Privacy Policy

Last updated 12 August 2026

Draft — not yet legally reviewed. This document describes how the platform actually behaves. It has not been approved by counsel against the Saudi Personal Data Protection Law or the Nigeria Data Protection Act, and consumer and food-safety obligations differ between the two markets. It must not be relied on, and must be signed off before launch.

This policy explains what African Palace collects, why we collect it, who it is shared with, and what you can ask us to do with it. It is written to be read rather than to be defensible, which means it is short.

Who we are

African Palace is a restaurant taking orders for delivery and collection in Saudi Arabia and Nigeria. We are the data controller for everything described here.

What we collect

To take an order

A name — so the counter and the rider know whose order this is.
A phone number — the one thing an order genuinely cannot go without. It is how the kitchen asks whether chicken is acceptable when the goat has run out, and how a rider outside the wrong gate finds the right one.
An email address, if you give one — for receipts and for signing in.
A delivery address, for delivery orders. Including the coordinates your device or the map gave, which decide which delivery zone you fall in and therefore what delivery costs.
What you ordered, what it cost, and any note you left for the kitchen.

Because we run a website

Your language and currency preference.
The IP address a request came from, and the country code implied by it, recorded at signup for fraud screening.
A record of staff access to a customer record, so that looking somebody up is itself auditable.

What we deliberately do not collect

No date of birth, no gender, no photograph, and no card number. The first three have no bearing on selling somebody dinner — a field collected without a use is one we would then have to protect, export on request and delete on demand for nothing in return. The fourth never reaches us at all: payment happens on the gateway's own page and what comes back is a reference and a result.

Why we are allowed to

To perform a contract — everything needed to cook, charge for and deliver an order you placed.
Because the law requires it — a receipt is a tax record, and in Saudi Arabia an invoice carries specific VAT requirements.
With your consent — promotional messages, and only those. You can turn them off in your account without affecting anything about your orders.

Who sees it

Our payment gateway — the amount, currency, an order reference, and your email address where you gave one. They tell us whether it worked; they do not tell us your card number and we do not ask.
Our SMS provider — your phone number and the message, for verification codes and order updates.
Google Firebase — a device token, if you allow push notifications, so we can tell you when your food is on its way.
Our riders — the name, phone number and address on the order they are carrying, for as long as they are carrying it.

Nobody else. We do not sell your data, we do not share it with advertisers, and there are no advertising or analytics trackers on this site.

How long we keep it

Orders, payments and invoices are kept for as long as tax law in the relevant market requires. That is a longer period than the rest and it is not something you can ask us to shorten — a business cannot delete the evidence of a sale on the buyer's request.

Baskets you never checked out are deleted a week after they expire. Everything else is kept while your account is open.

The exact retention periods are being confirmed with counsel in both markets, and this section will state them plainly once they are.

What you can ask for

A copy of everything we hold about you, as a file you can download. It is generated on request and the link expires after seven days.
A correction, if something is wrong. Most of it you can change yourself in your account.
Deletion. Your name, phone number, email address and saved addresses are erased. Past orders stay, without you attached to them, for the tax reason above.
To stop hearing from us — promotional messages off, order updates unaffected.

Ask through your account, or by writing to us. We answer within the statutory period in your market.

Children

This is a restaurant, and there is no age restriction on ordering food. We do not knowingly create accounts for children, we do not market to them, and we collect no information about anybody's age. If you believe a child has given us personal information, write to us and we will remove it.

Changes

If this policy changes in a way that affects what we do with your data, we will tell you before it takes effect rather than after. The date at the top is the last time it changed at all.

See also the cookie policy for what is stored in your browser, and the terms for the agreement itself.

Questions about this document? Write to to be confirmed — the address to write to.