Privacy Policy

Last updated: 5 November 2026

This policy explains what personal data we process in our product NovoDine (for restaurants) and its add-on NovoDine Stay (for hotels), why we process it, who we share it with, and the choices you have.

Who we are

The controller and operator of NovoDine Stay and NovoDine is Novotech Alliance for Design and Custom Software W.L.L.

Commercial Registration (CR): 226267
Address: Building 34, Apartment 8, Street 319, Zone 69, Lusail, Qatar
Phone: +974 5500 5370
Email: mohamed@novotechalliance.com
Website: https://novotechalliance.com/

NovoDine and WhatsApp

Restaurants connect their own WhatsApp Business number to NovoDine through Meta Embedded Signup. We act as a Tech Provider.

We access the restaurant's WhatsApp Business Account only to:

create 4 utility message templates automatically; and
send utility messages about a guest's order: order received, order ready, order on its way to your car, and running late.

We never take orders in WhatsApp.

Messages are sent only to guests who opted in on the order page. Marketing messages are sent only with separate consent.

What we collect

Data we receive from Meta about a restaurant that connects WhatsApp:

the WhatsApp Business Account ID (WABA ID);
the phone number ID;
the business profile;
the status of the message templates.

Data about guests:

the guest's phone number;
the delivery and read status of the messages we send.

We use SMS to verify a guest's phone number (through Twilio Verify), and may send order-update SMS in Qatar.

We also process:

guests' names and phone numbers on orders and table reservations, and what they ordered;
payment records: amount, tip and how the bill was paid (card details are handled by the payment provider, not stored by us);
guest profiles and loyalty points, for guests who join a restaurant's loyalty programme;
hotel booking details in NovoDine Stay;
names, email addresses and mobile numbers of restaurant and hotel staff who use our apps;
a device identifier and a language setting stored in the browser, to keep an order session working.

Why we use it

To verify a guest's phone number by SMS.
To send the order updates a guest asked for, by WhatsApp (and we may send order-update SMS in Qatar).
To create and keep the restaurant's 4 utility message templates on its WhatsApp Business Account.
To see whether our messages were delivered and read.
To send marketing messages, only to guests who gave separate consent for them.

To run the restaurant and hotel software: orders, bills, payments, reservations and bookings.
To send receipts by email and, only with separate consent, offers.
To bill restaurants and hotels for our service.
To keep the service secure, find and fix errors, and understand how it is used.
To provide AI features to restaurants (business reports, menu import), using business data.

Legal basis and consent

We send WhatsApp and SMS order updates only to guests who opted in on the order page. Marketing messages need a separate consent.

A restaurant authorises our access to its WhatsApp Business Account when it connects its number through Meta Embedded Signup.

We also rely on: our contract with the restaurant or hotel, and with the guest for their order; legal obligations, such as keeping accounting records; and our legitimate interest in keeping the service secure and working.

International transfers

Your data is processed in Singapore, where our database and application servers are hosted, and in the region of each service provider listed above, which may be outside Qatar. Each transfer is made under a contract with the provider that requires it to protect the data.

How long we keep it

Phone numbers on orders: removed 90 days after the order is completed or cancelled.
Guest profiles and loyalty points: deleted 24 months after the guest's last visit.
Device identifiers and reservation contact details: removed after 13 months.
A restaurant's WhatsApp account details: kept while WhatsApp is connected, removed when the restaurant disconnects.
Payment records: kept for as long as accounting law requires, without the guest's name or phone number.

Any data is deleted sooner when you ask us (see Your rights).

Security

All traffic is encrypted in transit (HTTPS), and our databases are encrypted at rest.
Guest phone numbers on orders are stored encrypted.
Each restaurant and hotel can only see its own data; this is enforced in the database.
Access tokens are kept in a secrets manager, not in the database.
Owners and administrators sign in with two-step verification.

Your rights

As a guest, you can ask us to:

give you access to the personal data we hold about you;
correct it;
delete it (see our Data Deletion Instructions at /data-deletion).

You can withdraw your WhatsApp or SMS opt-in at any time through the restaurant or by emailing us.

To use any of these rights, email mohamed@novotechalliance.com.

You also have the right to complain to the National Cyber Security Agency of Qatar, the authority responsible for personal data protection.

Children

Our services are not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, email us and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top of this page. We tell the restaurants and hotels using our products about important changes.

Governing law

This policy is governed by the laws of the State of Qatar, including Law No. 13 of 2016 on the Protection of Personal Data Privacy.

Contact

Questions about this policy or your data: Novotech Alliance for Design and Custom Software W.L.L. (CR 226267), Building 34, Apartment 8, Street 319, Zone 69, Lusail, Qatar.