privacy
PRIVACY POLICY
Menusday E-Commerce and Cloud Services Platform
Version 1.0 | Last Updated: 19 August 2026
1. Introduction
Menusday respects the privacy of its users and is committed to protecting personal data and processing it in a lawful, fair, and transparent manner in accordance with the laws and regulations applicable in the Kingdom of Saudi Arabia, particularly the Personal Data Protection Law (PDPL) and its Implementing Regulations, where applicable.
This Policy explains how personal data is collected, used, processed, disclosed, stored, protected, and destroyed. It also explains the rights of data subjects and how those rights may be exercised.
This Policy applies to menusday.com, dashboards, applications, services, interfaces, and digital features associated with the Menusday Platform, unless a particular service provides a separate privacy notice.
2. Who is Menusday?
Menusday is a cloud-based e-commerce platform that enables users to create and manage stores and digital services. Depending on the plan and activation, its features include e-commerce, order and delivery management, reservations, events, QR codes, reports and analytics, and other operational tools.
Legal name of the entity owning the Platform: Menusday
Trade name: Menusday
National Address / Headquarters: Kingdom of Saudi Arabia, Abha City, Building No. 7528, Secondary No. 2804, Postal Code 62512
General Email: info@menusday.com
Privacy / Data Protection Contact Email: info@menusday.com
Website: menusday.com
3. Scope of the Policy
Depending on the nature of the relationship and service, this Policy covers data relating to the following categories:
Visitors to the Menusday website.
Individuals who create an account or request a trial or subscription.
Owners, managers, and employees of businesses and stores subscribed to Menusday.
Users authorized to access dashboards.
Individuals who contact technical support or sales.
End consumers who deal with stores operating through Menusday, to the extent that the Platform processes their data.
Beneficiaries of reservation, event, delivery, or other services operated by Menusday Customers.
4. Roles of Controller and Processor
Menusday’s legal role may vary depending on the purpose of processing. When Menusday determines the purposes and means of processing data relating to its accounts and subscribers, such as account management, subscriptions, billing, security, and support, it may act as a “Controller.”
When a store or business uses the Menusday Platform to process its customers’ and consumers’ data according to its instructions and for purposes determined by that store or business, the store may act as the Controller and Menusday may act as a Processor, depending on the nature of the processing and the agreement between the parties.
This Policy does not alter the allocation of responsibilities imposed by applicable law or by any Data Processing Agreement entered into between Menusday and the Customer.
5. What Personal Data May We Collect?
The data we collect depends on how you use the Platform and the Services you choose. It may include the following categories:
Identity and account data: name, username, job title, and information about the business associated with the account.
Contact data: email address, mobile number, mailing address, or business address where required.
Business data: trade name, commercial registration, tax number, branch information, and nature of business where required to provide or verify the Service.
Login and security data: login records, IP address, login times, session information, login attempts, and permissions.
Device and usage data: device type, browser, operating system, language, pages or features used, performance data, and error information.
Subscription and billing data: plan, billing cycle, invoices, amounts, payment status, and subscription history.
Payment data: transaction-related information such as amount, currency, payment status, transaction reference, and payment method. Sensitive card information may be processed directly by the payment gateway, and Menusday does not retain the full card number where the actual integration is designed in this manner.
Store and order data: product information, orders, customers, delivery addresses, order status, and transaction history according to the Store’s use of the Platform.
Reservation and event data: name, contact information, appointment, reservation, ticket or attendance information, and any data specified by the service provider in the relevant form.
Delivery data: delivery address or area, delivery instructions, and delivery status, and may include location data to the extent necessary if a location-dependent feature is enabled.
Support data: messages, attachments, support request records, and information submitted by the User to resolve an issue.
Marketing and preference data: marketing consents, communication preferences, and campaign interactions when used.
User-provided Content: text, images, files, and information uploaded to the Platform.
6. Data We Do Not Normally Request
Menusday does not seek to collect sensitive data unless a specific service creates a legitimate and defined need for it and such collection is legally permitted with appropriate safeguards. Platform Customers should avoid collecting sensitive data from their customers through custom fields unless such data is necessary, lawful, and protected in accordance with applicable legal requirements.
7. How Do We Collect Data?
Directly from you when you register, create an account, subscribe, or update your profile.
When you create a Store, add Users, or configure Service settings.
When an order, reservation, payment, refund, or other operational feature is used.
When you contact us through support, email, forms, or approved communication channels.
Automatically through system logs, cookies, and similar technologies, as permitted by law.
From our business Customers when they process the data of their Store users through the Menusday Platform.
From service providers integrated with the Platform, such as payment gateways, messaging services, or delivery providers, to the extent necessary to operate the Service.
8. Purposes of Processing Personal Data
We may process personal data for the following purposes, depending on the type of data and Service:
Creating, verifying, and managing accounts.
Providing and operating Menusday Services and enabling Users to use Platform features.
