Privacy Commitments
- Zero Data Selling: We never sell personal data or monetize guest browsing history.
- Private Guest Feedback: Feedback submitted through digital menus goes directly to the restaurant owner. Contact details are always optional.
- Payment Privacy: We verify Telebirr & CBE screenshots manually. We never ask for or store your bank PINs or OTP passwords.
1. Scope and who is responsible
This Privacy Policy explains how DawaMenu (“DawaMenu,” “we,” “us,” or “our”) handles personal data when people create or manage an account, use the DawaMenu dashboard, visit public business pages and digital menus, submit guest feedback, interact with QR/NFC links, upload payment evidence, or contact support.
For account registration, authentication, platform security, subscription administration, and our own business operations, DawaMenu determines how the relevant data is used and acts as the controller where the law defines that role.
When a restaurant or other business uses DawaMenu to collect feedback, publish contact information, or display a business page, DawaMenu may process some personal data on that business’s instructions. The business owner should provide any venue-specific privacy notice and choose which optional guest details to request.
2. Personal data we collect
We collect only data reasonably needed to operate, secure, support, and improve the Service:
2.1 Account and authentication data
Name, username, email address, phone number, and business role if supplied. Account identifiers, password hash (not your plain-text password), email-verification status, session/authentication records, and account-security events.
2.2 Business profile and menu data
Business name, logo, banner, description, address, business hours, phone/email, website, social-media links, menu categories, item names/descriptions/prices, dietary labels, and optional item photographs. Wi-Fi network name and password if the business chooses to store and publish them.
2.3 Guest feedback data
Star ratings, food/service/cleanliness ratings, comments, submission time, optional name, and optional phone number or email address. The venue receiving feedback can view these details.
2.4 Payments and subscription records
Selected plan, term, amount, currency (ETB), payment channel (Telebirr or CBE), transaction/reference number, payer name, and receipt screenshots uploaded for manual verification. Never send DawaMenu your banking PIN, one-time password (OTP), or full banking login credentials.
2.5 Usage, QR scan, device, and security data
Public page views, QR visits, menu opens, clicks on configured links, timestamps, basic device info, referring source where available, and IP address in security logs. We do not need a guest’s exact GPS coordinates to count a QR visit.
3. Why we use data
- creating accounts, authenticating users, verifying email addresses, and enabling password resets;
- creating and maintaining business pages, menus, QR/NFC destinations, print exports, and configured links;
- calculating subscription periods, receiving payment evidence, verifying transfers, issuing invoices/receipts, and handling payment questions;
- showing scan and engagement analytics to the relevant business;
- delivering service, security, trial-expiry, payment, subscription, and account notifications;
- answering support requests and handling complaints;
- detecting fraud, unauthorized access, abuse, errors, and security incidents;
- complying with applicable legal, tax, accounting, and regulatory obligations.
We do not sell personal data. We do not use guest feedback contact details for DawaMenu marketing.
4. Public business pages and guest feedback
A business owner decides what profile information, menu content, social links, contact information, and Wi-Fi details are published publicly. Public information can be viewed, copied, indexed, or shared by visitors.
When a guest submits feedback to a business, the feedback is provided to that business through DawaMenu. DawaMenu does not direct guest feedback to Google based on whether it is positive or negative. Google review links and private feedback are separate choices.
5. Legal grounds and choices
We handle data on the basis permitted by applicable Ethiopian law, including where needed to perform a service agreement, operate and secure the platform, meet legal obligations, resolve claims, or where the individual has provided valid consent.
Marketing opt-in, where offered, is separate from accepting the Terms of Service and acknowledging this Privacy Policy. You may withdraw marketing consent at any time without losing essential account/service communications.
7. International processing and transfers
Some infrastructure or service providers may store or process data in countries outside Ethiopia. DawaMenu complies with the requirements of the Ethiopian Personal Data Protection Proclamation No. 1321/2024 regarding cross-border transfers and transfer safeguards.
8. Data retention
We keep personal data only for as long as reasonably needed for the stated purpose, the customer relationship, security, and applicable legal/accounting requirements:
- Account data: Retained while the account is active; upon closure, retained for a limited recovery window before deletion.
- Payment evidence & invoices: Retained for 7 years to comply with Ethiopian tax and accounting rules.
- Guest feedback: Retained for the period needed by the business to review and act upon feedback.
- Detailed scan logs: Retained for up to 90 days before aggregating into non-personal statistics.
9. Security
We use technical and organizational safeguards suitable for a multi-tenant SaaS service, including role-based access control, cryptographic password hashing (Scrypt), encrypted transport (TLS/HTTPS), database isolation, and security incident response.
10. Your privacy rights
Subject to Ethiopian Personal Data Protection Proclamation No. 1321/2024, individuals may have the right to request access to their personal data, correction of inaccurate data, deletion, restriction of processing, objection, data portability, and withdrawal of consent.
To submit a request, email temp3945@gmail.com.
12. Children
DawaMenu business accounts are intended for adults who can lawfully enter into business contracts. If you believe a child has provided personal information, please contact us.
13. Changes to this Policy
We may update this Policy when our practices or legal obligations change. We will publish new versions with an updated effective date.