Privacy policy

Who we are

Onetap is provided by Company legal name, trade licence / commercial registration number, registered at registered address ("Onetap", "we"). You can reach us at privacy email.

We operate in the United Arab Emirates and the Kingdom of Saudi Arabia and handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the Saudi Personal Data Protection Law, as they apply.

Two roles: for restaurants, and for ourselves

When you order, pay, book or join a rewards card at a restaurant, that restaurant decides how your data is used. Onetap processes it on the restaurant's behalf, under our agreement with them. For questions about a restaurant's own use of your data, contact the restaurant.

For restaurant owners and staff using our apps, and for visitors to this website, Onetap decides how the data is used.

What we collect

At the table and when ordering online: the table or branch, what you order, notes such as allergies you type in, payment status and amounts. Card payments are handled by our payment provider; we never see or store full card numbers.

If you verify your phone number or join a rewards card: your mobile number, and if you choose to add them, your name and birthday; your visits, stamps or points and vouchers. You can also keep a card on your phone without a number.

Bookings and the waitlist: name, phone number, party size, time, occasion and notes.

Messages with our AI concierge on the website, WhatsApp, Instagram or by phone: the conversation text. Phone calls are turned into text by our telephony provider; we keep the text, not the recording.

Feedback and reviews you choose to leave.

Restaurant staff: name, email, phone number, role, branch, clock-in times and actions taken in the apps.

Website visitors who request a demo: name, restaurant, WhatsApp number, email if given, city, number of branches, your message, and the page and campaign you came from.

Technical data: IP address and device information, used for security and to prevent abuse; your browser's local storage, used to remember your language and keep you signed in to your rewards card.

How we use it

To provide the service: show menus, send orders to the kitchen, take payments, issue receipts and tax invoices, manage bookings and rewards.

To send messages you asked for: login codes, order and booking updates on WhatsApp.

Marketing messages from a restaurant only if you ticked the box to receive offers. Reply STOP on WhatsApp at any time to stop them.

To keep the service secure, prevent fraud and abuse, and meet legal and tax obligations.

To improve the product using aggregated, non-identifying statistics.

Legal bases

We rely on performing the service you asked for, your consent (for marketing and optional profile details, which you can withdraw), our legitimate interest in security and fraud prevention, and legal obligations such as keeping tax invoices.

Who we share it with

The restaurant you visit or order from. Service providers who process data for us under contract: hosting provider and region, e.g. Supabase (region), Tap Payments (card payments), Meta (WhatsApp and Instagram messages), Twilio (phone calls), Google and Apple (Wallet passes, Google reviews), Firebase (staff notifications), Anthropic (AI concierge), and e-invoicing provider for tax reporting where required.

Authorities, when the law requires it. We do not sell personal data.

Transfers outside your country

Some providers process data outside the UAE or Saudi Arabia. Where that happens we rely on the safeguards the applicable law requires, such as adequacy decisions or contractual protections. Confirm data residency and transfer mechanism with counsel.

How long we keep it

Orders, payments and tax invoices: as long as tax law requires (confirm period for the UAE and for KSA). Rewards card data: until you delete it or the restaurant closes its account. Booking and chat data: retention period. Demo requests: retention period. Unused rewards card sign-ins end after 180 days.

Your rights

You can ask to access, correct or delete your data, object to or restrict some uses, and withdraw consent. You can delete your rewards profile yourself from the card at any time.

Contact the restaurant for data they control, or us at privacy email. You can also complain to the UAE Data Office or the Saudi Data & AI Authority (SDAIA).

Security

Each restaurant's data is kept separate at the database level, connections are encrypted, and sensitive tokens are stored encrypted or hashed. No system is perfectly secure; we will notify affected people and authorities of a breach as the law requires.

Children

Onetap isn't directed at children under age. Restaurant guests of any age may be served, but rewards cards and marketing are for adults.

Changes

We will update this page when our practices change and note the date at the top. Material changes will be announced in the app or by email to restaurant customers.