Privacy notice

Who we are

This notice is issued by Maitre Ahlan, a pilot service run by its founders in Doha, Qatar pending the incorporation of a Qatari company ("Maitre Ahlan", "we").

Maitre Ahlan is in its pilot phase. The pilot is run by the founders of Maitre Ahlan pending the incorporation of a Qatari company. Once that company is formed, its legal name, commercial registration number and registered address will be published here, and it will take over the rights and obligations described in these documents.

Contact: [email protected].

Who is responsible for your data

When you message a restaurant. The restaurant you contact decides why and how your booking data is used. It is the controller of your data, and Maitre Ahlan processes it on the restaurant’s behalf, under a written agreement, to run the restaurant’s WhatsApp concierge. Questions about how a particular restaurant uses your data can go to that restaurant or to us; we will pass them on.

Shared use across restaurants. We use your details across more than one restaurant (for example, to remember your preferences) only if you have agreed to it. Without your consent, each restaurant’s guest data is kept separate.

Our own website and restaurant accounts. For visitors to maitreahlan.com, people who write to us, and restaurant staff who use our back office, Maitre Ahlan is the controller.

What we collect

Through WhatsApp, on behalf of the restaurant:

• your WhatsApp number and profile name;
• the messages you send and our replies;
• booking details: date, time, party size, name for the booking, special requests and occasions you mention;
• dietary or allergy notes, only if you choose to share them, used only to pass them to the restaurant;
• your marketing choice (yes, no or STOP) and when you made it;
• delivery and read status of messages.

On the website and back office:

• what you send us through the contact form or by email (name, restaurant, email, phone, message);
• restaurant staff account details (name, email, role) and back-office activity logs;
• billing details for restaurants, handled by our payment provider (we do not store full card numbers);
• basic technical data needed to run the site securely (such as IP address in server logs).

Website analytics. We count page views and button clicks with our own cookieless, first-party counter. It stores only the page path, the event name and the time. No cookies, IP addresses or identifiers are used, and it switches off when your browser sends Do Not Track or Global Privacy Control.

Why we use it, and on what basis

• To handle your booking or question for the restaurant you contacted: you asked for it, and it is needed to provide what you requested.
• To send confirmations and reminders about a booking you made: needed for that booking.
• To hand you to a person at the restaurant when you ask or when the request needs one.
• To keep the service secure and working, prevent misuse and keep records the law requires: the legitimate interests of the restaurant and of Maitre Ahlan, and legal obligations.
• To send offers or news: only with your consent, which you can withdraw at any time.
• To reply to enquiries and manage restaurant accounts and billing: to take steps you asked for and to perform our contract with the restaurant.

We do not sell personal data, and we do not use it for advertising profiles.

Marketing is consent only

We or the restaurant send promotional messages only if you have said yes. Saying no never affects your booking.

To stop marketing messages on WhatsApp, reply STOP at any time. Email updates are opt-in only, and every email includes an unsubscribe link. You can also write to [email protected].

How long we keep it

• Booking records and conversations: for as long as the restaurant uses Maitre Ahlan and needs them for its bookings, and in any case deleted or anonymised within 90 days after the restaurant leaves, unless the restaurant has exported them under its own policy.
• Marketing consent and opt-out records: as long as needed to respect your choice and prove it.
• Website enquiries: up to 24 months after our last contact, unless you become a client.
• Restaurant account and billing records: for the life of the account and then as long as the law requires.

The restaurant you contacted can ask us to delete its guest data earlier.

Security

We protect data with encrypted connections, access limited to authorised people (with multi-factor authentication for our team), database rules that keep each restaurant’s data separate, and logging of important actions. No system is perfectly secure; if a breach affects your data, we will act promptly and notify the restaurant and, where required, the authority and you.

Service providers and transfers outside Qatar

We use these providers to run the service: Supabase (database and storage), Vercel (hosting), 360dialog and Meta (WhatsApp Business messaging), Tap Payments (restaurant payments), Resend (email delivery) and Google (website contact form delivery).

Restaurant guest conversations are answered by a rule-based engine and are not sent to an AI model provider. Maitre Ahlan’s own WhatsApp line (for restaurants and guests who write to Maitre Ahlan directly) may, if we switch it on, send a short message to an AI model provider only to work out what the message is about, with a daily cap; we will name that provider here before it is used.

Some of these providers store or process data outside Qatar. Where they do, we rely on their contractual and security commitments and take the steps Qatari law requires for cross-border transfers. WhatsApp messages are also subject to WhatsApp’s own privacy policy.

Your rights

You have the right to:

• access the personal data held about you;
• correct data that is wrong or incomplete;
• delete data, where it is no longer needed or you withdraw consent;
• object to processing, including at any time to marketing, and withdraw consent;
• be told about a breach that seriously affects you, and complain to the competent authority in Qatar.

To use these rights, write to [email protected] from the email or WhatsApp number concerned, or ask in the WhatsApp chat to speak to a person. We may need to confirm your identity. We reply within 30 days. If your request concerns a restaurant’s guest data, we handle it with that restaurant.

Children

Our service is meant for adults making restaurant bookings. We do not knowingly collect data from children under 18. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this notice

We will update this notice when our service or the law changes. The date at the top shows the latest version. Significant changes will be highlighted on this page.