KhaoPilao Privacy Policy

This Policy explains what personal data KhaoPilao collects when you use the website at khaokhilao.com, why, who sees it, and the choices you have. KhaoPilao is operated by Jenix Labs (SMC-Private) Limited, House No. 73, Midland Avenue, Model Town, T-Chowk, Multan, Pakistan ("KhaoPilao", "we", "us"). The date this Policy took effect is shown at the top of this page. 1. The data we collect Account - Your email address, which you use to sign in with a one-time code. - The name you give us. It is shown on your orders so that restaurants and riders know who an order is for. - A record of which version of our Terms and this Policy you accepted. Delivery addresses, if you save them - Your address line, area and label (such as Home or Work). - Building, landmark and delivery instructions, if you add them. We do not store map coordinates with your addresses. Your area and location - The delivery area you choose. - If you press the button to use your current location, your browser asks for permission. Your position is rounded to about 100 metres and sent to our server only to find your nearest area. We do not use your location in the background. Orders - The restaurant, items, options, quantities, notes and preferences, whether it is delivery or pickup, the voucher you use, the total, and the order's status history. - A copy of the delivery address as it was when you ordered. Later changes to your saved address do not change past orders. Other activity - Restaurants you save as favourites. - What you type in search, which is sent to our server to give you results. Technical data - Details of your session, such as when it started, when it was last active, and the type of device or browser. - Your IP address and request details, which pass through our hosting providers and may be recorded in their logs and ours. We do not ask for your phone number. Do not include one, or other sensitive details, in a note or in delivery instructions unless you are happy for the restaurant and rider to see it. Orders are paid in cash on delivery or pickup. We do not collect card or wallet details, and we do not take online payment on this website. 2. How we use your data We use your data to: - create your account, and sign you in; - show restaurants and offers in your area; - price, place and track your orders, and pass them to the restaurant and rider; - remember your addresses, favourites and preferences; - keep the service secure, and prevent fraud and misuse; - deal with questions or problems about your account or an order; - meet our legal obligations. We process your data because it is needed to provide the service you asked for, because you have accepted it, because of our legitimate interest in running and securing the service, or because the law requires it. We do not currently send marketing messages, and we do not sell your personal data. 3. Who sees your data Restaurants The restaurant you order from sees your name in short form (first name and last initial), your order, and your notes. It also sees your delivery address and instructions while the order is active. Restaurant staff can also keep their own notes about a customer and see how often you have ordered with them. Riders Riders work for the restaurants. A rider assigned to your order sees your name, your area, the delivery instructions and the items. The delivery address is shown only during the active delivery. KhaoPilao staff Authorised staff can see account information such as your name, a masked email address, account status, and when you were last active. Viewing a full email address is restricted and recorded. Staff can lock an account, end its sessions, and moderate content. Support staff can, for a limited time and with a recorded reason, sign in as a restaurant team member or rider to help them, and may then see what that person would see, including details of active orders. Service providers We use companies that provide services for us: - Cloudflare, which carries traffic to the website. - Google Cloud, which hosts our servers and stores images. Your browser loads images directly from Google Cloud storage, so Google can see your IP address when that happens. - An email service, which delivers our sign-in emails from the khaokhilao.com domain. They may only use your data to provide those services. Legal reasons and business changes We may disclose data where the law requires it, to protect people or our rights, or as part of a sale or reorganisation of our business. If you press "Open in Google Maps" for a restaurant, you leave KhaoPilao and Google's own terms and privacy policy apply. 4. Where your data is stored Our servers and your data are hosted in Doha, Qatar, which is outside Pakistan. By using KhaoPilao you understand that your data is sent there. Cloudflare may also process traffic in other countries on its way to our servers. 5. How long we keep your data We keep personal data only for as long as we need it: - Account details, saved addresses and favourites: while your account is open, and for up to 30 days after it is closed. - Orders, including the delivery address copied onto them: for up to 5 years from the order date, for accounting, tax and dispute purposes. - Session records and server logs: for up to 12 months. - Records of sensitive staff actions: for up to 5 years. After these periods we delete the data or make it anonymous, unless the law requires us to keep it longer. Orders remain linked to the account that placed them. Restaurants' access to your phone number and address, where shown, ends when the order is no longer active. 6. Your choices and rights On the website you can: - add, edit or delete your saved addresses (orders already placed are not changed); - remove favourites; - clear your recent searches; - refuse or withdraw your browser's location permission; - sign out. The website does not yet let you change your name or email, close your account, or download your data yourself. To ask for any of these, or to ask for a copy, correction or deletion of your personal data, email [email protected]. We will respond within 30 days. We may need to verify that the request is yours, and may have to keep some data where the law requires it or to deal with an order or dispute. You also have any other rights given to you by the law that applies to you. 7. Cookies and storage on your device We use one cookie, set by our server, which keeps you signed in. It is essential and cannot be switched off while you use an account. It is not accessible to scripts on the page. We also store a few things in your browser to make the site work: - your unfinished order, for up to 3 days; - your recent searches, up to 6, for up to 30 days; - within a browser tab: your chosen area, your place on the page, and an order that is being placed, so that it is not placed twice. Signing out removes your unfinished order and recent searches from that browser. The website can also work partly offline. It saves its own files and public restaurant and menu information on your device for up to 30 days. It does not save your account details, addresses, cart or orders in this way. We do not use advertising cookies, and the website does not include third-party analytics or tracking scripts. Our providers may set their own cookies needed for security and traffic handling. 8. Security We protect your data with measures including encrypted connections, sign-in by one-time codes, and access limits for staff with records of sensitive actions. No system is completely secure, so please keep access to your email safe, and sign out on shared devices. 9. Children KhaoPilao is not intended for anyone under 18. If you believe a child has given us personal data, contact us and we will deal with it. 10. Changes to this Policy We may update this Policy. When we do, we publish the new version on this page with its effective date. If a change is significant we will take reasonable steps to bring it to your attention. 11. Contact us Jenix Labs (SMC-Private) Limited House No. 73, Midland Avenue, Model Town, T-Chowk, Multan, Pakistan Privacy questions: [email protected]