Privacy Policy

1. Operator and scope

First Taste Company (One Person Company), referred to as “Spicy Meal,” “we,” or “us,” operates spicymeal.com.sa, the Spicy Meal mobile app, and related ordering services. This policy explains how we handle personal data when you use them.

2. Data we collect

We collect information needed to create and verify accounts, fulfill orders, and provide support. This may include:

• Name, phone number, phone-verification and authentication data.
• Saved delivery addresses and approximate or precise location when you choose to use it.
• Selected branch, order type, cart contents, products, and modifiers.
• Order history, order status, and loyalty points.
• Support communications, notification preferences, and push device tokens when enabled.
• Device information, app diagnostics, and security records needed for fraud prevention.

3. How data is collected

We collect data you provide during registration, address entry, ordering, and support; information from your device with permission; and operational information from our systems and providers when processing accounts, orders, payments, delivery, and diagnostics.

4. Purposes of processing

We process data to create and authenticate accounts, select a branch, prepare and deliver or hand over orders, show order status and history, operate loyalty points, send notifications you choose, answer support requests, improve reliability, prevent fraud, secure the service, and meet legal and accounting requirements.

5. Service providers and integrations

We may use cloud database and authentication providers, OTP or messaging providers, ordering and POS integration providers, delivery or logistics providers, payment providers when online payment is enabled, analytics or diagnostic services, push notification providers, and hosting providers. This policy does not name a specific provider unless verified.

6. Sharing and international processing

We share only data reasonably needed by providers, branches, and operational partners to fulfill orders and support, or by authorities when legally required. Customer data is not sold to advertisers, and providers may process data in different locations depending on their infrastructure.

7. Data security

We use reasonable administrative, technical, and organizational safeguards, including access controls, authentication measures, and monitoring for unusual activity. No electronic system can be guaranteed completely secure.

8. Retention

We retain data while needed to operate the account and service, then delete or de-identify it when no longer needed. Certain records may be retained for legal, accounting, security, fraud-prevention, or dispute-resolution requirements for the necessary period.

9. Your rights

Subject to applicable law, you may request information about your data, access or correct it, request deletion, or withdraw consent where processing relies on consent. We may verify your identity and limited legal exceptions may apply.

10. Account deletion

You can start an account-deletion request without signing in through our Delete Account page. We acknowledge requests within 3 business days, complete them within 30 calendar days, and send confirmation, subject to required retention of specific records.

11. Children’s privacy

The service is intended for customers legally able to use it and is not designed to knowingly collect children’s data. A parent or guardian who believes a child submitted personal data without proper authority may contact us for review.

12. Changes and contact

We may update this policy when services or requirements change. This page shows the latest update date, and material changes may also be announced in the app. Contact info@spicymeal.com.sa or 920031495.