Privacy policy

This is one policy for everyone the Mahsooba platform touches: restaurant owners and their staff, and the customers of every restaurant that orders through an app built on Mahsooba.

Who we are

Mahsooba is a platform for running restaurants. It is operated by Tatbeeki.

• Company: Tatbeeki
• Email: [email protected]

Each restaurant on Mahsooba has an ordering app under its own name. When you order from that app, you are dealing with the restaurant. We run the platform that stores your order and passes it to the restaurant.

What data we collect

Customers of restaurant apps

• Your name and email from your Google account, when you sign in with Google.
• If you sign in with Apple: the account ID Apple gives this app, the email Apple shares (it may be a private relay address), and a token from Apple, kept encrypted and used only to cancel your Apple sign-in when you delete your account.
• If you sign in with your phone number and a password: your password, kept only in a one-way scrambled form that nobody can read back, the restaurant included.
• Your phone number.
• Your delivery addresses, with a pin on the map if you choose to set one. The pin is optional.
• Your orders, your points, and the promo codes you used.
• Your phone’s notification token, so we can send you updates on your order.

Customers recorded by restaurant staff

For a phone or counter order, a staff member may record the customer’s name, phone number and address.

Restaurant staff

• Name, login email, and role.
• Password and PIN. Both are stored hashed, which cannot be reversed. No one can read them, including us.
• A record of who changed what, and when.

Payments

Payment on Mahsooba is cash or cash on delivery only. We do not collect or store any card data. If we add online payment later, we will update this policy first, before it goes live.

Why we use this data

• To record your order and pass it to the restaurant, and then to you.
• To send you notifications about your order’s status.
• To apply points and promo codes.
• To let staff sign in, protect accounts, and show who changed what.
• To reply to you when you contact us.

We do not sell data. We do not use it for ads.

Who sees your data

• The restaurant you ordered from, and its staff. Each restaurant sees only its own orders.
• The companies that run the service for us, only as far as their role requires (see the next section).
• An official authority, if the law requires us to share it.

Where the data is kept

• On a server in the United Kingdom.
• Backups are kept, encrypted, in the European Union.
• The app talks to the server over an encrypted connection (HTTPS).
• Every request to the platform passes through Cloudflare. Cloudflare handles each request, including your device’s IP address.
• We use Google for sign-in, for sending notifications, for the map and for crash reports.

The customer app

Third-party SDKs used inside the customer app:

• Google: for Sign in with Google, and to deliver notifications (Firebase Cloud Messaging).
• Google: to show the map and choose the delivery spot (Google Maps).
• Google: for crash reports (Firebase Crashlytics). When the app crashes, we receive a crash report only: where in the code it failed and the error type, the device model, the system and app versions, the time, the device’s state at that moment (screen orientation, free memory and storage, whether it’s rooted), and a random install ID. We use it only to fix crashes, never for advertising or analytics. No names, phone numbers, addresses, order contents or sign-in data.
• Apple: for Sign in with Apple.

This website uses Google Analytics, through Cloudflare, to count visits and see which pages and buttons are used, on what kind of device and from roughly which city. What you type on the site is never sent to Google Analytics, and we don't use this data for ads or sell it.

What you enter in the simulator (such as the restaurant name and the menu), and what you try in it, is kept on Mahsooba's own server only, to improve Mahsooba and to contact your restaurant. It is never sent to Google Analytics or anyone else, and we keep with it the country you visit from, not your IP address.

Deleting your account and data

• Inside the app: Account → Delete my account.
• Or by request on the delete your account page.

When your account is deleted, you are signed out of the app on every device, notifications stop, and your data disappears from the app. We may keep account data after an account is deleted, to prevent misuse and for the restaurant’s records.

You can also ask us for a copy of your data, or to correct it, by contacting us.

Changes to this policy

If we change this policy, we publish the new version here and update the date below.

Contact us

Email: [email protected]

WhatsApp: +20 100 686 9680

The Arabic version of this policy is the reference if the two differ.

Last updated: 6 November 2026