Meraki · Legal
Privacy Policy
This policy explains what personal data Meraki collects, why, who we share it with, and the rights you have under the Saudi Personal Data Protection Law (PDPL).
1. Who we are
Meraki (the website at merakiapp.sa and the Meraki mobile app) is operated by Meraki Works Establishment, a Saudi sole establishment, Commercial Registration (unified national number) 7055337815, Sayyid Al-Shuhada District, Al Madinah Al Munawwarah, Saudi Arabia. We are the controller of the personal data described here. Contact us about privacy at support@merakiapp.sa.
2. What we collect
On this website. If you join the waitlist we collect your email address, whether you are interested as a customer, cook or delivery partner, and your language preference. Our website host also keeps standard technical logs (such as IP address and browser type) for security. We don't use advertising trackers on this website.
In the app, for everyone: your phone number (used to sign in with a one-time code), your name and your saved addresses. You can also choose to add an email address, birth date, gender, address photos, and the name and phone number of someone receiving an order for you.
When you order: your orders, chats with the cook about an order, reviews, reports and support requests. Card payments are handled by our payment provider; Meraki never sees or stores your full card number.
Location: your addresses are used to show cooks near you and, once delivery is available, to deliver orders. While an order is out for delivery, the live location of whoever is bringing it is shared with the customer until it arrives.
If you apply as a cook: your national ID, Productive Family certificate or Freelance Document, health certificate, kitchen and menu details, and your IBAN so we can pay you.
Device data: a notification token so we can send order updates, and basic crash and error reports so we can fix problems.
3. Why we use it
- To create and secure your account and sign you in.
- To take, prepare, deliver and support your orders, and to process payments and refunds.
- To verify cooks before they can sell, and to pay them.
- To prevent fraud and abuse and keep the platform safe.
- To send service messages (order updates, login codes). With your consent, to tell you about Meraki's launch and news. You can opt out of non-essential messages any time.
- To meet our legal obligations, including accounting and tax records.
We rely on your consent, on what is needed to provide the service you asked for, and on our legal obligations, as the PDPL allows.
4. Who we share it with
We never sell your data and never share it for advertising. We share only what each party needs:
- The cook preparing your order (your name, order details, and the address or contact needed to hand it over). You, when a cook is preparing your order (the cook's kitchen name and pickup location).
- Service providers that run Meraki for us: our payment provider (Moyasar), our SMS provider for login codes, Google (Firebase notifications and Google Maps), our cloud hosting and file storage, our email provider, and Netlify (this website and the waitlist form). Menu text may be translated by an AI translation service; we don't send customers' personal data to it.
- Authorities, when Saudi law requires it.
Some of these providers may process data outside the Kingdom. When that happens we use the safeguards the PDPL and its regulations require (such as the standard contractual clauses issued by SDAIA and a transfer risk assessment), and we keep what we transfer to the minimum needed.
5. How long we keep it
- Waitlist emails: until 12 months after the app launches, or until you ask us to remove yours (email support@merakiapp.sa).
- Account data: while your account is active. If you delete your account, your addresses are erased and your identity is masked; order records are kept for as long as Saudi law requires (for example, for accounting and tax).
- Cook documents: while the cook is active on Meraki, and then as long as the law requires.
6. Your rights
Under the PDPL you have the right to be informed about how your data is used, to access it and get a copy, to have it corrected, to have it deleted when we no longer need it, and to withdraw your consent. You can delete your account from the app (Account → Delete account) or email us. We'll reply within 30 days. If you're not satisfied, you can complain to the Saudi Data & AI Authority (SDAIA).
7. Security
We protect your data with encryption in transit, access controls and limited staff access. If a breach affects your data, we'll notify SDAIA within 72 hours and tell you without undue delay where it could harm you.
8. Children
Meraki accounts are for people aged 18 and over.
9. Changes
If we change this policy we'll update the date above, and for important changes we'll tell you in the app or by email.