Privacy policy

Who is responsible

The « Rahi Wajda » service, at bipeur.online, is responsible for the processing described here. You can reach us at [email protected]. We sell no data, to anyone.

Restaurant owners

Accounts are opened by our team after a call; nobody signs up alone. We keep your name, the email address of the Google account you sign in with (Google confirms your identity to us; we never see your password), your phone number, and your restaurant's name, logo, colour and, if you enter it, location.

For the subscription, we keep your payment references: plan, amount, payment method, transfer reference and dates. We never see or store any card number.

If you turn on two-step verification, the authenticator secret is stored encrypted, the backup codes as hashes, and trusted devices are remembered by name for 30 days.

This data is used to run your console, your cashier screen and your customer page, to manage your subscription and to reach you about the service.

The callback form

On the homepage you leave us your name, your restaurant's name and your phone number. They are used only to call you back and open your account. No SMS or WhatsApp message is ever sent to that number. The form is protected from bots by Cloudflare Turnstile.

Restaurant customers

When you scan a restaurant's QR, we record your ticket number, the page's language and, only if you choose to add it, your first name. We ask for no phone number, no account, no email and no notification permission.

A random identifier is created in your browser's storage and sent with your ticket. It is used only to stop one phone from holding several numbers at once; it is shown to nobody and cannot tell who you are.

While your order is being prepared, the open page asks our servers every few seconds whether it is ready. We note the time of the page's last reply and how your phone can ring, so the counter knows whether to call you out loud.

On iPhone, you can add an Apple Wallet pass. It holds the restaurant's name and logo and your number, and Apple's notification service is what updates it when the order is ready. The pass includes the restaurant's address only if the owner entered it, so your iPhone can offer it near the counter.

Your ticket stays in your browser until the next day or until the order is finished, so a new scan brings the same number back.

Cashier screens

Every device connected to the counter (tablet, phone, computer) is recorded under a name suggested from the device and editable, with its browser and the date of its last activity, so the owner can see their devices and disconnect one.

Our team

Our team's actions on an account (creation, extension, suspension, payment confirmation, sign-in link, two-step verification reset…) are logged with their author, the date and the address they were made from. This log protects restaurant owners; it cannot be edited.

Visit statistics

On the homepage only, we load Google Tag Manager, which starts Google Analytics 4 and Microsoft Clarity. They measure pages viewed, clicks, device and browser type and an approximate location. Clarity also records the session (movements, clicks, scrolling) of the homepage, and of it alone.

For visitors in Europe (European Union, European Economic Area, United Kingdom, Switzerland), where the law requires it, a banner asks for your consent first and nothing loads without it. Elsewhere, these statistics load by default; you can block them at any time by deleting this site’s cookies and data in your browser settings, or with a content blocker.

None of this loads on the customer page, on the cashier screen or in the owner's and our team's consoles. Google and Microsoft process this data under their own privacy policies.

Cookies and browser storage

NEXT_LOCALE: a cookie that remembers the chosen language.

pager_session: the signed-in owner's session, valid 30 days, out of reach of scripts (httpOnly). pager_device: the trusted device for two-step verification, 30 days, same protection.

Local storage: on the customer page, the day's ticket and the anonymous identifier; on the cashier screen, its device token and display setting; everywhere, your choice about statistics (rw:consent).

Only after acceptance: _ga and _ga_* (Google Analytics), _clck and _clsk (Microsoft Clarity).

To change your mind, delete this site’s cookies and data in your browser settings: the statistics tools are no longer loaded, and in Europe the banner is shown again on your next visit.

Who receives the data

Our servers are hosted in Algeria. To run the service we rely on: Cloudflare (content delivery, protection of the site and the form), Cloudinary (logo storage), Apple (Wallet pass updates by notification), Google (owner sign-in; statistics through Tag Manager and Analytics), Microsoft (Clarity) and Chargily (CIB or Edahabia card payment, when offered).

These providers may process data outside Algeria, under their own commitments. Each receives only what it needs: Cloudinary the logos, Apple the pass content, Chargily the amount to pay.

How long we keep data

We keep data for as long as the service needs it: accounts and restaurant settings while the account exists, then a reasonable time after the subscription ends; customers' tickets while the service needs them (a ticket left open is cancelled by itself after 18 hours); callback requests while they are handled; payment references as long as the subscription requires. On request at [email protected], we delete what concerns you.

Your rights

Under Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, you have the right to access, rectify, delete and object to the processing of your data. Write to [email protected]; we answer within a reasonable time and may ask you to confirm your identity.

You may also refer to the National Authority for the Protection of Personal Data (ANPDP).

Security

The site and the API are served over HTTPS only. Access to data is limited to our team, with permissions per person, and every action is logged. Sessions are cookies out of reach of scripts, two-step verification secrets are encrypted, and no banking data passes through our servers.

Changes

We may update this policy as the service evolves. The date at the top of the page shows the latest version; an important change will be announced in the owner's console.