Privacy policy

Last updated: 20 October 2026

Who we are

Dosa ("we") runs the ordering pages that restaurants share with their customers. Each restaurant sells its own food and decides its menu and prices; Dosa provides the page you order on.

When you order, the restaurant you order from and Dosa both handle your information, each for the purposes below.

What we collect

• Your mobile number.
• Your order: items, options, notes, total, time and the restaurant.
• For car pickup: your plate number, car colour and model. For delivery: the location you pin and your address note.
• If you pay cash: when you choose cash at checkout, your phone's location is checked once against the restaurant's location, to make sure you're near it. It is not stored, and the restaurant doesn't see it. Online payment doesn't need your location.
• Whether you ticked the box for WhatsApp updates, and the language you use.
• If you turn on notifications on your order page: the notification address your browser creates for that order, and its encryption keys. They let us send that browser a notification; they don't contain your number or name.
• Your IP address, held briefly in memory to stop fake orders. It is not saved with your order.
• On your own device: your language choice (a cookie), a list of your recent orders so you can find them again, and, for 2 days, the orders you turned notifications off for. You can clear these from your browser.
• A random code your browser keeps and sends with your orders. It identifies the browser, not you, and lets a restaurant's cash rule cover other numbers used from the same browser.
• Visit statistics, linked only to that random code: which of our pages you open, which links on our home and owner pages you tap, items you open or add to a cart, and the kind of site that sent you (for example Google or a QR code), never its full address. We use them to count visits and see where ordering gets stuck. They are kept for 13 months, never shared or sold, and not collected if your browser asks sites not to track you (Do Not Track or Global Privacy Control).

Why we use it

• To send your order to the restaurant and let them prepare it and hand it to you.
• To send you updates about your order, on WhatsApp, by text message or as the notifications you asked for on your order page (see "Messages about your order" below).
• To give support and to settle problems or disputes about an order with the restaurant, including after the order is finished.
• To stop fake and prank orders, for example by limiting orders per number and blocking numbers that abuse the service. If a cash order isn't collected, that restaurant can accept only online payment from that number.
• To bill restaurants for the orders they receive, and to meet our legal and accounting duties.

Who sees it

We don't sell your information and don't use it for advertising.

• The restaurant you ordered from sees this for its own customers. Dosa's operations team can see it across restaurants.
• The restaurant needs your number and order to prepare it and reach you. Dosa's team uses it for support, disputes and to stop misuse.
• Providers that act for the restaurant, only what they need: the payment company (online payments), the WhatsApp or SMS provider (messages) and the delivery company (deliveries).
• If you turn on notifications, your browser's push service delivers them: Google (Chrome and most Android browsers), Apple (iPhone, iPad and Safari on Mac), Mozilla (Firefox) or Microsoft (Edge on Windows). The notification is encrypted so that only your browser can read it; the push service passes it on. Restaurants don't see your notification data.
• Authorities, only when the law requires it.

Payments

Card, mada, Apple Pay and STC Pay details are entered on the payment company's page. We never see or store your card number.

Messages about your order

We send you WhatsApp updates only if you tick the box when you order. The box is not ticked unless you tick it. The updates are about that order only (for example when it is accepted, ready, on its way or cancelled) and stop when it is finished. Never ads.

Without the tick you can still follow your order on its tracking page. Some restaurants also send order updates by text message (SMS); if yours does, you get those for your order even without the tick.

On your order page you can also ask for a notification on your phone when your order is ready (for delivery: when it is on its way). Your browser asks your permission only when you tap the button; the page never asks on its own. If you allowed notifications before in this browser, the page of your next order placed from it turns them on for that order too. A notification is about that order only, never ads, and shows the restaurant's name and your items, never your number, car plate or notes. If the restaurant has a Google Maps review link, about 30 minutes after you collect your order you get one more notification asking how it was, with a button to rate it.

When a notification is sent to your browser, the same update is not also sent on WhatsApp or by text message. If it can't be sent, you get that update the usual way instead: on WhatsApp if you ticked the box and the restaurant sends WhatsApp updates, or by text message if it sends those. To stop notifications, turn them off on the order page, or block notifications for this site in your browser or phone settings.

What we keep and where

We keep your mobile number, your order details, the delivery location and your car details with your order, also after the order is finished. We keep them to handle your order, to give support and settle disputes with the restaurant, and to meet our accounting and legal obligations.

We don't delete these records automatically after a set time. You can ask us to delete them (see below).

Notification data is different: your browser's notification address and keys are stored encrypted, with that order only, and deleted automatically 24 hours after the order is finished or cancelled (and at most 2 days after you turned notifications on). The push services are run by the companies named above, usually outside Saudi Arabia.

Your information is stored on cloud servers outside Saudi Arabia, run by our hosting providers. We protect it with encryption in transit and access limited to the people who need it.

Your rights

Saudi Arabia's Personal Data Protection Law gives you rights over your personal data. You can ask what we hold about you, ask for a copy of your data or ask us to delete it, and ask us to correct it. If we must keep something by law (for example for accounting), we'll tell you what and why.

To ask, email us at the address below with the mobile number you ordered with. If you're not satisfied with our answer, you can complain to the Saudi Data & AI Authority (SDAIA).

Changes

If we change this policy we update this page and its date.

Contact us

Email: info@do-sa.net