Privacy policy

Yafta is operated by Mohamed Abdelmaksoud, a sole proprietorship registered in Egypt under commercial register number 273292. We are the controller of the personal data described in this policy.

For any question about this policy, or to exercise any of the rights set out below, write to mohamed@abdelmaksoud.dev.

We collect only what you give us, either to use the service or to contact us.

• Account: your email address and your chosen language. Your password is held by our authentication provider and is not accessible to us.
• Business: its name, country, and a description of your premises generated from photographs you upload.
• Branches: address, telephone number, opening hours and map link.
• Brand: colours, logo, social media handles, WhatsApp number and tone of voice.
• Menu: dish names, prices, descriptions and which dishes sell best.
• Photographs: dishes, premises, menu card, logo, and any image attached to a chat message.
• Conversations: the messages you send in chat and the replies you receive.
• Posts: captions, prices shown, and the images produced.
• Billing: amount, date and payment method. Card details are held by our payment provider and are not accessible to us.
• Enquiries: if you write to us through the contact form, your name, email address, the name of your business, and what you wrote.

A message sent through the contact form is delivered to our own inbox by email and is not stored in Yafta.

To generate an image or answer a question in chat, Yafta sends your dish photographs, your branch address and telephone number, your prices and your own text to AI providers located in the United States: Google and OpenAI. Your images are stored in Germany, and the application is hosted in Germany.

We do not currently instruct those providers to exclude your data from model training or to delete it after processing. Their standard terms for API customers apply.

Yafta does not train any model on your data, and does not sell or share your data for advertising.

We use the following processors, each handling only what its function requires.

Images are served from public web addresses. Anyone with the link to one of your images can open it, whether or not you have published it.

We keep your data for as long as your account exists.

• Deleting a dish, photograph, post or conversation removes it from your view but retains the underlying record, so that billing history and support requests remain accurate.
• Photographs attached to a chat message but never sent are deleted within twenty-four hours. Photographs in messages you sent are retained.
• Records of what was generated are retained indefinitely. These include the exact text sent to the AI provider, which can contain your address, telephone number and prices.
• Billing records are retained indefinitely, as accounting records.
• Messages sent through the contact form live in our email, as the record of that enquiry and of how we answered it.

Yafta does not currently offer a self-service option to delete your account and erase your data. To have it removed, write to mohamed@abdelmaksoud.dev and we will carry it out.

You may request a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to mohamed@abdelmaksoud.dev and we will respond within thirty days.

If you are in the European Union or the United Kingdom, you may also lodge a complaint with your national data protection authority. If you are in Egypt, that authority is the Personal Data Protection Centre.

Your account has access only to its own data, and this is enforced by the database rather than by the application.

Our staff can access any account in order to answer a support request or investigate a failed post. Such access is logged.

Yafta uses three cookies, none of which are used for advertising.

• One records your chosen language.
• One records the country you are visiting from, so that prices are shown in the appropriate currency.
• One keeps you signed in.

We use Vercel Analytics to count page views. It does not use cookies to track you across other websites.

Access to your data is restricted at the database level, connections are encrypted, and passwords are held by our authentication provider rather than by us.

If your personal data is exposed, we will notify you and the relevant supervisory authority within seventy-two hours of becoming aware of it.

Yafta is a tool for businesses and is not intended for anyone under the age of 18. We do not knowingly collect data from children.

The date at the top of this page records when this policy last changed. We will notify you of any change that materially affects you.