Privacy Policy
Last updated: September 5, 2026 • Effective date: September 5, 2026
1. Overview & Multi-Tenant Commitment
Talabq ("Talabq", "we", "us", or "our") provides a multi-tenant SaaS platform powering digital menus, contactless QR ordering, kitchen management, inventory, and business intelligence for restaurants, cafes, coffee shops, bakeries, and food & beverage establishments.
This Privacy Policy articulates how we process, protect, and isolate data collected from our subscribers (business owners, managers, staff) as well as end-user diners interacting with public QR menus and online ordering touchpoints.
2. Information We Collect
A. Business Account Information
When an establishment registers on Talabq, we collect full name, business name, business type (restaurant, cafe, etc.), business email, contact telephone, physical branch addresses, country, tax identifiers, and billing profile details.
B. Customer & Diner Data (Public QR Menus)
When diners scan a table QR code or place orders through digital menus, we collect customer name, mobile phone number, delivery address (if off-premise ordering is enabled), order notes, dietary preferences, and transaction details. We do not store raw credit card credentials.
C. Telemetry, Analytics & Device Diagnostics
To ensure system uptime and security, we collect IP addresses, browser user-agent tokens, table QR scan timestamps, referrer URLs, and error diagnostics.
3. Data Isolation & Zero-Leakage Architecture
Every subscriber on Talabq operates within an isolated tenant partition. Menu catalogs, ordering pipelines, customer RFM databases, and financial reports are enforced with strict foreign-key scoping and server-side authorization policies. Tenant A can never view, mutate, or access customer or transactional records belonging to Tenant B.
4. Payment Processing Compliance
Subscription billings and guest online payments are conducted via PCI-DSS certified payment processors (Stripe and Paymob). Payment tokens, cards, and bank account numbers are processed directly on encrypted external gateway rails. Talabq only logs sanitized webhook event summaries and idempotent transaction identifiers.
5. Data Retention & User Rights
Under GDPR and regional data protection frameworks, business owners and diners maintain the right to inspect, export, or request deletion of their personal records. Data erasure requests can be dispatched to privacy@talabq.com.
6. Inquiries & Data Protection Officer
For privacy or regulatory compliance questions, contact our team at:
Email: privacy@talabq.com
Address: Cairo / Riyadh / Dubai Regional SaaS Operations