Privacy Policy

1. Who this policy is about

It covers everyone Profiley holds information about: people with an account, the businesses that publish a profile, the team members and couriers who work on one, and guests who scan a QR code and order without registering.

Profiley decides how the information described here is handled, which under Egypt's Personal Data Protection Law and under the GDPR makes us the controller of it. When a business uses Profiley to run its own operation, it decides things about its own customers too, and it is responsible for that part.

For anything in this policy, write to [email protected].

2. What we collect

We collect the following, and nothing here is sold to anyone.

• Account details: your name, username, email address, a hashed version of your password, and your language. If you sign in with Google, Apple or Facebook, we receive your name, email address and profile picture from them. Apple can hide your real address behind a relay address, and that works normally on Profiley.
• Profile content: your picture and cover image, bio, job title or category, links, location if you add one, and the posts, reels, comments, reactions, saved items and messages you create.
• Business content: your catalogue or menu and its images, tables and QR codes, opening hours, services, bookings, packages, team members and their roles, and delivery settings.
• Transactions: orders, bookings, payments, refunds, your wallet balance and its full ledger, service fees, ad spend, and for a business its payout history and the bank details it enters for payouts.
• Payment details: a reference to your payment method held by our payment provider, together with the card type and last digits. Profiley never receives your full card number, its expiry date or its security code.
• Delivery details: the addresses you save, the address on a specific order, a phone number for the courier, and, while a delivery is in progress, the courier's location.
• Location: your approximate or precise location, when you allow it, to show what is near you and to quote a delivery.
• Device and technical data: IP address, device model and operating system, app version, a notification token if you allow notifications, and a session identifier. A guest order is tied to a guest identifier stored on the device.
• How you use Profiley: screens opened, features used, orders and bookings completed, and similar events, collected as counts and analytics rather than as a record of everything you look at.
• Diagnostics: technical error reports when something breaks, which can include the screen you were on and your account or device identifier.
• Safety data: the results of automatic screening of text and images, reports people make about content, and notes from our review of them.

3. Why we use it

Each purpose below has a lawful basis under Egypt's Personal Data Protection Law and, where it applies, the GDPR.

• To run the service you asked for: your account, your profile, orders, bookings, deliveries, payments, refunds and payouts. This is necessary to perform our agreement with you.
• To keep Profiley safe: screening content, acting on reports, preventing fraud and abuse, rate-limiting and securing accounts. This is our legitimate interest, and in places a legal obligation.
• To communicate with you: order and booking updates, security notices, and the notifications you have chosen. Service messages are part of performing our agreement; optional ones rest on your choice.
• To improve the product: analytics, aggregate statistics and error diagnostics, so we can see what is slow, broken or unused. This is our legitimate interest, and our analytics can be switched off in your settings.
• To show relevant things: ranking discovery results, energy ratings built from verified activity, and promoted profiles. This is our legitimate interest in a useful product.
• To meet legal and accounting obligations, and to establish or defend a legal claim.
• For anything that needs your permission, such as precise location, push notifications, camera access for scanning, or optional analytics, we use it only while that permission is on. You can withdraw it at any time in the app or in your device settings.

4. What is public

A public profile, and the posts on it, can be seen by anyone, including people without a Profiley account. They can be indexed by search engines, shown as a link preview elsewhere, and reached at your Profiley username link.

You control this. Each profile has a visibility setting and a switch that keeps it out of search engines, and each post has its own visibility. Your email address, phone number, saved addresses, wallet, order history and payment details are never published.

A business profile is public by nature, and so is the catalogue, price list and QR menu it publishes.

5. Who else sees your information

We share only what a recipient needs, and only for the reasons below.

