Privacy policy

01Who we are

Minu is operated by NEONS EMS (the "Company", "we", "us"). For guests ordering at a merchant, the merchant is the party you are buying from, and we process your order on its behalf. For merchants, NEONS EMS is your service provider under the terms of service.

02Guests ordering at a table

Ordering through a Minu QR code needs no app and no account. We keep the minimum required to serve the table and settle the bill.

• The table code you scanned, the items you ordered, the time and the amount.
• A mobile number or email only if you choose to receive a receipt, an order update or a review prompt.
• Payment is handled by a licensed payment provider through a hosted, tokenised page. Minu never sees or stores your full card number or CVV.
• Tips you leave are recorded against the shift so the merchant can pay them to its staff.

03Merchant owners and staff

Merchant accounts are created by the Minu team; there is no public self-registration. For owners, managers, cashiers and waiters we hold the name, work email or mobile, role, branch and the actions taken in the system (orders, discounts, voids, shifts). Access to a merchant’s data is limited to that merchant and to the roles its owner assigns.

04Demo requests and the website

When you request a demo we receive the name, merchant, mobile, work email, number of branches and point of sale you entered, and we use them only to arrange and follow up the demo. The website uses no advertising cookies. We keep basic, anonymous usage measurements to keep the site working.

05Why we process data

• To take, prepare and settle orders, and to issue receipts and e-invoices.
• To run the merchant’s floor, kitchen, checkout, shifts and reports.
• To meet legal duties in Saudi Arabia, including ZATCA e-invoicing and tax record keeping.
• To keep the service secure, detect misuse and fix problems.
• To respond to you when you contact us.

06Who we share data with

We share data only where the service needs it: the merchant you ordered from, payment providers for card payments, SMS and email providers for receipts and notifications, ZATCA for e-invoicing, and hosting providers that store the platform. We do not sell personal data and we do not share it for advertising.

07How long we keep it

Orders, receipts and settlement records are kept for the period Saudi tax and commercial law requires, and are not rewritten afterwards. Contact details from a demo request are deleted within twelve months if no relationship follows. Staff accounts are removed when the merchant closes them.

08Security

Data is encrypted in transit and at rest. Secrets such as invitation links and password resets are single use and expire. Each merchant’s data is isolated from every other merchant. Only staff with a need can reach production systems, and access is logged.

09Your rights

Under the PDPL you can ask what we hold about you, ask for it to be corrected or deleted, withdraw consent where processing rests on consent, and object to processing. If you are a guest, your first contact is the merchant; we will help it answer. You can also write to us directly.

10Changes

We will post any change to this policy here with a new date. Material changes affecting merchants are announced in the product as well.