Kartee privacy policy

1. Introduction

This Privacy Policy explains how Hypebox (“Hypebox”, “we”, “us” or “our”) collects, uses, shares and protects information in connection with Kartee (“Kartee”): the Kartee iPhone app, the Kartee staff web app at app.kartee.tech, and the digital menus that restaurants publish with Kartee at addresses such as app.kartee.tech/m/<restaurant> (together, the “Service”).

Kartee is operated by Hypebox through its affiliated entities, Hypebox Media SARL (Beirut, Lebanon) and Hypebox For Marketing and PR (Dubai, United Arab Emirates). This Policy should be read together with the Kartee Terms of Use.

2. Who this Policy covers, and our role

• Restaurants and their team (“Customers” and their “Users”: owners, managers, waiters, kitchen staff). For account and platform data, Hypebox is the data controller.
• Guests who open a restaurant’s menu, place an order or call a waiter. Guests do not create an account. Order details and any contact details a guest gives are collected for the restaurant: the restaurant is the controller and Hypebox processes that data on its behalf. Questions about an order or about your details held by a restaurant should go to that restaurant first; we will help them answer.

3. Information we collect

a. Restaurant accounts

• Name, email address and password (stored only as a salted hash), and the one-time sign-in codes we email you.
• If you use Sign in with Apple or Google: the identifier and email address Apple or Google shares with us.
• Restaurant content you add: restaurant and branch names, menu link, logo, cover and dish photos, dishes, prices, choices, discounts, opening hours, address, phone, social links, Google review link, tables and QR codes.
• Team information: the people you invite (name, email), their role, and invitations.
• Activity in the Service, such as orders handled, order status changes and portion counts.

b. Guests using a restaurant’s menu

• When ordering: the dishes and choices ordered, notes, the table, and the name you enter. Email and phone number are asked for only if the restaurant has switched them on, and you may leave them blank.
• Requests sent from the table, such as “Call waiter” or “Ask for the bill”.
• On your own device (browser storage): your cart, the name and contact details you typed (so you don’t retype them), a random visitor identifier and a session identifier. Your list of orders on the device is cleared after 12 hours.
• Menu statistics for the restaurant: visits, dishes viewed and added, searches, taps on buttons (such as directions, social links or Google reviews), where the visit came from (a table QR code or a link), the type of device and the browser language. These statistics are tied to the random identifiers above, not to your name, and we do not store your IP address or your full browser details with them.

c. The Kartee iPhone app

• A push notification token for your device, so we can tell you about new orders and table requests.
• The camera and your photo library are used only when you choose to take or pick a photo, and the app saves a QR code to your photos only when you tap to download it.

d. Payments

• Plans bought in the iPhone app are sold and charged by Apple. We receive the purchase details Apple signs (the product, transaction identifiers, renewal and expiry status, and the store environment). We never see your card or Apple account payment details.
• Plans paid by card on the web are processed by Stripe. Stripe handles your card details; we store the Stripe customer and subscription identifiers and the plan status.
• Guests pay the restaurant at the table. Kartee does not take or store guest payments.

e. Usage and technical data

• On the web (app.kartee.tech, including the guest menu pages, and our website kartee.tech) we use Amplitude product analytics: page views, clicks and session recordings that help us find problems and improve the Service. Our website and web app also use Vercel Web Analytics, which counts page views without cookies.
• Basic technical logs (such as errors and request logs) kept by our hosting providers to run and secure the Service.

4. How we use information

• To provide the Service: show the menu, take orders to the restaurant, notify staff, run the kitchen tools.
• To manage accounts, sign-in (including the emailed codes), team roles, plans, trials and billing.
• To show restaurants statistics about their own menu and orders.
• To send service emails such as sign-in codes, invitations and account notices.
• To keep the Service secure, prevent abuse (for example, limits on orders per table) and fix problems.
• To comply with legal obligations.

We process data to perform our contract with Customers, for our legitimate interests in running and improving a secure service, to comply with the law, and with consent where the law requires it. We do not sell personal data, and we do not use guest data for advertising.

5. How we share information

Service providers. We use these providers to run Kartee. They may use data only to provide their service to us:

• With the restaurant. A guest’s order, name and any contact details they give go to the restaurant they ordered from, and are visible to that restaurant’s team according to their roles.
• Within a restaurant account. Content and team details are visible to the other Users of the same account, according to their role (owner, manager, general, waiter, kitchen).
• Legal and safety. When required by law or to protect the rights, property or safety of Hypebox, our users or others.
• Business transfers. As part of a merger, acquisition or sale of assets, subject to this Policy.

6. International data transfers

Hypebox operates from Lebanon and the UAE, and our providers are located in the European Union, the United States and other regions. Your information may therefore be processed outside your country. Where required, we use appropriate safeguards, such as contractual protections.

7. Data retention

• Account and restaurant content is kept while the account is open.
• Orders and menu statistics are kept as part of the restaurant’s records while its account is open, so the restaurant can see its history.
• When an account is deleted, we delete its content within a reasonable period, except what we must keep by law (for example, billing records). Backups may persist for a limited time before they are overwritten.

8. Security

We use encryption in transit, row-level security that keeps each restaurant’s data separate, role-based permissions for staff, hashed passwords and codes, verification of every App Store purchase against Apple’s signature, and restricted internal access. No system is perfectly secure; please keep your password private and give your team only the roles they need.

9. Your rights and choices

Depending on where you live and the law that applies (including Lebanese Law No. 81/2018, applicable UAE data protection law, and the EU/UK GDPR where relevant), you may have the right to access, correct, delete, restrict or object to the processing of your data, to receive a copy of it, and to withdraw consent.

• Delete your account: in the Kartee app, open Account and tap Delete account at the bottom, or email info@hypebox.agency from the address you sign in with. Restaurants you are the only owner of are deleted with your account; accounts that have another owner stay with them. Deleting your account does not cancel an App Store subscription; cancel it in your iPhone’s Settings › Apple Account › Subscriptions.
• Guests: contact the restaurant, or email us and we will pass your request on and help them respond.
• Notifications: you can turn off push notifications at any time in your iPhone’s Settings.

We may need to confirm your identity before acting on a request.

10. Cookies and browser storage

We use cookies and browser storage that the Service needs to work: keeping staff signed in, and keeping a guest’s cart, details and visitor identifier on their device. We also use Amplitude analytics on the web as described in section 3e. You can clear browser storage at any time in your browser settings.

11. Children

Restaurant accounts are for adults (18 or older). Guests can view a menu without giving any personal data. We do not knowingly collect personal data from children; if you believe a child has given us personal data, contact us and we will remove it.

12. Changes to this Policy

We may update this Policy. When we make material changes we will update the “Updated” date and, where appropriate, tell restaurant accounts by email or in the app.

13. Contact us

• Email: info@hypebox.agency
• Hypebox Media SARL — George Castro Street, Khanamerian Bldg., Badaro, Beirut, Lebanon
• Hypebox For Marketing and PR — Damac Hills, Dubai, United Arab Emirates