Privacy Notice · PDPL

Privacy Notice

Last updated: 26 September 2026

See also our Customer Terms.

1. Who is responsible for your data

1.1 For Jareb's pages, private feedback feature, business onboarding and service-support records, the data controller is Jareb (TRY F&B TECHNOLOGIES, a sole establishment, Dubai, UAE). Contact hello@jareb.ae.

1.2 Once you continue to WhatsApp to order, the Business you contact controls the phone number, messages and order details it receives. WhatsApp/Meta also processes the conversation under its own terms. Jareb does not receive or store that WhatsApp conversation.

2. What Jareb processes

2.1 Viewing an order page and preparing a WhatsApp order

You do not need an account. Jareb does not ask for or store your name, phone number, WhatsApp number or WhatsApp message. When you prepare an order, the server briefly processes the selected items, quantities, fulfilment choice and timing choice to build the WhatsApp message. It does not store that cart or message.

Jareb stores aggregate counters such as page opens, menu-item interactions, prepared WhatsApp handoffs and the broad link source. These counters do not include a name, phone number, IP address, user-agent string, cookie ID, persistent visitor ID, message or cart.

Separately from aggregate counters, Jareb records a limited sequence of service events using random journey and event references, page or Business references, action categories and times. A secure first-party cookie groups activity into a journey and expires after 30 minutes of inactivity. These records help Jareb understand use, identify interrupted setup and operate the service; authorized Jareb staff can inspect them in restricted administration views. They do not include order-message text or cart contents. The random references can link events together, so these records are separate from aggregate statistics.

To keep a lost or interrupted server response from counting the same prepared handoff twice, the current browser tab temporarily stores one random retry identifier, a one-way digest of the exact request and its creation time. It does not store the cart, request text or referrer in that retry record. The server stores only a one-way hash of the identifier, the Business page, Dubai day, claim time and expiry. A changed order uses a new identifier; a confirmed response clears the browser record.

2.2 Private customer feedback

An approved Business page may invite you to submit an optional rating from 1 to 5 and optional free-text comments. The feedback form does not ask for your name, phone number or contact details. Jareb stores the rating and comment, the Business page they belong to, the submission time, and technical policy fields needed to keep the record private.

Purpose and access: feedback is collected only to share private service feedback with the Business operating that page. It is available to that Business through its private dashboard and to authorized Jareb staff who operate or support the service. It is not a testimonial and will not be published or reused for marketing.

To limit abuse, Jareb temporarily converts the hosting provider's edge-supplied IP address into a shortened one-way hash for a per-minute rate-limit counter. Jareb does not store the IP address in the feedback record. The per-minute counter expires after about 2 minutes; daily submission counters expire after about 48 hours.

2.3 Visitor questions and page reports

If you choose to use the public question form, Jareb stores the question and the email address or WhatsApp number you provide for a reply, together with submission and scheduled deletion times. The question and contact are available only to authorized Jareb staff in the restricted inbox. Jareb may send its restricted operational-alert provider a content-free notice that a question is waiting, but does not copy the question or contact into that alert.

If you report a Business page, Jareb stores the page identifier, optional free-text reason and report time for restricted manual review. New product-data backups and restores exclude question and report records.

2.4 Business onboarding and support

If you apply for or operate a Business page, Jareb processes the business, contact, menu, fulfilment, licence and acceptance information you submit to create and manage the listing. As you choose Continue or another save action during setup, Jareb saves the completed step so you can return to it. Saved answers are encrypted; uploaded logos, dish photos and licence documents are stored separately in encrypted form. Simply typing does not save each keystroke. While the setup page is open, it also notes, with no content, when you switch away from it, come back to it or close it, so Jareb can tell a pause from someone who has left. Your browser uses a secure session cookie and setup references to reconnect to your saved draft. A continuation link can also restore access; keep that link private.

