Privacy Policy

This policy explains what personal data Dieto collects when you use the Dieto app and website, why we collect it, who we share it with, how long we keep it, and the choices you have. It applies to diners who order meals and supplements, and to the kitchens and shops ("partners") who sell through Dieto.

The short version

• We collect what we need to run your account, calculate your nutrition targets, and get your order from the kitchen or shop to your door.
• Some of what you tell us — your body measurements, goal, diet style, allergies and what you eat — is health data. We treat it as sensitive and only use it with your explicit consent.
• Kitchens see what they need to prepare your order, including your allergy flags. They never see your weight, height, age or targets.
• We don't sell your data. The app has no advertising or tracking tools, and the website sets no cookies.
• You can delete your account in the app at any time: Account → App settings → Delete account. Order and payment records are the exception: UAE tax law requires us to keep them for a set period.

1. Who we are

Dieto is operated by [Dieto legal entity name], a company registered in the United Arab Emirates under trade licence [trade licence no.], with its registered address at [registered address] ("Dieto", "we", "us").

For the personal data described in this policy, Dieto is the data controller: we decide why and how it is processed.

You can reach us about anything in this policy at [privacy@ contact]. [Legal review: confirm whether Dieto must appoint a Data Protection Officer under the UAE data protection law — processing health data may make it mandatory — and, if so, add the DPO's name or role and contact here.]

2. What this policy covers

This policy covers:

• the Dieto app for iPhone, used by diners and by partner kitchens and shops;
• the Dieto website; and
• your contact with our support team.

Kitchens and shops that sell through Dieto receive some of your data to fulfil your order (see section 6). They are responsible for how they handle it once they have it, and our agreement with them limits them to using it for your order. Our delivery partner and payment processor also have their own privacy policies, which apply to the data they process for their own purposes.

3. The data we collect

When you create an account

• Your mobile number, which is how you sign in.
• Your full name, email address (for receipts), date of birth and city.
• A referral code, if you enter one.
• Your language setting (English or Arabic).

When you sign in

We send a one-time code to your mobile number by WhatsApp. We store the code only in a scrambled (hashed) form, and it expires within minutes. Once you're signed in, we keep a session token so you stay signed in.

Health and body data

To calculate your daily calorie and macro targets and to hide dishes you can't eat, we ask for:

• your sex, age (from your date of birth), height and weight;
• your goal (lose weight, stay the same, or build muscle);
• your diet style (for example, balanced or high protein);
• your allergies and intolerances;
• the supplements you take; and
• what you've eaten through Dieto, which we add up against your daily targets.

From these we work out your calorie, protein, carb and fat targets. We treat all of this as sensitive personal data — see section 5.

When you order

• What you ordered: dishes, portions, add-ons, supplements, quantities, prices and the nutrition figures at the time of the order.
• Notes you leave for the kitchen or the rider.
• Your delivery address, its label (such as "Home"), and the map location you set for it.
• Delivery windows and the status of each order.
• For meal plans: the meal slots, days, delivery windows and address you choose, and any days you skip or swap.
• Ratings and reviews you leave, including whether a portion matched its label.

Payments and your wallet

• Cards, Apple Pay and Google Pay: your card number is entered into, and held by, our payment processor, [Payment processor name]. We never see or store your full card number or security code. We keep a token from the processor, plus the card's brand, last four digits and expiry date, so you can pay again.
• Cash on delivery: we record that the order was paid in cash and the amount collected.
• Dieto wallet: we keep a record of every credit and debit to your wallet, such as refunds and referral credit.
• Promotions: the promo codes you use and the discounts applied.

When you contact us

The messages you send our support team, and our replies. What you choose to share with us here is up to you.

Your preferences

Your notification settings, and whether you've agreed to receive offers and new-kitchen announcements.

Technical data

When the app or website talks to our servers, the servers receive technical information such as your IP address, the app version, your device type and operating system, and the time of the request. We use it to run the service, keep it secure, and fix problems. The app does not collect your device's advertising identifier.

Partner kitchens and shops

If you work for a kitchen or shop that sells through Dieto, we also collect:

• the business's name, trade licence, locations, opening hours and delivery zones;
• the names, work email addresses and mobile numbers of the staff who sign in, and their sign-in details (store ID or email, and a password we keep only in hashed form);
• the bank account used for payouts (bank name and last four digits shown in the app; full details held for payment only); and
• your menus, recipes, portion weights, nutrition figures and the records of how each order was handled.

