This Privacy Policy explains how Zadly Inc. (“Zadly”, “we”) collects, uses, and shares information when you use the Zadly platform, websites, and related services (the “Service”). It applies to both restaurant owners who run a Zadly account and the guests who scan a Zadly menu QR code.
1. Scope
Zadly is built for Iraqi restaurants and cafés. Where we describe ourselves as a data controller, we decide how and why information is used (for example, our own user accounts). Where we act as a data processor, we handle information on behalf of a restaurant (for example, customer feedback submitted to their menu).
2. Information we collect
From restaurant owners and team members
- Account info: name, email address, and any profile details you provide. We use magic links and social sign-in (Google, GitHub, Apple), so we don’t store your password.
- Organization info: restaurant name, slug, city, cuisine types, logo, cover photo, currency preference, and feedback settings.
- Menu data: categories, items, descriptions, prices, photos, allergen tags, and option groups you create.
- Team data: member emails, roles, and invitation status.
- Billing data: the plan you are on, redemption records for upgrade codes, and (where applicable) the records needed to process payment.
- Technical data: IP address, user-agent, locale, and basic device info needed to deliver the dashboard and detect abuse.
From your customers (menu guests)
- Page-load telemetry: anonymous request data needed to serve your menu page (IP address, user-agent, locale).
- Feedback content (only when you enable the customer-feedback feature): the food / staff / place star ratings and the optional free-text comment your customer submits. We do not require their name, email, or phone number for feedback.
Customer feedback is associated with your restaurant’s account only, not with the individual customer.
3. How we use information
We use the information we collect to:
- provide and operate the Service, including hosting your menu and generating QR codes,
- authenticate you, including sending magic-link sign-in emails,
- show you usage stats and aggregate feedback on your dashboard,
- enforce plan limits, process upgrade codes, and (where applicable) handle billing,
- send important service emails (sign-in links, billing receipts, security alerts) — these are operational, not marketing,
- detect, investigate, and prevent fraud, abuse, and security incidents,
- comply with legal obligations.
We do not sell personal information. We do not use customer feedback to train external AI models.
4. Sharing & disclosure
We share information only in these cases:
- With your restaurant: customer feedback submitted to a menu is shared with the owners and admins of that restaurant’s account.
- With service providers who help us run Zadly under contract: our database host (Neon / Vercel), file storage for images, email delivery (for magic links), and analytics. These providers are only allowed to process data on our instructions.
- With identity providers you choose to sign in with (Google, GitHub, Apple), only to authenticate you.
- For legal reasons: when required by law, court order, or to protect rights, property, or safety.
- In a business transfer: if Zadly is involved in a merger, acquisition, or asset sale, your information may transfer as part of that deal, subject to this policy.
5. Cookies & similar tech
We use cookies and local storage for:
- Sign-in sessions (e.g. a
better-authsession cookie), - Locale preference (a
localecookie that remembers whether you prefer English or Arabic), and - Theme preference (a
theme-modecookie for light / dark / auto).
We do not run advertising trackers. You can clear these cookies in your browser at any time; some functionality (staying signed in, remembering language) will reset.
6. Data retention
We keep your data while your account is active. When you delete your organization, your menu, items, categories, customer feedback, and billing records are removed from the live database; backups containing these records age out on a rolling schedule (typically within 30 days). Aggregated, non-identifying statistics may be kept longer.
7. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To make a request, email privacy@zadly.app. We will verify your request and respond within a reasonable time.
If you are a restaurant’s customer who submitted feedback and you want it removed, contact that restaurant first — they control the feedback collected from their menu.
8. Security
We use industry-standard measures including TLS encryption in transit, hashed authentication tokens, role-based access controls, and least-privilege access for our team. No system is perfectly secure; if you believe your account has been compromised, contact us at security@zadly.app immediately.
9. International transfers
Zadly operates from Iraq but uses cloud infrastructure that may store and process data in regions outside Iraq, including the European Union and the United States. Where required, we put appropriate safeguards in place for those transfers.
10. Children
The Service is not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, contact us and we will delete it.
11. Third-party links
Menus and the dashboard may link to third-party websites (for example, social media accounts that a restaurant adds). This Privacy Policy does not cover those third parties; their own policies apply.
12. Changes
We may update this Privacy Policy from time to time. If we make a material change we will give reasonable notice (for example, by email or an in-product banner). The “Effective” date at the top always reflects the current version.
13. Contact
For privacy questions or requests, email privacy@zadly.app. For general support, write to support@zadly.app.