Jareb records setup progress, validation categories, timestamps and random setup/support references, including when you have not opened Help. Authorized Jareb staff can see the business name and WhatsApp number you entered together with these restricted progress records, to operate and support the service, including contacting you about an interrupted setup. To help with an interrupted setup, authorized staff may review the saved answers across your completed setup steps, even if you have not opened Help. This includes the business details, links, menu, fulfilment, payment, hours and timing choices you saved. Your contact number is shown only to authorized Jareb staff and is never included in operational alerts. The saved-setup view shows whether a licence was uploaded, not the document itself. Access to saved support information is logged. These records are not a live screen view and do not prove that you are currently present. Short-lived one-way IP hashes are used separately to limit abuse.

When a Business uses its private dashboard, Jareb records activity such as session and section opens, selected controls, save results and share-link actions. Restricted Jareb administration views use these records to operate the service, understand use and respond to problems. They do not contain the Business's WhatsApp conversations.

The private dashboard uses one strictly necessary, secure access cookie containing a random session value. Jareb stores only a one-way hash of that value with the Business page identifier, a hash tied to the current private access token, and creation/expiry times. The session lasts up to 30 days, is invalidated when the private token changes, and does not use device fingerprinting.

When an authorized Jareb supervisor opens a page in silent review mode, Jareb may keep a separate restricted audit entry containing the time, action category and Business page identifier. It is not shown to the Business or customers. New product-data backups and restores exclude it.

Feedback to Jareb: a Business can send Jareb an optional product suggestion from its private dashboard. Jareb stores the words you write, your Business page identifier, the name of the dashboard tab you were on and the time. It does not store the page address, and the words are not copied into alerts, analytics or activity records. Suggestions are read only by authorized Jareb staff to improve the service; Jareb may not reply. They are separate from private customer feedback. While you write, an unsent draft stays in your browser's local storage until it is sent or cleared. Please do not include customers' personal details.

2.5 Technical processing and storage on your device

IP addresses and similar technical data may be processed transiently by Jareb's hosting, security and CDN provider to deliver and protect the service, subject to that provider's controls. Jareb does not copy visitor-level delivery logs into its analytics database.

Jareb does not currently collect application-level browser error messages, script sources, page paths or stack traces from visitor browsers. The former client-error beacon is inactive and its endpoint stores and logs nothing.

An order page may use local storage on your device to remember only the item identifiers and quantities in the last successfully prepared selection. Optional item requests are never kept in that reorder record, and older saved records are stripped of request text when read. “Prepared” means Jareb created the WhatsApp draft; Jareb cannot know whether you sent it. The item-and-quantity record stays on your device and is not sent to Jareb as a stored customer profile.

Recovery backups: Jareb keeps restricted backups of current Business menus, operator and licence records, and private access-recovery records to restore the service after a failure. Backup objects are scheduled for deletion after 30 days. These menu and account backup files exclude private feedback, visitor questions, page reports, saved onboarding drafts and support records, dashboard sessions and activity, and other short-lived service records. Older files may contain earlier copies of those records until the file is deleted. Restoring these files excludes those record classes. Separate database recovery copies remain restricted, and restoring service does not extend records’ original retention periods. Approved deletion or restriction requests must be applied before restored Business records return to use.

3. Why Jareb processes this data

Jareb processes the limited data described above to provide the page and features you request, prepare the WhatsApp handoff, operate Business listings and dashboards, provide onboarding support, prevent abuse, secure the service, understand aggregate service use and meet applicable legal obligations. Where consent is required by applicable law, Jareb will ask for it before that processing.

4. Sharing and recipients

Jareb does not sell personal data. Data may be handled by Jareb's hosting, storage, security and CDN providers to operate and protect the service; by the relevant Business for its private feedback and aggregate page reporting; by authorized Jareb staff for restricted support and administration; and by legal or regulatory recipients where required by law. The Business and WhatsApp/Meta receive order details only when you choose to continue to WhatsApp.

Jareb's operational-alert provider may receive limited service-event summaries and private, time-limited links that grant authorized staff access to the corresponding administration record. Alert message content does not include saved form answers, contact numbers, licence documents, customer messages, or credentials for the full administration dashboard, a Business dashboard or customer setup continuation. Support guidance for saved setup is prepared by rule-based software for staff review; this support feature does not send the saved answers to a generative-AI provider.

