Privacy Policy

Last updated: June 18, 2026

At Tawelti, we respect your privacy and take the protection of your personal data very seriously. This policy explains what data we collect, how we use it, and what your rights are.

Core commitment: We do not use your personal information for any purpose other than operating the Tawelti service. No selling, no sharing with third parties, no targeted advertising.

01 · Data controller

The data controller is Tawelti, reachable at [email protected].

02 · Data we collect

We collect the following categories of data:

Account data:

Account owner first and last name
Email address and password (stored hashed with bcrypt)
Venue information (name, address, logo, opening hours)

Menu data:

Categories, items, descriptions, prices and menu photos
Language and currency settings

Usage data:

Login logs (IP address, timestamp, browser)
QR code scan events (anonymized)
Menu viewing statistics (page views, languages used)

03 · Purposes and legal basis

We process your data for the following purposes:

Providing and maintaining the service — legal basis: performance of contract
Sending transactional notifications (password reset, alerts) — legal basis: performance of contract
Improving the service through usage analysis (aggregated and anonymized data) — legal basis: legitimate interest
Complying with our legal obligations — legal basis: legal obligation

We do not sell, rent or share your personal data with third parties for commercial purposes.

04 · Data retention

Your account data is kept for the entire duration of your active subscription, then for 30 days after cancellation (restoration window), before permanent deletion.

Deleted menu items are kept for 30 days (restorable) then permanently purged by a nightly automated process.

Aggregated analytics data may be kept indefinitely, in anonymized form.

05 · Your rights

You have the following rights over your personal data:

Right of access: obtain a copy of the data concerning you
Right to rectification: correct inaccurate or incomplete data
Right to erasure: request deletion of your data
Right to portability: receive your data in a structured, readable format
Right to object: object to certain processing

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

06 · Data security

We implement appropriate technical and organizational measures to protect your data:

HTTPS encryption for all communications
Passwords hashed with bcrypt (high cost factor)
Short-lived JWT tokens (15 minutes) with refresh-token rotation
Strict per-venue (tenant) data isolation at the database level
Request rate limiting via Redis

07 · Cookies and local storage

Tawelti uses the following storage mechanisms:

Secure httpOnly cookies for authentication tokens
localStorage for the customer portal language preference
sessionStorage for anonymous identity in social features (per tab, ephemeral)

We do not use advertising cookies or third-party tracking.

08 · Google Sign-In

Tawelti offers sign-in via Google Sign-In. When you choose this method, Google shares only the following information with us:

Your full name (as set in your Google account)
Your Google email address
A unique Google identifier (Google ID, not visible to the user)

This data is used exclusively to create your Tawelti account and identify you on subsequent logins. We never use your Google information for advertising, behavioral analysis or commercial personalization.

We do not share, sell or rent your Google data to any third party. Your personal information stays strictly confined to operating the Tawelti service.

You can revoke Tawelti's access to your Google account at any time via myaccount.google.com/permissions. Revoking does not delete your Tawelti account.

To learn more, see Google's Privacy Policy.

09 · Limited Use of Google user data

Tawelti's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: Google user data is used only for authentication and account creation; it is not transferred to others except as needed to provide the service, for legal compliance, or with your consent; it is not used for advertising; and it is not read by humans unless we have your explicit consent, for security purposes, or to comply with the law.

10 · AI features & personalization

Our AI features never use, store, or train models on your personal data. Every request is processed temporarily and nothing is retained.

We do not use your personal information for advertising or any purpose beyond operating the service.

Any optional feature you choose to enable is used solely to personalize your experience in the app.

11 · Contact

For any question about this policy or to exercise your rights:

Tawelti — DPO

Email: [email protected]

Tunisia