Privacy policy

Scope and contact

This policy describes browsing, device profiles, cash orders, delivery, rewards and the separate demo. The contact details on Contact us are available for privacy questions and requests.

Information used by the preview

• Device profile: a name and phone number saved in this browser, used to prefill contact fields. The profile is unverified.
• Cash orders and delivery: your name, contact phone, selected branch, table or delivery address and map coordinates, ordered items, preparation notes, charges and staff status updates are stored on the server so the restaurant can fulfill your order. Authorized staff can access these records.
• Rewards: a device customer identifier, completed visit dates, points earned and product reward reservations are stored on the server. A contact phone number is unverified and does not grant access to another device’s records.
• Shared sessions: guest names, branch and table references, selected items, item notes, order progress, simulated payments and session identifiers. Other participants in the same authorized table session and authorized staff can see relevant shared details. Use sample information and avoid sensitive information in names or notes.
• Technical information: hosting and infrastructure providers may process IP addresses, request details, browser information and diagnostic logs to deliver and protect the service.

Use and service providers

Information supports order fulfillment, cash collection records, rewards, saved bags, order history, customer enquiries, staff access and service security. The website does not include advertising measurement.

Vercel hosts the website and Supabase provides database storage and staff authentication. The database is hosted in Frankfurt, Germany, so using the website can involve processing outside Egypt.

Location and external maps

Location access is requested when you choose a location feature. You can decline and search manually. The nearest-branch feature keeps your coordinates in page memory to calculate approximate distances.

The delivery map loads Google Maps and Places when you open that feature. Google may process your search text, map interactions and technical information under its privacy policy. External directions and social links open services with their own policies.

Cookies and browser storage

Browser storage remembers contact preferences, bags, pending order requests, delivery drafts and demo session access. An HttpOnly customer cookie controls access to cash orders and rewards on this device. Staff sign-in uses separate authentication cookies. The website does not include optional analytics or advertising pixels.

Device profile details remain until you sign out in Your profile or clear site data. Delivery drafts are valid for up to 24 hours; checkout labels and other temporary data use session storage. Some session access and saved-bag data may use local storage to restore a visit.

Signing out clears this device’s cash-order access and saved contact details. Until cross-device verification is available, clearing that access can prevent you from recovering order history or points on this device. Clearing browser data does not delete server order, cash collection or audit records.

Retention and your choices

Demo sessions have an access expiry, but expiry does not mean that all database records or backups are immediately deleted. A production retention schedule and deletion process must be confirmed before live ordering opens.

Contact BitterSweet to request access, correction or deletion of information, or to raise a privacy concern. Include only the details needed to identify your enquiry; we may need to verify your connection to the information. Legal recordkeeping obligations may limit deletion.

Payments and security

Orders use cash only. Do not enter or send card details. Cash collection is recorded by authorized staff. The separate demo payment simulator does not process charges.

This policy will be updated when the website's data practices change. Live payment provider disclosures and production retention details must be published before those services open.