Privacy Policy

1. Who this policy applies to

We handle personal data about three groups of people, and our role differs for each:

• Visitors and prospects: anyone who browses rapideats.pk, fills in the demo form or messages our demo WhatsApp number. For this data we decide why and how it is used.
• Merchants: restaurant owners and staff who sign up for Rapid Eats. For your account, billing and support data we decide why and how it is used.
• Merchants’ customers: people who order from a restaurant through its Rapid Eats WhatsApp bot, website or app. The restaurant decides why this data is collected; we process it on the restaurant’s instructions to take, pay for and deliver the order. Questions about how a restaurant uses your data should go to that restaurant first; we will help if you cannot reach them.

2. Data we collect

Demo and contact enquiries. When you fill in the demo form we collect:

• Restaurant name and city
• Number of branches
• WhatsApp number (and name or email if you provide them)
• How you take orders today (for example phone, WhatsApp, marketplace)
• Approximate monthly orders
• Anything you write in the message box

Website analytics. We measure how the site is used with a privacy-focused analytics service (Plausible) or Google Analytics 4. Plausible does not use cookies and does not store personal data. If Google Analytics 4 is used, it sets cookies and processes a truncated IP address and device information; see section 9.

Server logs. Our hosting provider records the IP address, browser type, requested URL, referrer and timestamp of each request for security and debugging. Logs are kept for 30 days.

WhatsApp data. When you message a Rapid Eats WhatsApp number — our demo line or a restaurant’s ordering bot — we receive your phone number, WhatsApp profile name and the content of your messages, including menu selections, delivery address and order notes. Messages are delivered to us by Meta through the WhatsApp Business Platform and are stored in our systems to run the order.

Merchant account data. Business name, trading address, owner and staff names, phone numbers and email addresses, NTN and CNIC details used for merchant onboarding and verification, bank account details for settlement, menu, prices, branches and order history. Verification and bank details are collected and held by RapidGateway under its merchant agreement.

Order and payment data. For each order: items, amount, delivery address, payment method (Raast, JazzCash, Easypaisa, card or cash on delivery), payment status and settlement reference. We never see or store full card numbers; card data is handled by RapidGateway and its PCI DSS-compliant processors.

Rider data. For restaurants using the rider app: rider name, phone number, device location while a delivery is active, delivery timestamps, proof-of-delivery photos and cash collected.

3. Why we use it

We use personal data to:

• Reply to demo requests and enquiries, and set up a demo on your menu
• Create and run merchant accounts, storefronts, bots and rider apps
• Take orders, send order updates and payment links on WhatsApp, and deliver orders
• Process payments and settle funds through RapidGateway, including fraud prevention, chargebacks and refunds
• Produce settlement views, reconciliation exports and invoices
• Provide support and fix problems
• Measure and improve the website and the product
• Send merchants service notices and, with consent, product news
• Meet legal obligations, including tax record-keeping and requests from regulators or law enforcement under Pakistani law

Marketing broadcasts to a restaurant’s customers are sent by the restaurant to customers who have opted in, using approved WhatsApp message templates. Customers can opt out at any time by replying STOP, and we enforce the opt-out across the restaurant’s broadcasts.

4. Who we share it with

We do not sell personal data. We share it only with the service providers below, each under a contract that limits what they may do with it:

• RapidGateway — our parent company, which processes payments, performs merchant verification and settles funds to merchants. RapidGateway’s own privacy policy at rapidgateway.pk applies to payment processing.
• Meta Platforms (WhatsApp Business Platform) — delivers messages between customers and Rapid Eats numbers. Meta processes message metadata and content under its WhatsApp Business terms.
• Google Cloud / Firebase — hosts the website, platform and database.
• Resend — sends transactional email such as demo confirmations, invoices and password resets.
• Plausible or Google — website analytics as described in section 2.
• The restaurant you ordered from — your order, contact and delivery details, so it can prepare and deliver the order and handle any problem with it.
• Banks, wallet providers and card schemes — the minimum needed to complete a payment or a refund.
• Professional advisers, auditors and authorities where the law requires it.

5. How long we keep it

We keep personal data only as long as we need it for the purposes above:

• Demo and contact enquiries: 24 months from your last contact with us, then deleted.
• Demo WhatsApp conversations: 90 days, then deleted.
• Server logs: 30 days.
• Merchant account data: for the life of the account and 12 months after closure, except records we must keep longer.
• Order, payment and settlement records: 6 years after the transaction, as required for tax and financial record-keeping in Pakistan.
• Customer order data processed for a restaurant: for as long as the restaurant is a Rapid Eats merchant and 30 days after, during which the restaurant can export it. Customers can ask the restaurant, or us, to delete their profile earlier.
• Rider location data: 90 days after the delivery.

6. How we protect it

All traffic to rapideats.pk and the platform is encrypted in transit (TLS). Data is encrypted at rest by our hosting provider. Access to merchant and customer data is limited to staff who need it to run the service, is logged, and requires two-factor authentication. Payment card data never touches Rapid Eats systems; it is handled by RapidGateway and its certified processors.

No system is perfectly secure. If we discover a breach that affects your personal data we will tell affected merchants without undue delay, and affected individuals where the law or the risk to them requires it.

7. Your rights and choices

Whether or not a statute requires it, you can ask us to:

• Tell you what personal data we hold about you and give you a copy
• Correct data that is wrong or incomplete
• Delete your data, unless we must keep it for legal or financial record-keeping
• Stop sending you marketing — reply STOP to any WhatsApp broadcast, use the unsubscribe link in an email, or write to us
• Export your data in a usable format (merchants can export menus, customers and orders from the dashboard at any time)

Write to privacy@rapideats.pk. We confirm receipt within 5 working days and answer within 30 days. We may ask you to verify your identity, for example by messaging from the WhatsApp number in question.

If you are a restaurant’s customer and your request concerns data the restaurant controls, we will pass it to the restaurant and help it respond.

8. Data about children

Rapid Eats is for businesses and for adults ordering food. We do not knowingly collect personal data from anyone under 18 as a merchant or a demo prospect. If you believe a child has given us personal data, write to privacy@rapideats.pk and we will delete it.

9. Cookies and similar technologies

rapideats.pk uses only the cookies it needs to work: a session cookie on the merchant dashboard and a preference cookie if you change a setting such as language. We do not use advertising cookies.

If Google Analytics 4 is enabled, it sets analytics cookies (for example _ga) to tell returning visitors apart; you can block them in your browser without affecting the site. If Plausible is used, no analytics cookies are set.

10. Where data is stored and transferred

Our platform runs on Google Cloud. Merchant, order and customer data is stored in Google Cloud’s Mumbai (asia-south1) region, the closest region to Pakistan, with backups in the same region.

WhatsApp messages pass through Meta’s infrastructure, which may be located outside Pakistan. Transactional email is sent through Resend’s infrastructure. Each of these providers is bound by contract to protect the data and use it only to provide its service to us.

11. Changes to this policy

We will update this page when our practices change and update the "Last updated" date at the top. For material changes affecting merchants we will also email the account owner at least 14 days before the change takes effect.

12. Governing law

This policy and any dispute about it are governed by the laws of Pakistan, including the Prevention of Electronic Crimes Act 2016, and the courts of Karachi have exclusive jurisdiction. If a data protection statute comes into force in Pakistan that gives you additional rights, those rights apply in addition to this policy.

13. Contact

Privacy questions and requests: privacy@rapideats.pk. General contact: hello@rapideats.pk. Postal address: RapidGateway, Karachi, Pakistan.