Privacy Policy

• Account details: your name, email address, phone number, password (stored only in encrypted form) and your role (student, cafeteria owner, staff or admin).
• Cafeteria details: for cafeterias, the business name, location, description, photos, menu, stock and opening hours.
• Orders: what was ordered, from which cafeteria, prices and fees, times, status, pickup codes and cancellation reasons.
• Payments: the amount, payment method type (card or wallet), the payment reference from our payment processor and refund status. Card numbers are entered on Paymob's page and never reach Tuck.
• Payout details (cafeterias): the bank account, InstaPay address or wallet number where Tuck sends your earnings.
• Reviews and support: ratings and comments you write, and messages and screenshots you send to support.
• Security and technical data: sign-in times, and for actions in the admin portal, the IP address and browser used. If error monitoring is on, technical details of errors (without names or email addresses).

• To run your account and let you sign in securely.
• To place, prepare and track orders, and to notify you about them.
• To review cafeteria applications and keep the platform safe, including investigating misuse.
• To answer support requests.
• To calculate fees and commissions and keep the records the law requires.
• To understand how Tuck is used so we can improve it, using totals rather than individual profiles where we can.

• Cafeterias see the name of the customer, the order and the pickup code for orders placed with them. They don't see your email or other orders.
• Tuck staff with admin access can see account and order details to run and support the platform. Admin accounts must use two-step sign-in.
• Service providers that host and run Tuck for us: Supabase (database, sign-in and file storage), Vercel (website hosting), Paymob (payment processing: it receives your name, email, phone and order total to take the payment) and, if switched on, Sentry (error monitoring). They process data only on our instructions.

We don't sell your personal data. We share it with authorities only when the law requires it.

Our service providers may store data on servers outside Egypt, in [region of the Supabase project]. Where that happens we make sure the transfer is allowed under Egyptian law and that the data stays protected.

We keep account data while your account is open. Order and fee records are kept for [number] years for accounting and legal purposes. Support messages and admin activity logs are kept for [number] months. When you delete your account we delete or anonymise your data, except what we must keep by law.

Data is encrypted in transit, access is limited by role (students, cafeterias, staff and admins each see only what they need), admins use two-step sign-in, and important admin actions are recorded in an audit log.

Under Egyptian law you can:

• ask what personal data we hold about you and get a copy;
• correct data that's wrong or incomplete;
• ask us to delete your data or stop using it;
• withdraw consent where we rely on it;
• complain to Egypt's Personal Data Protection Center.

To use these rights, contact us. We'll reply within the time the law sets.

If we change this policy in a way that matters, we'll tell you before the change takes effect.