Privacy Policy

If you sign in to manage a business, we keep:

• Your login email. Staff who sign in with a login we created for them use a placeholder address, which never receives email.
• Your password, stored only as a salted hash. We never store your password in readable form and we never email it.
• A session cookie that keeps you signed in for up to 7 days. It is host-only, so it is set for the business’s own address and is not shared with other businesses.
• Failed sign-in attempts, counted per IP address to block password guessing. The limit is 5 failed attempts per 15 minutes.
• The business’s content that you enter: menu, prices, descriptions, opening hours, address, phone and WhatsApp numbers, social links, and uploaded photos and logo.
• Messages you send us from the admin area for support.
• Billing records: your plan, due dates, payments we record by hand, and reminder history.
• A log of the emails we send, such as reminders, receipts and password-reset emails.

Visitors do not need an account. What we and the menu site handle is:

• Cart and order details. The cart, and any name, address, table number or notes you type for an order, are stored only in your own browser (local storage), so the cart survives a page refresh. We do not receive them.
• Sending an order. When you send an order, the message is written in your browser and opened in WhatsApp, so that you send it to the business yourself. Wajha does not receive or store that message.
• Language. A cookie called NEXT_LOCALE remembers whether you chose Arabic or English. It lasts one year.
• Anonymous usage counts. We record that an item was viewed or that an order was sent, with only the business ID, the item ID and a count. The business sees these counts in its statistics. They contain no personal data.
• Page views. Cloudflare Web Analytics, which uses no cookies, may be used on menu sites to count page views.

We use the information above to:

• run, secure and maintain the service, including keeping sites online and blocking repeated sign-in attempts;
• show each business its own menu statistics;
• send service emails, such as billing reminders, receipts and password-reset emails;
• answer messages and support requests;
• meet our legal and accounting obligations.

We do not sell personal information, we do not show advertising, and we do not track people across sites.

Some menu sites load content from other services. The Info page may show a Google Maps map. Businesses with the Instagram add-on show a feed of their photos, either through Instagram’s own embed or through a third-party widget such as SnapWidget or LightWidget. These services load their content directly from their own servers, and their own privacy policies apply to it.

Wajha runs on Cloudflare. The application runs on Cloudflare Workers, the database is a Cloudflare D1 database, and uploaded photos and logos are stored in Cloudflare R2. Emails are sent through Cloudflare’s email services. Each business’s data is kept separate from every other business’s.

We do not sell information, and we do not use it for advertising. We share information only:

• with the infrastructure providers that run Wajha, listed above;
• with the business a visitor orders from, and only for that business’s own data, such as its anonymous statistics;
• when the law requires it.

• Session cookie (owners only): keeps you signed in for up to 7 days. It is host-only, so browsers send it only to the business’s own address.
• NEXT_LOCALE (language): kept for one year.
• Local storage: the cart and the order details a visitor types, kept on that visitor’s device only.
• Cloudflare Web Analytics sets no cookies.

• You can edit or delete menu items, prices, photos and other settings in your admin area at any time. Deleted photos are removed from storage.
• You can ask us to disable your site. Its address then shows “not found”, and your data is kept.
• You can ask us to delete your business’s data.
• Billing records are kept for as long as they are needed for accounting.
• Owners can contact us to ask for access to, correction of, or deletion of their information.
• Visitor data stays in the visitor’s own browser. The visitor can clear it in the browser settings.

We use HTTPS everywhere, store passwords only as salted hashes, keep each business’s data separate, and limit sign-in attempts. No system is perfectly secure, so we cannot promise that information will never be accessed without permission. If a breach affects your data, we will tell the affected owners promptly.

Wajha is not directed at children.

We may update this policy. When we do, we will change the date at the top of the page, and we will tell owners by email about material changes.

For questions, or to ask about your information, contact us on WhatsApp at +961 81 091 511 or by email at support@wajha.cc.