5. International transfers

Service providers may process technical or stored data outside the UAE. Jareb’s hosting and storage provider operates under a data-processing agreement that includes contractual safeguards. Operational-alert providers handle the limited alerts described above under their own terms. Contact hello@jareb.ae for information about international processing of your data and the safeguards that apply.

6. Retention

• Private feedback: kept so the Business can look back on it, until the Business page it was left on is deleted, or sooner if you ask us to delete it (email hello@jareb.ae with the page link and roughly when you sent it).
• Visitor questions: automatically deleted 180 days after submission.
• Feedback to Jareb (Business product suggestions): removed 180 days after they are sent. Expired suggestions stop being shown immediately and are physically removed by routine cleanup.
• Business-page reports: automatically deleted 180 days after submission.
• Feedback abuse controls: per-minute hashed rate-limit counters last about 2 minutes; daily count-only controls last about 48 hours.
• Aggregate order-page analytics: retained for up to 400 days.
• Prepared-handoff retry control: the browser-tab retry record and server-side one-way replay latch are retained for no more than 24 hours, and the browser record is normally cleared sooner after a confirmed response.
• Saved onboarding drafts and uploaded files: access expires after 14 days without a save and no later than 30 days after creation; expired content is removed by scheduled cleanup. Information submitted to create a Business page becomes part of the Business/operator records described below.
• Onboarding support cases: expire 30 days after creation, without extension when updated; they may be removed earlier when setup is completed or deleted.
• Onboarding sessions: expire after 14 days of inactivity and never outlast the draft's 30-day limit. Continuation links have a limited expiry shown when issued and do not extend the draft's life.
• Support-access audit: scheduled for cleanup after 180 days.
• Journey and service-event records: scheduled for cleanup after 180 days; private-dashboard activity has a 90-day retention period.
• Operational-alert delivery receipts held by Jareb: have a 30-day retention period. The alert provider handles its copies under its own applicable retention arrangements.
• Onboarding-support abuse control: the per-minute hashed rate-limit counter expires after about 2 minutes.
• Temporary onboarding submission reference: retained for up to 30 days to make a submission safe to retry.
• Private-dashboard activity: the detailed recent activity ring is retained for up to 90 days. A last-seen timestamp may remain while the Business account is administered.
• Private-dashboard access session: the strictly necessary cookie and hashed server session expire after up to 30 days; changing the private access token invalidates the session earlier.
• Restricted supervisor-review audit: retained for up to 90 days.
• Submitted Business and operator records: retained while needed to operate the listing, maintain the account and meet applicable legal obligations. Menu and account recovery files are scheduled for deletion after 30 days. When Jareb approves a deletion or restriction request, it applies the request to live records and checks it again before restoring Business records from a backup.
• Technical logs: retained by Jareb's hosting/security provider under that provider's controls.
• Browser storage: remains on your device until the flow removes it, it is replaced, or you clear the site's data.

7. Your choices and rights

Subject to applicable law and its conditions, you may have rights to access, correct, delete or restrict processing of your personal data, object to processing, and request portability.

How to make a request: email hello@jareb.ae with the relevant page URL and what you want us to do. For private feedback, include the page URL and approximate submission date and time. Because feedback has no name or contact field, Jareb may be unable to identify a particular record without enough matching detail and will not ask you to provide unnecessary identity data. For a WhatsApp order conversation, contact the Business and WhatsApp/Meta as the relevant controllers.

You may also complain to the competent UAE data-protection authority.

8. Privacy contact

Jareb has not appointed a Data Protection Officer at launch. Privacy questions and requests go to hello@jareb.ae. This position will be reviewed if Jareb's processing changes.

9. Data breaches

If a personal-data breach requires notification under applicable law, Jareb will notify the competent authority and affected people as required, and will investigate and mitigate the incident.

10. Children

Jareb's order and Business pages are intended for adults and are not directed at children.

11. Changes and contact

We may update this notice and will change the "last updated" date when we do. Questions or requests: hello@jareb.ae.