Privacy policy

ScaleMeal (“we”, “us”) is a service run by Buy Dream Web that gives restaurants, cafés and home kitchens their own ordering website and app. This policy explains what information we handle, why, and the choices you have. It covers our own website and the ordering sites and apps we host for restaurants.

Two kinds of people use ScaleMeal

Restaurants (and their staff) sign up to run a store. For their accounts, we decide how the information is used.

Customers order food from a restaurant's ordering site or app. The restaurant is responsible for its customers and their orders; we handle customer information on the restaurant's behalf, to run its store. Questions about an order are best sent to the restaurant.

What we collect

From restaurants

• Account details: name, email address, phone number and password (stored only in scrambled form by our sign-in provider).
• Business details: store name, branches and addresses, opening hours, menu, prices, photos, logo, brand colours and domain names.
• Staff accounts the restaurant invites, and what they do in the dashboard.
• Plan and billing records: invoices, payments reported, and discount codes used.
• Files uploaded to import a menu (PDFs, photos, spreadsheets).

From customers

• Name, email address and phone number, when an account is needed (delivery and pickup orders).
• Delivery address and the map pin chosen at checkout.
• Orders: items, notes, totals, table number for table orders, and order status.
• Loyalty points and rewards, where the restaurant offers them.

From everyone who visits

• Technical information such as IP address, browser and device type, and the pages requested, kept in server and security logs.
• Approximate country, worked out from the IP address, to show the right version of our website.
• Cookies and browser storage, described below.

How we use it

• To run the service: host stores, take and show orders, and keep accounts signed in.
• To send messages the service needs: sign-in codes, order updates, notifications you switch on, invoices and account notices.
• To prevent fake orders and abuse: “I'm human” checks, confirmed email addresses and, where a restaurant turns it on, phone number checks.
• To bill restaurants for their plan and to provide support.
• To keep the service secure, fix problems and improve it.
• To meet legal, tax and accounting obligations.

We don't sell personal information, and we don't show advertising.

Who helps us run the service

We use trusted providers that handle information only to provide their service to us:

• Supabase: database, sign-in and file storage.
• Cloudflare: network delivery, security and the “I'm human” check.
• An email delivery provider for sign-in codes, order and account emails.
• An SMS provider for phone number checks, only where a restaurant turns them on.
• Google (Gemini): reads menu files a restaurant uploads for import, and draws logos when asked.
• OpenStreetMap-based services (OpenFreeMap maps, Nominatim and Photon address lookup) when a customer picks a location on the map.
• Browser push services (from Google, Apple, Mozilla and others) to deliver notifications you've allowed.

We may also share information when the law requires it, to protect people's safety or our rights, or as part of a sale or reorganisation of the business, in which case this policy keeps applying to it. Some providers process information outside your country; we choose providers that protect it.

Cookies and browser storage

• Sign-in cookies that keep you logged in, and security cookies that remember a completed sign-in code or a browser you chose to trust.
• A cookie that remembers which version of our website you picked (international or Pakistan).
• Your cart and a device identifier for table orders, saved in your browser so they survive a page reload.
• Cookies Cloudflare sets for security and bot protection.

We don't use advertising or cross-site tracking cookies. Blocking cookies will stop sign-in from working.

How long we keep it

We keep account information while the account is open. Orders are kept so restaurants have their records and so we can meet tax and accounting obligations; after that we delete or anonymise them. Logs are kept for a short time for security. When a restaurant closes its account, we delete its store data within a reasonable time, apart from records the law requires us to keep.

Your choices

You can ask to see, correct or delete your personal information, or object to how it's used, by writing to [email protected]. If you're a customer of a restaurant, you can also ask the restaurant directly. Restaurants can change most of their information in the dashboard at any time. We'll answer requests within the time the law allows.

Security

All traffic is encrypted (HTTPS). Access to data is limited by account and by restaurant, passwords are never stored in readable form, and staff sign-ins use a one-time code. No system is perfectly secure, but we work to protect your information and will tell affected users about a breach where the law requires.

Children

ScaleMeal isn't meant for children under 13, and we don't knowingly collect their information.

Changes

We'll update this page when our practices change and change the date at the top. For important changes we'll also tell restaurants by email or in the dashboard.

Contact

Questions about privacy: [email protected]. ScaleMeal is operated by Buy Dream Web.