• The business you order or book with: your name, profile, the order or booking itself, and, for a delivery, the address and phone number needed to fulfil it. As a guest at a table, the business sees the order and the name you give, not an account.
• The courier on a delivery: the delivery address, a contact number, and what is being delivered.
• Our payment provider, Paymob, which processes card payments, holds and refunds, and confirms when money has cleared for a payout.
• Service providers who run parts of the platform for us: Amazon Web Services for hosting, storage, email and push delivery, Sentry for error diagnostics, Google Analytics for usage analytics, Capgo for app updates, and a routing provider for delivery distances and directions. They act on our instructions.
• Apple and Google, which deliver push notifications to your device, and the sign-in provider you choose when you sign in with it.
• AI providers, currently Anthropic and Google, for the platform's own AI-generated profiles and for content-assistance features. We do not send them your private messages, payment details or contact details.
• Our own team, where support, moderation, financial reconciliation or a security investigation needs it. Access is limited and logged.
• Authorities and advisers, where the law requires it or to establish or defend a legal claim.
• A buyer or successor, if the business behind Profiley is ever sold or reorganised. We would tell you first, and this policy would continue to apply until it is replaced.

6. Location

Location is used for three things: showing what is near you, quoting and routing a delivery, and letting a customer follow a courier while an order is on its way.

We ask for it when a feature needs it, and you can refuse or withdraw it in your device settings. Refusing means those features fall back to what you type in, or stop being offered.

A courier's location is shared while they are on an active delivery, and stops when the delivery ends.

7. Cookies, storage and analytics

On the web we set a small number of cookies that keep you signed in and protect the session. They are necessary for the service, and the app cannot work without them.

We also store preferences on your device, such as your language, your last-used profile, drafts and settings you have chosen. That stays on your device.

If Google Analytics is enabled for the app, it records how the product is used and sets its own identifiers. You can turn our analytics off in Settings, and doing so stops us from sending those events.

We do not run third-party advertising trackers, and Profiley ads are served by us from your own activity on the platform, not from data bought about you.

8. Guests, without an account

You can scan a table QR code and order without registering. We then store a guest identifier on your device, the orders in that session, and any name and phone number you give the business.

A guest identifier is kept while it is in use and for a limited period after, so that returning to a table does not lose your bill, and is removed once it goes unused. If you later create an account, your open guest session can be joined to it.

9. Where your information is held

Profiley runs on Amazon Web Services, and your information is stored and processed in the United States, with a content delivery network serving media closer to you.

Some of the providers listed above process data outside Egypt and outside the European Economic Area. Where that is the case we rely on the safeguards our contracts with them provide, including the standard contractual clauses, and we share only what the provider needs.

10. How long we keep it

Your account and its content are kept while your account is open. Deleting a profile removes its posts, comments, media and social connections from Profiley.

Financial records are kept even after deletion, because the law requires it: transactions, the wallet ledger, refunds, payouts and their invoices. We keep them for the retention period Egyptian tax and commercial law sets, and then delete them.

Other periods: error diagnostics and technical logs are kept for a short period; aggregated statistics have their own expiry and hold no message content; a guest identifier expires after a period of inactivity; backups roll over on their own schedule.

Where we must keep a record, we keep the record and nothing more.

11. Your rights

You can ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or withdraw a permission you gave. You can also ask us not to make a decision about you by automated means alone.

Much of this is immediate in the app: edit your profile, change a visibility setting, turn analytics or a notification category off, remove a saved address, or delete a profile or the whole account from Settings.

For anything else, write to [email protected]. We answer within 30 days, and we may need to confirm who you are first. If you are not satisfied, you can complain to Egypt's Personal Data Protection Centre, or to your own data protection authority if you are in the European Economic Area or the United Kingdom.

12. Children

Profiley is not for children under 13. If you are under 18, you need a parent's or guardian's permission to use it.

If you believe a child under 13 has an account, write to [email protected] and we will remove it.

13. How we protect it

Traffic is encrypted in transit, passwords are stored only as hashes, and private media is served through short-lived signed links that are tied to who is asking. Access to production data is limited to the people who need it and is recorded.

No system is perfect. If a breach affects your information and puts you at risk, we will tell you and the regulator as the law requires.

14. Changes to this policy

We may update this policy. The date at the top shows when it last changed, and we announce material changes in the app or by email before they take effect.

15. How to reach us

For any privacy question, request or complaint, write to [email protected], or use Report a Problem inside the app.