Privacy Policy

Our role

For a restaurant’s own account and its guests’ order data, the restaurant is the data controller and Hidangi is its processor, handling data on the restaurant’s instructions. For the Owner account you create with Hidangi, we are the controller.

What we collect

We collect only what the product needs to work:

• Owner account: the email address Apple or Google gives us when you sign in, and the anonymous account identifier they issue. We ask those providers for your email only — never your name — so your name is not something we receive or hold. Hidangi never sets or stores a password for Owners, and an Apple Private Relay address is accepted as-is.
• Staff accounts: the phone number an Owner enters when inviting a staff member, and a password the staff member sets, stored only as an Argon2id hash — never in readable form.
• Restaurant data: menu, categories and options, tables, opening hours, currency and tax settings, and the staff you create.
• Guest orders: the phone number a guest enters (stored encrypted, with a separate tenant-scoped hash used only for matching), the items ordered, any order note, and the marketing-consent choice. A guest never needs an account and never installs an app.
• Photos you choose for AI enhancement: only the image you explicitly pick. Location and other EXIF metadata are removed on your device before upload, so photo location never leaves the device.
• Devices and notifications: a device record we issue (used for the five-device limit, On Duty and revoking a lost device) and the Apple or Google push token needed to alert you to a new order.
• Purchases: the signed transaction the App Store or Google Play gives us when you subscribe or buy an image pack, and the resulting plan state. We never see your card details.
• Support requests: the subject, your note and up to three screenshots you attach.
• Technical signals for abuse prevention: a hashed IP address and a browser marker. Raw IP addresses are not stored.

What we do not collect

Hidangi contains no analytics SDK, no crash-reporting SDK and no advertising or attribution SDK. We do not read the advertising identifier (IDFA), we do not track you across other apps or websites, and no App Tracking Transparency prompt is shown because there is nothing to track. We collect no location data and no health or financial data. Because guests pay at the counter, no card or bank details for a meal exist anywhere in the product.

The sales figures the app shows a restaurant are estimates calculated from the orders that restaurant took. They are its own operational records, not analytics about how you use the app.

How we use it

To take and route QR orders, alert and remind staff about orders nobody has picked up, run the restaurant’s own analytics, verify subscriptions and image-pack purchases, answer support requests, send transactional email, and prevent abuse. We do not sell personal data, and we do not use it to advertise to you.

Who processes data for us

We use a small number of service providers as sub-processors. They act on our instructions and only for the purposes below:

• Railway — application hosting and the PostgreSQL database.
• Cloudflare R2 — storage for menu and AI images, support screenshots and CSV exports, in private buckets reached only through short-lived signed links.
• Resend — transactional email (staff invitations, deletion and retention notices, support receipts).
• DeepSeek — AI text generation, receiving only the restaurant’s brand-voice settings and the topic it asks for.
• Google (Gemini) — AI image generation, receiving only the photo you picked (with metadata already stripped) and the prompt.
• Apple, Google Play and Stripe — verifying purchases and handling billing.

AI features

The AI features are optional and only run when you ask for them. Guest personal data is never included in an AI request: requests are screened for personal information before they leave our servers, and a guest phone number is never sent to an AI provider. Only the restaurant’s own content — its menu text, brand voice and the photo it picked — is processed. AI output is a draft for you to review; you remain responsible for what you publish, including any halal, allergen or price claim.

Where data is processed

Hidangi serves Malaysia and Indonesia, but the providers above operate data centres outside those countries, so your data may be processed abroad. Where that happens we rely on our contracts with those providers, encryption in transit, and the access controls described on our security page.

Marketing consent

A guest is added to a restaurant’s marketing list only if they explicitly tick the consent box at checkout. An unticked box is never treated as consent, and consent can be withdrawn at any time.

Retention and deletion

Order and analytics data is retained while an account is active. A long-inactive Free account may be scheduled for deletion after notice. You can delete your account and data at any time from inside the app; deletion is recoverable for 30 days, after which data is deleted or anonymised and cannot be restored. Deleting your Hidangi account does not cancel a subscription bought through the App Store or Google Play — cancel that in your store account.

Security

Guest phone numbers are encrypted at rest, access tokens rotate and are held in the device keychain, staff passwords are Argon2id hashes, and stored images and exports are reachable only through short-lived signed links. How to report a vulnerability to us is on our security page.

Children

Hidangi is a tool for restaurant operators, not a service for children. We do not knowingly collect personal data from a child. If you believe a child’s data has reached us, write to us and we will remove it.

Your rights and contact

You can access, correct or delete your data, and withdraw a consent you gave. Restaurant guests should contact the restaurant, which controls their data; for the Hidangi account itself, or any privacy question, write to hello@hidangi.my.

Changes to this policy

If we change how we handle data we will update this page and the date at the top. Where a change is significant we will also tell account holders in the app or by email.