JAWA MENU · Your information

Privacy Policy

How we use personal information to provide JAWA MENU, and where to go for help with your data.

Updated 2 November 2026

At a glance

JAWA operates your account and protects access to the service.
Your restaurant or takeaway decides how its customer and staff information is used. Contact that business about an order or its records.
We currently use no optional analytics or advertising cookies. You can review your choice in our Cookie Policy.
Cookie choices are separate from accepting the Terms and Conditions.

1. Who is responsible for your information?

JAWA AI LTD operates JAWA MENU. We act as controller when deciding how to use information for our own account administration, service security, support and legal records.

The restaurant, takeaway or other business using JAWA MENU is normally the controller of its customer, order, delivery and staff information. We act as its processor when providing the service on its instructions. This policy explains our role; it does not replace that business's own privacy notice. The Data Processing Schedule in our terms describes those responsibilities.

If you are a customer or member of staff, contact that business first about how it uses your information. If we receive a request relating to information we process for it, we will refer the request to the relevant business and assist as required.

2. What information do we handle?

Information comes from you, the business and its authorised users, your browser when it connects, and a configured caller ID service or device when used.

Accounts and business contacts: Names, email addresses, business details, roles and memberships, password authentication records, account status, and records of who accepted which terms and when.
Access and security: Session identifiers, IP addresses, browser/device information, sign-in and lockout records, staff unlock and manager authorisation records, and service logs.
Customer, order and staff records: Details entered by the business, such as names, phone numbers, email addresses, delivery addresses, approximate postcode locations, order items, instructions, staff access details, transaction records and caller ID metadata. Free-text instructions can include sensitive information, such as allergies; businesses must collect this only when necessary and with an appropriate legal basis and condition.
Support and communications: Correspondence you send us, problem reports and included display settings, and the status of account messages, order confirmations and receipts.
Browser preferences: Your cookie choice and settings used for requested interface and till features. A sale not yet saved, including any customer details added to it, is kept in the till's browser tab until it is saved or cleared, the tab closes, or someone signs out or locks the till. Orders taken while a till has no connection, including any customer details, are kept on that device until they are synced. If the business chooses never to sync them, they stay only on that device until the business exports and clears them: JAWA does not receive or hold them, and the business is responsible for those records. The Cookie Policy explains browser storage and its duration.

Required account fields are needed to create and secure an account. A business may need contact or address details to fulfil an order. Without the necessary details, the relevant account or order function cannot be completed. Do not include unnecessary sensitive information or payment credentials in notes or support reports.

If you choose Sign in with Google or Sign in with Apple, that provider receives the sign-in request and your connection information. JAWA receives its verified account identifier and email address, and may use the supplied name to prefill registration. Apple private relay addresses are accepted. We retain the provider name and account identifier while connected, and a limited security record of linking or removing it. We do not receive your provider password or retain its access or refresh tokens. Provider sign-in is optional; connecting an existing JAWA account requires a separate confirmed sign-in.

3. Why do we use it?

For information we control, the following purposes and lawful bases apply:

Creating and operating your service account: Performing a contract with you, or taking steps you request before that contract. Where you represent a company rather than contract personally, we rely on legitimate interests in administering that business relationship and communicating with its representatives.
Protecting access, preventing misuse and providing support: Legitimate interests in maintaining a secure, reliable service, investigating faults and responding to requests, balanced against the interests and rights of the people concerned.
Keeping contractual evidence and handling disputes: Legitimate interests in recording agreements and establishing, exercising or defending legal claims. Where a specific legal recordkeeping or disclosure duty applies, we rely on that legal obligation.

For business-controlled information, we follow the business's lawful instructions to support ordering, preparation, delivery, receipts, staff access and reporting. The business must explain its purposes and legal bases, including any condition needed for health information. Our service agreement and a cookie choice do not provide customer consent for marketing or sharing data between businesses.

There are no optional analytics or advertising cookies in this application. A saved “accept” choice does not authorise future tracking, new recipients or new purposes. Any future activity requiring consent needs a specific explanation and fresh choice before it begins.

The current service does not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

5. How long is information kept and how is it protected?

We keep account security activity, including the event, IP address, a limited browser and system description, app and time, for 12 months to protect accounts and investigate misuse as a legitimate interest. You can review the last 90 days in Account security and end your own device or app access. Hashed device records expire after one year without sign-in; a device not seen for 90 days receives a new sign-in email. We never store passwords, tokens, codes or the email address entered into an unsuccessful sign-in in the activity record.

Account, support, security and acceptance records should be kept only for the time justified by their purpose, legal duties or relevant legal claims. Business-controlled records follow the business's documented retention instructions and applicable obligations. The deployment's periods, deletion process and backup expiry still need confirmation where the schedule is blank.

Deleting a customer-directory entry does not automatically remove customer details saved on earlier orders, in delivery snapshots or in notes, communications, logs or exports. A request must consider those copies too. Financial recordkeeping does not automatically justify keeping all delivery or allergy information for the same period.

The application uses access permissions, protected credentials and encrypted authentication cookies. Authentication sessions expire after 12 hours. The wider operational security arrangements for a deployment must be confirmed below. Cookie expiry ends browser access; it does not itself delete the related database records.

Retention, backups and return/deletion process: Pending confirmation before production use.
Operational security measures: Pending confirmation before production use.

6. Your choices and rights

You may ask for access to your personal information, correction, erasure, restriction or portability where the relevant right applies. Rights depend on the processing and can have legal conditions and exceptions. We may need to verify your identity. We will respond within the applicable statutory period, normally one month, subject to permitted timing rules and extensions.

You have the right to object to processing based on legitimate interests. You can object to direct marketing at any time.

Where separate processing relies on consent, you may withdraw that consent without affecting earlier lawful processing. You can change your browser cookie preference at any time in the Cookie Policy. Rejecting optional cookies does not prevent essential sign-in and security functions.

Use the contact details below for information we control. For a restaurant's customer or staff records, contact that business as controller; we assist it with appropriate requests. You can also complain to the Information Commissioner's Office or another competent supervisory authority. You do not have to contact us first.

7. Contact and updates

Service provider and account data controller: JAWA AI LTD
Company number: 15815826
Business / registered address: 53 Dorcas Avenue, Newcastle Upon Tyne, United Kingdom, NE15 6SL
Privacy enquiries and rights requests: [email protected]

We will update this notice when the service or relevant processing changes and identify the revision date above. Where needed, we will bring material changes to your attention before new processing begins. Updating this notice does not change the edition of the terms accepted by a business.