Privacy Policy
Effective date: September 20, 2026
1. Who this policy applies to
This Privacy Policy explains how Nexai Co. (Commercial Registration No. 7055198076), headquartered in Riyadh, Kingdom of Saudi Arabia ("Nexai", "we"), collects, uses, and protects personal data when a restaurant ("Merchant") uses the NexOrder platform, and when an end customer ("Customer") interacts with a Merchant's digital menu or AI-assisted ordering conversation. It is intended to comply with the Kingdom's Personal Data Protection Law (PDPL) and its implementing regulations.
2. Data we collect
From Merchants: account and business details (name, phone, email, restaurant information, commercial registration where applicable), menu and pricing data, and usage data about how the dashboard is used. From Customers: information shared during an ordering conversation (name, phone number, order details, delivery address, and free-text messages), and, where applicable, payment-related metadata processed through our payment provider (Nexai does not store full card numbers).
3. How we use data
We use this data to operate the Service: to take and relay orders, respond to customer messages through the AI assistant, process payments through our payment providers, notify Merchants of new orders, provide customer support, secure accounts, and improve the reliability and quality of the Service. We do not sell personal data to third parties.
4. Roles: who decides, who processes
In relation to Customer data collected through a Merchant's digital menu and ordering conversation, the Merchant decides what is collected and why (for example, to fulfil and follow up on an order), and Nexai processes that data on the Merchant's behalf to operate the Service. In relation to Merchant account and business data, Nexai determines the purposes of processing needed to provide, bill for, and secure the Service. Where a written data-processing agreement is in place between a Merchant and Nexai, its terms govern the detail of this arrangement; this Policy describes the general allocation of responsibility.
5. Sharing with third parties
We share data only as necessary to operate the Service, with: the messaging provider used to deliver conversations (such as WhatsApp/Meta Platforms, Inc.), payment gateways to process transactions, delivery providers where a Merchant has connected one, and cloud infrastructure and AI-model providers who process data under contractual confidentiality and data-protection obligations on our behalf. We do not share Customer data with unrelated third parties for their own marketing purposes.
6. Data retention
We retain Merchant account data for as long as the subscription is active and for a reasonable period afterward to comply with legal, accounting, and dispute-resolution obligations. We retain Customer conversation and order data for as long as reasonably necessary to fulfil the order, support the Merchant's after-sales obligations, and meet legal retention requirements, after which it is deleted or anonymized.
7. Cross-border transfer
Some of the providers we rely on to run the Service — including cloud hosting providers, the WhatsApp messaging platform operated by Meta Platforms, Inc., our payment gateway, and the AI language-model provider used to power the assistant — may process data outside the Kingdom of Saudi Arabia. Where this occurs, we require contractual safeguards consistent with the requirements of the PDPL for transferring personal data outside the Kingdom, and we review our provider list periodically as the Service evolves.
8. Your rights
Subject to the PDPL, individuals whose personal data we process have the right to know the data collected about them, to access and obtain a copy of it, to request correction of inaccurate data, to request deletion of data no longer needed for the purpose it was collected, and to withdraw consent where processing is based on consent. Customers should direct these requests to the Merchant they interacted with in the first instance, or to us at the contact below if the Merchant cannot be reached; Merchants may contact us directly.
9. Security
We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data we process, including access controls, encryption in transit, and tenant isolation between Merchants' data. No system is completely secure, and we continuously work to improve these safeguards.
10. Children's data
NexOrder is a business tool operated by and for restaurants and is not, on its own, a consumer product directed at children. The Merchant is responsible for complying with any age restrictions or parental-consent requirements that apply to its own customers under applicable law. We do not knowingly collect personal data from children for our own purposes as the platform operator.
11. Changes to this policy
We may update this Privacy Policy from time to time. Where a change is material, we will provide notice through the Service or by email before the change takes effect.
12. Contact us
Nexai Co. — Commercial Registration No. 7055198076, Riyadh, Kingdom of Saudi Arabia. For privacy questions or to exercise your rights, contact us at support@nexai-sa.com.