Creating Stores and managing orders, reservations, events, delivery, and related Services.
Managing subscriptions, invoices, payments, refunds, and financial records.
Providing technical support and customer service and handling reports and issues.
Protecting accounts and systems and detecting fraud, misuse, and unauthorized activities.
Improving Platform performance and User experience, developing features, and fixing errors.
Conducting internal analytics and statistics and understanding usage patterns, while minimizing data or anonymizing it where appropriate.
Sending important operational notices relating to accounts, orders, invoices, security, or Services.
Sending marketing communications where an appropriate legal basis exists and enabling Users to opt out where required.
Complying with legal obligations and requests from competent authorities and protecting legal rights and claims.
Performing contracts and agreements entered into with Customers and managing the business relationship.
9. Legal Basis for Processing
Menusday relies on the appropriate legal basis for each processing activity in accordance with the Personal Data Protection Law and its regulations. This may include the data subject’s consent where required, performance of a contract to which the data subject is a party, compliance with a legal obligation, pursuit of a legitimate interest in cases permitted by law after considering the rights and interests of the data subject, or any other basis permitted by law.
Where processing is based on consent, the data subject may withdraw consent in accordance with applicable legal requirements, without affecting the lawfulness of processing carried out before withdrawal.
10. Mandatory and Optional Data
Certain data is necessary to create an account, perform the Service, or satisfy legal requirements, and failure to provide it may prevent account creation or the provision of a particular feature. Optional data will be identified, where necessary, in the form or context in which it is collected.
11. Store Customer Data
Menusday enables its Customers to create and operate Stores and process End Consumer data. Where the Store determines the purposes for collecting consumer data and how it is used, the Store is responsible for providing an appropriate privacy notice to its customers, identifying the legal basis for processing, and responding to data-subject rights.
Menusday processes such data to the extent necessary to provide Services to the Store and in accordance with lawful instructions and contractual arrangements. A consumer wishing to exercise a right relating to data controlled by a particular Store should contact the Store first, with Menusday cooperating with the Customer where necessary and in accordance with applicable law.
12. Payments
Menusday may use external payment providers to process subscription fees or transactions. The payment provider may receive card or account data necessary to complete the transaction in accordance with its own terms and privacy policy.
Menusday generally retains transaction reference data, such as the transaction number, amount, status, and payment method, to the extent necessary for billing, accounting, support, and fraud prevention. The actual technical implementation should determine whether Menusday receives or stores any portion of card data.
13. Cookies
The Menusday website may use cookies and similar technologies to operate the website, maintain sessions and preferences, enhance security, measure performance, and understand usage. Depending on the actual implementation, these may be categorized as:
Necessary cookies: required for website, account, and security functions.
Preference cookies: store language, settings, and User choices.
Analytics cookies: help understand website usage and improve performance.
Marketing cookies: used to measure campaigns or personalize marketing where enabled and where required consents are obtained.
14. Analytics and Performance Measurement
Menusday may use internal or third-party analytics and performance-measurement tools. The tools actually used, such as web analytics or error-monitoring tools, should be identified together with the nature of the data they receive and, where applicable, the location in which it is processed.
15. Messages and Notifications
We send necessary operational communications such as account, security, billing, order, and support notifications. We may send marketing communications where an appropriate legal basis exists. Users may unsubscribe from marketing messages through an unsubscribe link, account settings, or by contacting us, while necessary operational communications may continue.
16. When Do We Share Data?
We do not sell personal data. We may disclose or share it, to the extent necessary, with the following categories:
Hosting, infrastructure, and cloud-computing providers.
Payment gateways, banks, and financial institutions involved in processing transactions.
Messaging, email, notification, and support-service providers.
Delivery companies or providers when the Customer requests a delivery integration.
Analytics, cybersecurity, and performance-monitoring providers, where used.
Advisers, auditors, and professional service providers where necessary and subject to appropriate safeguards.
Governmental, judicial, or regulatory authorities where disclosure is legally required.
A successor or acquiring party in connection with a restructuring, merger, or acquisition, subject to applicable legal requirements.
Processors acting on behalf of Menusday must process data in accordance with the relevant purposes, instructions, and appropriate contractual and regulatory safeguards.
17. Transfer of Data Outside the Kingdom
Certain technical Services may require personal data to be processed or stored outside the Kingdom of Saudi Arabia if a service provider or the infrastructure used operates in another country. Any statement regarding whether international transfers occur should reflect the actual technical infrastructure.
When personal data is transferred outside the Kingdom, Menusday complies with the applicable legal requirements and controls governing cross-border transfers of personal data, including assessment of the necessary requirements and safeguards as appropriate to the circumstances.
18. Data Retention Period
We retain personal data only for as long as necessary to achieve the purposes for which it was collected, for periods required by applicable laws and regulations, or where legitimately necessary to resolve disputes and establish rights and obligations.
