Privacy Policy
Effective date: September 20, 2026 · Last updated: October 12, 2026 · Version: 2026-10-12.3
1. Who this policy applies to
This Privacy Policy explains how Nexai Co. (Commercial Registration No. 7055198076), headquartered in Riyadh, Kingdom of Saudi Arabia ("Nexai", "we"), collects, uses, and protects personal data when a restaurant ("Merchant") uses the NexOrder platform, and when an end customer ("Customer") interacts with a Merchant's digital menu or AI-assisted ordering conversation. It is intended to comply with the Kingdom's Personal Data Protection Law (PDPL) and its implementing regulations.
2. Data we collect
From Merchants: account and business details (name, phone, email, restaurant information, commercial registration where applicable), menu and pricing data, and usage data about how the dashboard is used. From Customers: information shared during an ordering conversation (name, phone number, order details, delivery address, and free-text messages), and, where applicable, payment-related metadata processed through our payment provider (Nexai does not store full card numbers). We also keep a record of the version of this Policy and of the Terms of Use you acknowledged, when, and for which Merchant, and the protected identity key described in section 5.
3. How we use data
We use this data to operate the Service: to take and relay orders, respond to customer messages through the AI assistant, process payments through our payment providers, notify Merchants of new orders, provide customer support, secure accounts, and improve the reliability and quality of the Service. We do not sell personal data to third parties.
4. Roles: who decides, who processes
In relation to Customer data collected through a Merchant's digital menu and ordering conversation, the Merchant decides what is collected and why (for example, to fulfil and follow up on an order), and Nexai processes that data on the Merchant's behalf to operate the Service. In relation to Merchant account and business data, Nexai determines the purposes of processing needed to provide, bill for, and secure the Service. Where a written data-processing agreement is in place between a Merchant and Nexai, its terms govern the detail of this arrangement; this Policy describes the general allocation of responsibility. The unified identity described in section 5 is the exception: Nexai decides its purposes and means.
5. Unified identity and smart personalisation across the NexOrder network
This section explains how NexOrder recognises a returning customer across the restaurants that use the platform, and what it does — and does not do — with that recognition. Nexai decides the purposes and means of the processing described here, so for this section Nexai acts on its own account (as a controller), not only on a Merchant's behalf. What we do today. When you order through a Merchant's digital menu, we may link the separate customer records that different Merchants hold for the same phone number, using a protected key derived from your phone number (a keyed hash, an HMAC computed with a secret key that only NexOrder holds; it is a protected fingerprint of your number rather than the number itself, but it remains personal data because NexOrder can use it to link records that belong to you). The link carries no name, address, order, or preference; it is used only inside NexOrder and is never shown to any Merchant. Each Merchant sees only the data from its own orders. Features such as "your usual order", a welcome-back greeting, and suggestions at a Merchant are built only from your orders at that same Merchant. What may be added later — only with your separate consent. In future, NexOrder may use general preference signals that do not identify you (for example, favoured cuisines or dietary choices) to personalise suggestions across restaurants. This is not active today. If we introduce it: (1) we will ask for your explicit, optional consent, separate from this Policy and from the Terms of Use — acknowledging this Policy at checkout is not that consent; (2) you can withdraw it at any time, with effect for the future; (3) no Merchant will ever be shown the names of other restaurants you ordered from, what you ordered, when, or how much, and no Merchant will receive your name, phone number, or address from another Merchant; (4) we will not switch it on before its legal basis has been documented and assessed as the PDPL requires. Purposes and legal basis. We keep a register of each purpose of processing, its legal basis, and its status, and we record which version of this Policy and of the Terms of Use you acknowledged, and when. Fulfilling the order you place: performance of your request. The identity link and personalisation within a single Merchant: our legitimate interest in providing a consistent service, which you may object to. Personalisation across restaurants: consent only. You can exercise the rights described in section 9 (including objecting to personalisation or withdrawing consent) through the contact in section 13.
6. Sharing with third parties
We share data only as necessary to operate the Service, with: the messaging provider used to deliver conversations (such as WhatsApp/Meta Platforms, Inc.), payment gateways to process transactions, delivery providers where a Merchant has connected one, and cloud infrastructure and AI-model providers who process data under contractual confidentiality and data-protection obligations on our behalf. We do not share Customer data with unrelated third parties for their own marketing purposes.
7. Data retention
We retain Merchant account data for as long as the subscription is active and for a reasonable period afterward to comply with legal, accounting, and dispute-resolution obligations. We retain Customer conversation and order data for as long as reasonably necessary to fulfil the order, support the Merchant's after-sales obligations, and meet legal retention requirements, after which it is deleted or anonymized. Acknowledgement records (which version of the Privacy Policy and the Terms you acknowledged, when, and for which Merchant) and consent records are kept for 12 months from the date they were recorded and are then deleted automatically, unless a dispute, a regulator's request or another legal obligation requires us to keep them longer; a consent that is still in force is kept while it is in force and then until its 12 months have ended. If your customer record is deleted at your request, these records are kept without any link to you (no name, phone number or customer identifier) until the 12 months end. After 12 months we may ask you to acknowledge the current documents again at your next order. Identity keys are kept for as long as needed to provide the Service and are then deleted or anonymised.
8. Cross-border transfer
Some of the providers we rely on to run the Service — including cloud hosting providers, the WhatsApp messaging platform operated by Meta Platforms, Inc., our payment gateway, and the AI language-model provider used to power the assistant — may process data outside the Kingdom of Saudi Arabia. Where this occurs, we require contractual safeguards consistent with the requirements of the PDPL for transferring personal data outside the Kingdom, and we review our provider list periodically as the Service evolves.
9. Your rights
Subject to the PDPL, individuals whose personal data we process have the right to know the data collected about them, to access and obtain a copy of it, to request correction of inaccurate data, to request deletion of data no longer needed for the purpose it was collected, and to withdraw consent where processing is based on consent. Customers should direct these requests to the Merchant they interacted with in the first instance, or to us at the contact below if the Merchant cannot be reached; Merchants may contact us directly.
10. Security
We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data we process, including access controls, encryption in transit, and tenant isolation between Merchants' data. No system is completely secure, and we continuously work to improve these safeguards.
11. Children's data
NexOrder is a business tool operated by and for restaurants and is not, on its own, a consumer product directed at children. The Merchant is responsible for complying with any age restrictions or parental-consent requirements that apply to its own customers under applicable law. We do not knowingly collect personal data from children for our own purposes as the platform operator.
12. Changes to this policy
We may update this Privacy Policy from time to time. Where a change is material, we will provide notice through the Service or by email before the change takes effect.
13. Contact us
Nexai Co. — Commercial Registration No. 7055198076, Riyadh, Kingdom of Saudi Arabia. For privacy questions or to exercise your rights, contact us at support@nexai-sa.com.