Privacy Policy

1. Who we are

Picky plans your office lunches for a week or more, takes one payment for the week or more, then delivers each lunch to the drop-off point at the location you chose. Picky is run by Picky Establishment (مؤسسة بيكي), Commercial Registration No. 7055481852, Building 3890, Al Qashashiyah, Al Nada District, Riyadh 13317, additional no. 7554, Kingdom of Saudi Arabia. We are the controller of your personal data.

2. Data we collect

Data you give us:

• Account: your mobile number and name.
• Delivery: your office address, the map pin and building details of your drop-off point, the drop-off photo you take, and your delivery window.
• Food preferences: your budget, lunch goal, dishes and ingredients you never eat, taste answers, Taste Test swipes, swaps, ratings and saved meals.
• Allergies: the allergies you tell us about. These count as health data, which the law treats as sensitive. We collect them only with your explicit consent and use them only to keep unsafe dishes out of your week and to warn the restaurant.
• Messages: what you write to us on WhatsApp, by SMS or by email, and our notes about your orders and any problem.
• Waitlist: if you joined before launch: your number, name, and the company or building you gave us.

Data created when you use Picky:

• Your weeks and lunches: what was planned, paid, ordered and delivered, with dates and times.
• Payments: amount, date, status and Tap's payment reference. Your card number is entered on Tap's page; we never see or store it.
• Picky credit you earned or used.
• Usage and device data: pages and buttons used, the invite or campaign link you came from, device and browser type, language, IP address, and error reports.
• Cookies and similar storage that keep you signed in, remember your settings and measure how the website is used.

Picky does not connect to any health or fitness app, and does not collect biometric data.

3. Why we use your data, and our legal basis

• To run the service you asked for: plan your week, take payment, order and deliver your lunches, send your login code and lunch updates (on its way, late, delivered), and handle problems and refunds. Legal basis: carrying out our agreement with you.
• To keep you safe from allergens: filter dishes and tell the restaurant. Legal basis: your explicit consent, which you can withdraw at any time (see section 9).
• To improve your picks: learn from your swipes, swaps and ratings. Legal basis: carrying out our agreement, and our legitimate interest in a better service.
• To send offers and news: only if you ticked the box or asked for them on WhatsApp. Legal basis: your consent. Reply STOP or use the Stop button at any time.
• To protect the service and meet the law: prevent fraud and abuse, keep financial records and answer lawful requests. Legal basis: legal obligation and legitimate interest.

We don't sell your data and don't use it for advertising by others.

4. Who we share it with

Only what each needs to do its part:

• The logistics company and the restaurant: to place and deliver your order: your first name, the drop-off details and phone number for the rider, your order, and allergy notes. What happens inside the logistics company is also covered by its own privacy policy.
• Tap Payments: processes your card payment and any refund.
• Meta (WhatsApp): delivers login codes and lunch updates on WhatsApp. Its servers are outside the Kingdom.
• Authentica: delivers login codes by SMS, inside the Kingdom.
• Supabase and Vercel: host our database, login, photo storage and app, in Frankfurt, Germany.
• Cloudflare: checks that sign-ups and code requests come from a person, not a bot.
• OpenStreetMap: shows the map and turns your drop-off pin into a street address.
• Microsoft Clarity: measures how the website is used, on the website only (not in our iPhone app).
• Government authorities: when the law or a court requires it.
• A buyer or successor: if Picky is sold or merged, after telling you, under this same policy.

Our service providers process data on our instructions and under contracts that require them to protect it.

5. Data stored outside the Kingdom

Our database and app are hosted in Germany, and some providers above (Meta, Cloudflare, OpenStreetMap, Microsoft) process data in other countries. We transfer only what each needs, under the PDPL and its Regulation on Personal Data Transfer outside the Kingdom, with contractual safeguards from each provider.

6. How long we keep it

• Your account, preferences, allergies, drop-off, photos, weeks, orders, credit and our notes about you: kept until you delete your account. Deleting it (Profile → Delete account) erases all of them from Picky straight away, along with your waitlist entry.
• Usage data: kept for up to 2 years. When you delete your account, it is no longer linked to your phone number.
• Payments: Tap keeps its own record of your card payments and refunds, as payment rules require. Our accounts keep the amounts and dates that accounting and zakat rules require, without your profile.
• Messages you sent us on WhatsApp or by email: up to 2 years after the last contact, or less if you ask us to delete them.
• Waitlist data, if you never create an account: deleted if you ask, or 12 months after launch.

7. How we protect it

Data is encrypted in transit. Each customer can only read their own records, and only the founders running orders can see the order details they need. No system is perfectly secure. If a breach could harm you, we will tell the Saudi Data & AI Authority (SDAIA) within 72 hours of learning of it and tell you without undue delay.

8. Your rights

Under the PDPL you can:

• Be informed: of how and why we process your data (this page).
• Access: your data and get a copy of it in a readable format.
• Correct: data that is wrong or incomplete. Most of it you can edit in Profile and Preferences.
• Delete: your data. Use Profile → Delete account, or email us. Deleting your account erases your data from Picky straight away (section 6).
• Withdraw consent: for allergies or offers at any time. This doesn't affect what we did before.

Email info@trypicky.co. We reply within 30 days. If you're not satisfied, you can complain to the Saudi Data & AI Authority (SDAIA).

9. Allergies

Giving us your allergies is optional, but if you don't, we can't filter dishes for you. You can remove them in Preferences at any time; we then stop using them and stop passing them to restaurants. Restaurants prepare the food, so we can't guarantee a dish is free of an allergen (see our Terms).

10. Cookies and the iPhone app

We use cookies and local storage that the website needs to work (staying signed in, language, your planned week) and, on the website only, analytics cookies. You can clear or block them in your browser; some parts may then stop working. Our iPhone app asks your permission before using the camera (drop-off photo), location (drop-off pin), saving to Photos (your Taste DNA card) and notifications (weekly reminder). You can turn each off in iPhone Settings.

11. Age

Picky is for people aged 18 and over. We don't knowingly collect data from anyone younger, and we delete it if we find out.

12. Changes to this policy

We'll post any change here with a new date. If a change matters, we'll tell you in the app or by message before it applies.

13. Contact

• Controller: Picky Establishment (مؤسسة بيكي), Commercial Registration No. 7055481852
• Address: Building 3890, Al Qashashiyah, Al Nada District, Riyadh 13317, additional no. 7554, Kingdom of Saudi Arabia
• Email: info@trypicky.co