Customer Policy
Privacy Policy
This policy explains what personal information Leffah collects when you use our website or mobile app, why we collect it, who we share it with, and what control you have over it.
Information We Collect
- Information you give us Name, email address, delivery address, phone number, and — where needed for rewards or age verification — date of birth. Payment card details are entered on and processed by our payment provider; we do not store full card numbers on our systems.
- Order information What you ordered, from which store, when, where it was delivered, order value, and any notes or preferences you added.
- Allergy and dietary information If you tell us about a food allergy or dietary requirement, we treat it as sensitive data and use it only to pass on to the store preparing your order. We ask for your explicit consent before collecting it, and you can withdraw that consent at any time.
- Information collected automatically IP address, browser type, operating system, device identifiers, pages viewed, and how you move through the site or app. This is gathered through cookies and similar technologies.
- Location information The mobile app may ask permission to use your precise location to find nearby stores and confirm your delivery address. You can refuse or turn this off in your device settings; you'll then need to enter your address manually.
How We Use Your Information
- To process and deliver your orders Passing order and contact details to the store and the courier, taking payment, and issuing refunds.
- To manage your account and rewards Keeping your saved addresses and order history, and running any loyalty or promotional programme you join.
- To support you Answering questions and investigating complaints about an order, payment, or delivery.
- To improve our service Understanding which pages and menu items are used, fixing problems, and testing improvements to the site and app.
- For marketing — only with your consent Sending offers and updates by email, SMS, or WhatsApp. Every message includes a way to opt out, and opting out does not affect your ability to order.
- For security and legal compliance Detecting fraud and abuse, protecting our systems, and meeting obligations under the laws of the Kingdom of Saudi Arabia, including tax and record-keeping rules.
Sharing & Disclosure
We share only what is necessary with the partners who help us run the service: restaurants and stores fulfilling your order, delivery couriers, payment processors, SMS and email providers, hosting and analytics providers. They may use your data only for the task we've given them.
We do not sell or rent your personal information to third parties for their own marketing.
We may disclose information when required by law, a court order, or a request from a competent authority, or where it is necessary to protect our rights, our staff, or the safety of others.
If our business is sold, merged, or restructured, customer data may transfer to the new owner under the same protections described here.
Data Security & Retention
We protect your information with encrypted connections (HTTPS), restricted staff access on a need-to-know basis, secured databases, and payment handling through a certified provider so card details never sit on our servers.
No system is completely secure, so we cannot promise absolute protection — but if a breach affects your data, we will notify you and the relevant authority as required by law.
We keep your data only as long as we need it: account and order records for as long as your account is active and for the period tax and commercial regulations require afterwards, and marketing consents until you withdraw them.
Cookies & Tracking
We use cookies and similar technologies for three purposes:
- Essential cookies Keep you signed in, hold your cart, and secure checkout. The service cannot work without these.
- Analytics cookies Show us how the site and app are used so we can fix problems and improve them.
- Marketing cookies Let us show relevant offers and measure whether our advertising works.
Your Rights & Choices
Under the Personal Data Protection Law of the Kingdom of Saudi Arabia — and, where they apply to you, laws such as the GDPR — you have the right to:
- Access your data Ask what personal information we hold about you and get a copy of it.
- Correct it Have inaccurate or incomplete information updated. Most details can be edited directly in your account.
- Delete it Ask us to erase your data, except where we must keep records to meet a legal or tax obligation.
- Object or restrict Opt out of direct marketing at any time, or object to other specific uses of your data.
- Withdraw consent Take back consent you gave — for allergy information, location access, or marketing — without affecting anything done before you withdrew it.
- Request a copy to transfer Receive your data in a commonly used, machine-readable format where this right applies.
To exercise any of these, email us at [email protected] from the address on your account, or contact us on the number below. We respond within 30 days. If you're not satisfied with our response, you may raise a complaint with the competent data protection authority.
Children's Privacy
Our service is intended for adults. We do not knowingly collect personal information from children without the consent of a parent or guardian. If you believe a child has given us their information, contact us and we will delete it.
Changes to This Policy
We may update this policy as our service or the law changes. The date at the top of this page always shows the current version, and we recommend checking it from time to time. If a change materially affects how we use your data, we will tell you through the app, by email, or with a notice on the site.
Contact Us
Questions about your privacy, or want to exercise one of your rights? Reach us directly: