RothDine — Privacy Policy
Version: 1.0 (consent version 2026-10-30) · Applies from: 31 October 2026 · Operator: Gateway & Associate Business LLC
Owner-approved. Approved for publication by the owner of Gateway & Associate Business LLC on 31 October 2026, under the company's responsibility. It has not been independently certified by a lawyer, and the Arabic text has not had an independent native-language legal review.
1. Who we are
RothDine is operated by Gateway & Associate Business LLC ("RothDine", "we"), Ghala 10, Muscat, Sultanate of Oman. E-mail: support@rothdine.com. Phone: +968 9705 5140. For anything about personal data, write to support@rothdine.com with the subject "Data protection"; this address is our data-protection contact.
2. What this policy covers and our role
This policy covers the RothDine website, the restaurant administration application (app.rothdine.com), the guest menu that a restaurant shows its diners through a QR code, and our e-mail and telephone contact.
- For restaurant owners and their staff (account data), RothDine is the controller.
- For diners who use a restaurant's QR menu, the restaurant is the controller and RothDine is its processor: we process diner data only to run the menu, ordering and service-request features for that restaurant, on its instructions.
3. What we collect and why
| Who | Information | Why | Source |
|---|---|---|---|
| Website visitors | Technical request data recorded by our hosting provider (IP address, time, page, browser type); language choice (cookie qr_locale). No analytics, advertising or tracking scripts | Deliver and secure the website; remember language | Your browser |
| People who contact us | What you write or say: name, e-mail, phone, message | Reply to you | You |
| Restaurant owners and staff | Name, e-mail address, password (kept only as a cryptographic hash by our sign-in provider), optional multi-factor authentication data, role and branch permissions, invitations, restaurant and branch details, branding images, a record of important changes | Provide and secure the service; permissions; support; legal obligations | You and your restaurant |
| Your consent record | The versions of this policy and the Terms you accepted, whether you agreed to the transfer of your data outside Oman, the language shown, and the time (section 8) | Prove consent | You, at sign-up |
| Subscription payments | The payment request you create, the bank reference you quote, and the receipt image you upload (stored privately; visible to you and to RothDine's platform administrators) | Match a bank credit to your subscription | You |
| Diners using a restaurant QR menu | The table number, the content of an order or service request, and any note the diner types. No name, phone number, e-mail address or payment detail is collected, and the diner needs no account | Show the menu; let the restaurant receive orders and requests | The diner |
We do not sell personal data and do not use it for advertising or profiling.
4. Legal basis
- Your explicit consent to this policy and to the transfer of your data outside Oman, given at sign-up through two separate boxes (Article 10 of the Personal Data Protection Law). You can withdraw it at any time (section 10); withdrawal does not affect processing done before it, but the service cannot be provided without the data it needs.
- Performance of our agreement with you (running your account and subscription).
- Legal obligations, such as keeping records the law requires.
5. Who processes data for us, and where
| Provider | Role | Where the data is processed |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in and file storage: accounts, restaurants, menus, orders, photos, payment receipts | Mumbai, India (AWS region ap-south-1) |
| Vercel Inc. | Hosting of the website and application; server functions; request logs | The application's server functions run in Washington, D.C., United States (region iad1); pages and static files are served from Vercel's worldwide edge network |
| Hostinger | E-mail: our support mailboxes and (once switched on) service e-mails such as sign-up confirmation, password reset, invitations and billing notices | Not yet verified. We have not been able to confirm the country of the mail servers. We will state it here once Hostinger confirms it, and we send only the service e-mails named here through this provider |
| Payment provider | None | Subscriptions are paid by manual bank transfer; no card data reaches us |
6. Cookies and similar technologies
| Name | Purpose | Duration | Needed? |
|---|---|---|---|
qr_locale | Remembers English or Arabic | 1 year | Strictly necessary for the language setting |
| Sign-in session cookies | Keep a signed-in user signed in | Session / short-lived | Strictly necessary |
| Browser memory only (diner's table session) | Holds the diner's table session while the page is open | Until the page is closed | Not stored on the device |
No analytics or advertising cookies are used, so no cookie banner is needed.
7. International transfers
Your data is processed outside the Sultanate of Oman: the database, sign-in and files in India (Mumbai); the application servers in the United States (Washington, D.C.); pages and static files on Vercel's worldwide edge network; and e-mail through Hostinger, whose server location is still to be confirmed. We plan to move the application servers to Mumbai, which would remove the United States from the request path; this text will then be updated.
The Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulations (Ministerial Decision 34/2024) allow a transfer outside Oman under the controls they set, and treat explicit consent and an adequate level of protection at the destination as the key conditions. We therefore (a) ask for your separate, explicit consent to these transfers when you sign up, (b) use providers that apply security controls and written terms, and (c) transfer only what the service needs. If you do not consent, you cannot create an account, because the service cannot run without these providers.
8. How we record your consent
When you create an account you must tick two separate boxes, neither pre-ticked: (1) you have read and accept the Terms of Service and this Privacy Policy; (2) you consent to the transfer and processing of your personal data outside Oman as described in section 7. We then store, in an append-only record that you can read but not change: your account, which consent was given, the document version (2026-10-30), the language shown, and the time. We do not store your IP address in this record. If we change the documents in a way that needs a new consent, we ask you again.
9. Retention
| Data | How long |
|---|---|
| Account and restaurant data | While your account exists, and for up to 30 days after you ask us to delete it |
| Orders and order history | Up to 7 years, because they are business records of the restaurant |
| Payment requests, receipts and approvals | As long as the law requires business and tax records |
| Audit record of important changes | Up to 7 years |
| Consent record | As long as we need to prove consent |
| Contact e-mails | Up to 24 months |
| Backups | Held by our database provider; a deletion request is honoured in backups when they are next restored or rotated |
Deletion is carried out by our team on request; it is not yet automated.
10. Your rights
You may ask us to give you access to your personal data, correct it, delete it, restrict or object to its use, receive it in a portable form, and withdraw your consent. Write to support@rothdine.com ("Data protection"). We may need to verify who you are. We answer within the period the Executive Regulation sets (45 days at most). If you are a diner, we may pass your request to the restaurant that controls your data.
11. Security and breaches
Encrypted connections; separation of every restaurant's data inside the database; role-based permissions; optional multi-factor authentication for restaurant users and mandatory multi-factor authentication for platform operators; an append-only audit trail; receipts stored privately. No system is perfectly secure. If a breach is likely to affect your data, we will notify the Ministry of Transport, Communications and Information Technology and, where there is a serious risk, you, within the time the law sets (72 hours from our knowledge).
12. Children
The service is for businesses and is not directed at children. We do not knowingly collect children's data.
13. Changes, contact and complaints
We will post changes here with a new version number and tell account holders by e-mail before a material change takes effect. Contact: Gateway & Associate Business LLC (RothDine) · Ghala 10, Muscat, Sultanate of Oman · support@rothdine.com · +968 9705 5140. You may also complain to the competent authority under the Personal Data Protection Law, the Ministry of Transport, Communications and Information Technology.
14. Sources used
Royal Decree 6/2022 (Personal Data Protection Law), Articles 10 (explicit consent), 11 (rights), 14 (notice before processing), 20 (data-protection officer), 23 (transfers abroad); Ministerial Decision 34/2024 (Executive Regulation) and its 2025 amendment, as summarised by law-firm commentary; the Oman VAT Law and the Consumer Protection Law (Royal Decree 66/2014) for the Terms. The Executive Regulation's own text was not available to us in full; the owner has approved sections 7, 9 and 10 as written.