Privacy policy

• Visitors to this website, including anyone who sends us the interest form.
• Customers who order from a cafeteria’s shop or pay through a payment link sent by a cafeteria.
• Cafeteria staff (owners, kitchen and delivery staff) and company administrators who sign in to CafeteriaBills.

For orders and payments, the cafeteria you order from decides what it needs from you and is the controller of that data. Scale Nxt processes it on the cafeteria’s behalf to run the service. For this website and the interest form, Scale Nxt is the controller.

Interest form. Your name, business name, phone number, country, number of branches and, if you give them, an email address and a message. We also record the date, IP address and browser type to protect the form from abuse.

Customers. The phone number and delivery address you give when ordering, the items you ordered, the order status and the payment status reported by the payment gateway. Your browser may remember your name, phone and address so you do not type them again; this is stored on your device only and you can clear it at any time.

Staff and administrators. Name, phone number or email, role and branch, sign-in times and the actions you take in the app (for example marking an order as paid or ready). PINs and passwords are stored only as salted hashes.

Payments. Card payments are handled by a licensed payment gateway in Qatar or the UAE. Card numbers are entered on the gateway’s pages and never reach Scale Nxt’s servers. We receive only the outcome of the payment, the amount and a gateway reference.

Technical data. Server logs with IP address, time, request path and browser type, kept briefly for security and troubleshooting.

• To contact you about a demo or your account when you ask us to through the interest form.
• To create, deliver and track orders and to confirm payments.
• To send order and payment links on WhatsApp when a cafeteria chooses to.
• To let staff sign in securely and to limit each person to the actions of their role.
• To produce daily reports for cafeteria owners and to detect payment problems.
• To prevent fraud and abuse, to keep the service secure and to meet legal obligations.

We do not sell personal data and we do not use it for third-party advertising.

We use a small number of strictly necessary cookies: a session cookie that keeps staff and administrators signed in, and a cookie that remembers your language (English or Arabic). The customer shop keeps your cart and saved contact details in your browser’s local storage. We do not use advertising or cross-site tracking cookies.

• The cafeteria you order from, which needs your phone number and address to prepare and deliver the order.
• Payment gateways licensed in Qatar or the UAE, to process card payments.
• Hosting and database providers that run the service under contract with us, with data stored in regional or EU data centres.
• Authorities where the law requires it.

• Interest form requests: until we have followed up and for up to 24 months afterwards, unless you ask us to delete them earlier.
• Orders and payment records: for as long as the cafeteria uses the service and as required by tax and accounting law, typically 5 years.
• Staff accounts: while the account exists; audit records of actions are kept for 24 months.
• Server logs: up to 90 days.

You can ask us to access, correct or delete personal data we hold about you, to restrict how we use it, or to receive a copy of it. If you are a customer of a cafeteria, we may direct your request to that cafeteria or help them answer it. We respond within 30 days. You may also complain to the data protection authority in your country.

All traffic is encrypted in transit. Prices and totals are computed on our servers, never trusted from the browser. Access to data is restricted by role and logged. Gateway credentials are stored encrypted. No system is perfectly secure, so please contact us immediately if you believe your account has been misused.

CafeteriaBills is a business tool and is not directed at children under 18. We do not knowingly collect data from children.

We may update this policy as the service evolves. The date at the top shows the latest version. Significant changes will be announced in the app or on this website.