Privacy Policy — Habah
Last updated: October 5, 2026
Who we are
Habah (“we”, “us”) provides online ordering software for restaurants (habah.com and customer sites at {slug}.habah.com or custom domains).
Questions about this policy: contact@habah.com.
Scope
This policy applies to the Habah platform website (habah.com), restaurant owner accounts, and features we operate on behalf of subscribing restaurants.
Each restaurant’s public storefront may display its own business name and contact details. Orders placed on a restaurant site are processed for that restaurant; Habah acts as a technology provider.
Information we collect
We collect the following categories of data:
- Restaurant owner / staff accounts: name, email address, password (stored by our auth provider), role, restaurant configuration, and content you enter (menu, hours, zones, branding).
- Google Sign-In (optional): when you choose “Continue with Google”, we receive your Google account email, display name, and profile picture URL via OpenID Connect scopes (openid, email, profile). We use this only to create or sign in to your Habah admin account.
- Customer order data (on behalf of tenants): name, phone, email, delivery or pickup details, order items, notes, and payment method selection. Card numbers are not stored by Habah.
- Payments: transactions are processed by PayPal, Stripe, or other processors you enable. We receive payment status, amounts, and processor references—not full card data.
- Technical data: IP address, browser type, device information, cookies, and analytics events (see Cookies below).
- Communications: support email, Telegram linking codes for kitchen notifications, and operational messages.
How we use information
We use personal data to:
- Provide and secure the ordering platform, admin panel, and notifications.
- Authenticate users (including Google Sign-In) and manage restaurant accounts.
- Transmit orders and status updates to restaurants and their staff.
- Process subscriptions and one-time fees through payment partners.
- Improve reliability, prevent abuse, and comply with law.
- Send service-related email (order confirmations, account notices) when enabled.
Google API Services & Limited Use
Habah’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Google user data (email, name, profile photo) is used only to provide and improve Habah account sign-in and account management. We do not use Google user data for advertising, sell it, or transfer it to third parties except as needed to operate the service (e.g., hosting, auth) or with your consent or for legal reasons.
Retention
We retain account and order data while your subscription is active and as needed for legal, accounting, and dispute resolution purposes.
Restaurants may export or request deletion of tenant data subject to applicable law and active orders.
Your choices and deletion requests
Restaurant owners can update account details in the admin panel. You may disconnect Google Sign-In by using email/password sign-in where available or contacting us.
To request access, correction, or deletion of Habah platform data, email contact@habah.com from the address associated with your account. We will verify ownership before processing requests.
End-customers who ordered from a specific restaurant should contact that restaurant for order-related privacy requests; we will assist restaurants as their processor when appropriate.
Security
We use encryption in transit (HTTPS), access controls, and industry-standard practices. No method of transmission or storage is 100% secure.
Children
Habah is not directed at children under 13. We do not knowingly collect personal information from children.
Changes
We may update this policy. The “Last updated” date will change. Continued use after changes constitutes acceptance of the updated policy.
Contact
Habah — contact@habah.com