The retention period varies according to the type of data and its purpose. Menusday should maintain an internal retention schedule covering account data, invoices, transaction records, support records, security logs, and Store data following the end of a subscription.
19. Destruction or Anonymization of Data
When there is no longer a legal or operational need for personal data, Menusday takes appropriate measures to securely destroy it or anonymize it so that it can no longer be linked to the data subject, unless a legal obligation requires longer retention.
20. Data Security and Protection
Menusday applies appropriate technical and organizational measures to protect personal data against unauthorized access, use, disclosure, alteration, loss, or destruction. Depending on the actual technical infrastructure, such measures may include access controls, encryption, backups, security monitoring, vulnerability management, and event logging.
No electronic method can guarantee absolute security. We therefore review our security controls periodically and apply reasonable measures appropriate to the level of risk.
21. Permissions of Store Employees
The Customer may grant its employees or representatives permissions within the dashboard. The Customer is responsible for managing and revoking those permissions when no longer required and for avoiding permissions that exceed business needs. The Platform may retain logs of administrative actions for security and accountability purposes.
22. Accuracy of Data
We seek to maintain the accuracy and relevance of data for its intended purpose. Users must update their account information when it changes. We may request verification of certain information before modifying it where necessary to protect the account or comply with legal requirements.
23. Data Subject Rights
Under the Personal Data Protection Law and applicable requirements, data subjects may have rights including:
The right to be informed of the legal basis and purpose for collecting and processing personal data.
The right to access personal data in accordance with applicable legal requirements.
The right to obtain a copy of personal data in a clear and readable format where applicable.
The right to request correction, completion, or updating of inaccurate personal data.
The right to request destruction of personal data in circumstances prescribed by law.
The right to withdraw consent where consent is the legal basis for processing, subject to applicable requirements.
Any other rights established by the law and its Implementing Regulations.
Certain rights may be subject to legal limitations or exceptions, such as a legal obligation to retain particular data.
24. How to Exercise Your Rights
A request concerning personal data may be submitted through the privacy email: info@menusday.com.
We may request reasonable information to verify the identity of the requester and prevent unauthorized disclosure. We will handle requests within the time limits and in accordance with the requirements prescribed by law. If the data concerned is controlled by a Store using Menusday, we may refer the data subject to that Store or cooperate with it in handling the request according to the allocation of roles.
25. Complaints
If you have a complaint concerning the processing of your data, we recommend contacting Menusday first through the designated privacy channel so that we can review and address the complaint. This does not prejudice the data subject’s right to submit a complaint to the competent authority in accordance with applicable procedures.
26. Personal Data Breach Incidents
Menusday applies procedures for responding to security incidents. If an incident affecting personal data occurs, it will be assessed and necessary measures will be taken, including notification to the competent authority or the data subject where the applicable legal conditions and requirements for notification are met.
27. Privacy of Children and Minors
Menusday Services are primarily intended for business owners, businesses, and Users legally capable of entering into contracts. The Platform does not independently target the collection of children’s data unless a service provided by a Menusday Customer legitimately requires such processing.
When a minor’s data is processed, the relevant Controller must observe the applicable requirements concerning legal capacity, consent, and additional protections, as required by law in the circumstances.
28. External Links and Services
The Platform may include links to or integrations with websites and services operated by third parties. Menusday does not control the privacy practices of those parties, and Users are advised to review their privacy policies before providing data to them.
29. Automated Decision-Making and Artificial Intelligence
If Menusday uses automated processing or artificial intelligence technologies in the future to make decisions that have a material effect on individuals, applicable legal requirements will be assessed and appropriate disclosures and safeguards will be added before implementation. This Policy does not state that such decision-making is currently in use unless it is actually implemented.
30. Changes in Ownership or Business Structure
If Menusday merges with another entity, is acquired, or transfers part of its business, data may be transferred to the successor entity to the extent necessary, subject to applicable legal requirements and continued protection of the data under this Policy or a policy providing an appropriate level of protection.
31. Updates to the Privacy Policy
We may update this Policy due to changes in Services, technical practices, or legal requirements. We will publish the updated version together with the date of the latest update and may provide an additional notice where the change is material or where required by law.
We recommend reviewing this Policy periodically for updates.
32. Contact Us
For inquiries, requests to exercise rights, or privacy-related complaints, please contact us through:
Privacy Team / Responsible Person: Customer Relations Manager
Email: info@menusday.com
Address: Kingdom of Saudi Arabia, Abha City, Building No. 7528, Secondary No. 2804, Postal Code 62512
Website: menusday.com
33. Special Provisions for Menusday Business Customers
Every Store or business using Menusday must prepare and publish its own Privacy Policy consistent with the way it collects and uses its customers’ data. Menusday’s Privacy Policy does not replace the Store’s Privacy Policy because the Store may determine additional processing purposes outside Menusday’s control, such as the Store’s own marketing, loyalty programs, or independent delivery operations.