moving steps — purchase approvals, invoice approvals and supplier payments — are separated between people and recorded in an audit log.
06 Retention
We keep data for as long as your account is active. Financial records — Point of Sale transactions, tax invoices, supplier invoices, payments and ledger entries — are kept for the period Saudi tax and commercial law requires, even after cancellation. Other data is deleted or returned to you on request when you leave.
07 Your Rights
Under PDPL, you have the right to:
- Access & Correction: Request to view or correct your data.
- Erasure: Request data deletion upon cancellation.
- Data Portability: Export your customer database anytime.
Your customers, staff and suppliers should direct requests about their data to your restaurant, as the controller; we will help you respond to them.
08 Contact Us
If you have any questions regarding this Privacy Policy, please contact us at: info@masil.sa