Privacy policy

Last updated: 3 November 2026

Who we are

Dosa ("we") runs the ordering pages that restaurants share with their customers. Each restaurant sells its own food and decides its menu and prices; Dosa provides the page you order on.

When you order, the restaurant you order from and Dosa both handle your information, each for the purposes below.

What we collect

• Your mobile number.
• Your order: items, options, notes, total, time and the restaurant.
• For car pickup: your car colour and model, and the plate number if you add it. For delivery: the location you pin and your address note.
• If you pay cash: when you choose cash at checkout, your phone's location is checked once against the restaurant's location, to make sure you're near it. It is not stored, and the restaurant doesn't see it. Online payment doesn't need your location.
• Whether you ticked the box for WhatsApp updates, and the language you use.
• If you turn on notifications on your order page: the notification address your browser creates for that order, and its encryption keys. They let us send that browser a notification; they don't contain your number or name.
• Your IP address, held briefly in memory to stop fake orders. It is not saved with your order.
• On your own device: your language choice (a cookie, and another if you said no to the offer to show a page in your phone's language), a list of your recent orders so you can find them again, and, for 2 days, the orders you turned notifications off for. You can clear these from your browser.
• A random code your browser keeps and sends with your orders. It identifies the browser, not you, and lets a restaurant's cash rule cover other numbers used from the same browser.
• Visit statistics, linked only to that random code: which of our pages you open, which links on our home and owner pages you tap, items you open or add to a cart, the kind of site that sent you (for example Google or a QR code), never its full address, and the main language set on your phone or browser (for example Arabic or Hindi). We use them to count visits, see where ordering gets stuck and choose which languages to add. They are kept for 13 months, never shared or sold, and not collected if your browser asks sites not to track you (Do Not Track or Global Privacy Control).

Why we use it

• To send your order to the restaurant and let them prepare it and hand it to you.
• To send you updates about your order, on WhatsApp, by text message or as the notifications you asked for on your order page (see "Messages about your order" below).
• To give support and to settle problems or disputes about an order with the restaurant, including after the order is finished.
• To stop fake and prank orders, for example by limiting orders per number and blocking numbers that abuse the service. If a cash order isn't collected, that restaurant can accept only online payment from that number.
• To bill restaurants for the orders they receive, and to meet our legal and accounting duties.

Who sees it

We don't sell your information and don't use it for advertising.

• The restaurant you ordered from sees this for its own customers. Dosa's operations team can see it across restaurants.
• The restaurant needs your number and order to prepare it and reach you. Dosa's team uses it for support, disputes and to stop misuse.
• Providers that act for the restaurant, only what they need: the payment company (online payments), the WhatsApp or SMS provider (messages) and the delivery company (deliveries).
• If you turn on notifications, your browser's push service delivers them: Google (Chrome and most Android browsers), Apple (iPhone, iPad and Safari on Mac), Mozilla (Firefox) or Microsoft (Edge on Windows). The notification is encrypted so that only your browser can read it; the push service passes it on. Restaurants don't see your notification data.
• We use AI to translate your notes. If the note you add to your order isn't in the restaurant's language, an AI service (Claude, by Anthropic, outside Saudi Arabia) translates it automatically for the restaurant's staff. We send only the note's text: phone numbers, other long numbers and email addresses in it are taken out first, and your number and order details are not sent. The staff see the translation with your original note under it.
• Authorities, only when the law requires it.

Payments

Card, mada, Apple Pay and STC Pay details are entered on the payment company's page. We never see or store your card number.

The map

When you open the map at checkout to pin your delivery location (or a restaurant sets its own location), the map and the place search come from Google Maps. Google receives what it needs to show the map: your device's address on the internet (IP address), the area you look at and what you type in the search box, under Google's own privacy policy. The pin you choose is sent only to us.

If Google Maps can't load, the map and search come from OpenStreetMap instead, in the same way.

Messages about your order

We send you WhatsApp updates only if you tick the box when you order. The box is not ticked unless you tick it. The updates are about that order only (for example when it is accepted, ready, on its way or cancelled) and stop when it is finished. Never ads.

Without the tick you can still follow your order on its tracking page. Some restaurants also send order updates by text message (SMS); if yours does, you get those for your order even without the tick.

On your order page you can also ask for a notification on your phone when your order is ready (for delivery: when it is on its way). Your browser asks your permission only when you tap the button; the page never asks on its own. If you allowed notifications before in this browser, the page of your next order placed from it turns them on for that order too. A notification is about that order only, never ads, and shows the restaurant's name and your items, never your number, car plate or notes. If the restaurant has a Google Maps review link, about 30 minutes after you collect your order you get one more notification asking how it was, with a button to rate it.

When a notification is sent to your browser, the same update is not also sent on WhatsApp or by text message. If it can't be sent, you get that update the usual way instead: on WhatsApp if you ticked the box and the restaurant sends WhatsApp updates, or by text message if it sends those. To stop notifications, turn them off on the order page, or block notifications for this site in your browser or phone settings.

Table bookings

When you book a table, we keep your name, mobile number, the number of people, the day and time, and a random id your browser keeps, with the booking. The restaurant sees your name and number to keep your table for you.

Dosa's WhatsApp number sends you messages about that booking only: a message to confirm it, the confirmation, a reminder before the time, and a message if the booking is changed or cancelled. Never ads. The booking form says so under the mobile number.

When you scan a table's code at the restaurant, or give your mobile number when you first order at the table, we use the same random id and the number you booked with to recognise your booking, so the restaurant knows you have arrived and your pre-order goes to the kitchen. We don't ask you anything and don't show your booking to anyone else at the table.

From shortly before your booking, its page lets you order for your table. Your booking's link works like the table's code: anyone you share it with can see what has been ordered on your table's bill and add to it, until your visit ends. Your number is never shown to them.

In the browser you booked from, the restaurant's page shows your booking for that day, and if you book again for the same day we ask whether you want to change your booking instead. For this we use only the random id that browser keeps, never your number: nobody else can see whether a number has a booking.

When you message Dosa on WhatsApp

When you message Dosa's own WhatsApp number (+966 57 030 4649), we keep your messages, our replies, your number and your WhatsApp profile name for up to 90 days so we can answer you, then delete them automatically. Photos, voice notes and files are not saved: only that you sent one, and its caption.

When Dosa's number sends you a WhatsApp message (for example a booking confirmation), we keep that message and your number the same way, for up to 90 days.

Only Dosa's team sees these messages. The restaurants don't.

What we keep and where

We keep your mobile number, your order details, the delivery location and your car details with your order, also after the order is finished. We keep them to handle your order, to give support and settle disputes with the restaurant, and to meet our accounting and legal obligations.

We don't delete these records automatically after a set time. You can ask us to delete them (see below).

Notification data is different: your browser's notification address and keys are stored encrypted, with that order only, and deleted automatically 24 hours after the order is finished or cancelled (and at most 2 days after you turned notifications on). The push services are run by the companies named above, usually outside Saudi Arabia.

Your information is stored on cloud servers outside Saudi Arabia, run by our hosting providers. We protect it with encryption in transit and access limited to the people who need it.

Your rights

Saudi Arabia's Personal Data Protection Law gives you rights over your personal data. You can ask what we hold about you, ask for a copy of your data or ask us to delete it, and ask us to correct it. If we must keep something by law (for example for accounting), we'll tell you what and why.

To ask, email us at the address below with the mobile number you ordered with. If you're not satisfied with our answer, you can complain to the Saudi Data & AI Authority (SDAIA).

Changes

If we change this policy we update this page and its date.

Contact us

Email: info@do-sa.net