4. How we use your data, and why we're allowed to

UAE data protection law lets us process personal data with your consent, or without it only in specific cases — for example, where we need it to perform our contract with you or to comply with the law. For each use below we give the reason we rely on. [Legal review: confirm each basis against Article 4 of Federal Decree-Law No. 45 of 2021, which has no general "legitimate interests" basis, and against its executive regulations once they are issued.]

• Running your account and signing you in — needed to perform our contract with you.
• Calculating your targets, tracking what you've eaten, and filtering out dishes you're allergic to — your explicit consent, given when you create your account (see section 5).
• Passing your order to the kitchen or shop, and to the rider — needed to perform our contract with you.
• Taking payment, issuing refunds and managing your wallet — needed to perform our contract with you, and to comply with the law.
• Keeping invoices and transaction records — to comply with the law, including UAE tax law.
• Customer support — needed to perform our contract with you.
• Preventing fraud and misuse, and keeping the service secure — to comply with our legal obligations and to protect our users, partners and Dieto. [Legal review: confirm the basis.]
• Checking and improving calorie labels — using order and review data (such as "portion matched the label") to find labels that need rechecking. This is part of the service you signed up for; we use the data in a form that doesn't identify you wherever we can.
• Improving the app — using aggregated or de-identified data only.
• Sending offers and new-kitchen announcements — only with your consent, which is optional and separate. You can withdraw it at any time.
• Service messages (such as order updates) — needed to perform our contract with you. You can turn most of them off in Account → Notifications.
• Complying with the law and responding to lawful requests from UAE authorities.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Your calorie targets are calculated automatically from a standard formula, but they are an estimate for your information, and you can change the inputs at any time.

5. Your health data

Health data gets extra care, both under UAE law and from us.

• We ask first. When you create your account, you agree to our Terms and this policy, including how your health data is used to calculate your targets. This consent is separate from marketing, which is its own optional choice.
• We use it only to serve you. Your health data is used to calculate your targets, show your progress, filter out dishes that contain your allergens, and flag your allergies to the kitchen preparing your order.
• Kitchens see allergy flags, not your body. A kitchen preparing your order sees the allergies relevant to it. It never sees your weight, height, age, goal or targets.
• Never for advertising. We don't use health data for advertising or marketing, and we don't share it with advertisers or data brokers.
• You can withdraw consent. You can change or clear your body details, goal, diet style and allergies in the app at any time, or delete your account. If you withdraw consent, we can't calculate personal targets or filter dishes for you, but you can still order.

Dieto is not a medical service. Your targets are general estimates, not medical advice.

6. Who we share your data with

We share personal data only with the people and companies below, and only what each one needs.

• The kitchen or shop you order from — your first name, order reference, what you ordered, your notes, and the allergy flags relevant to your order.
• Our delivery partner, [Delivery partner name] — your name, mobile number, delivery address and map location, delivery notes, order reference and pickup code, so a rider can collect and deliver your order and contact you about it.
• Our payment processor, [Payment processor name] — your card details (which you give directly to the processor), payment amounts and order references, to take payments, issue refunds and prevent fraud. If you use Apple Pay or Google Pay, Apple or Google processes the payment information under its own terms.
• Meta Platforms (WhatsApp) — your mobile number and your one-time sign-in code, which we send through the WhatsApp Business Platform. Meta processes this on our behalf to deliver the message.
• Service providers who host and run our systems — such as cloud hosting ([Hosting provider and region]), email delivery ([Email provider]) and support tools ([Support tool, if any]). They act only on our instructions.
• Professional advisers — such as lawyers, accountants and auditors, under a duty of confidentiality.
• Authorities — UAE government bodies, courts and law enforcement, when the law requires it or to protect the rights, property or safety of our users, partners or the public.
• A buyer of our business — if Dieto is reorganised, merged or sold, your data may pass to the new owner, who must continue to protect it as this policy describes.

For partners: diners see your business name, menus, nutrition figures, ratings and location. Your staff contact details and bank details are not shown to diners.

We do not sell your personal data.

7. Data stored or processed outside the UAE

Some of our providers process data outside the United Arab Emirates. In particular, WhatsApp messages are handled by Meta's systems, which may be outside the UAE, and [state where the hosting provider stores data].

When personal data leaves the UAE, we transfer it only as UAE law allows — for example, to a country the UAE recognises as giving adequate protection, or under a contract that requires the recipient to protect it to the standard UAE law expects. [Legal review: confirm the transfer mechanism for each provider under Articles 22 and 23 of the PDPL, given that no list of adequate countries has been published. Decide whether health data must be hosted in the UAE: Federal Law No. 2 of 2019 on the use of ICT in health fields requires this for the health data it covers, and whether it covers Dieto is unclear.]

8. How long we keep your data

We keep personal data only as long as we need it for the purposes above.

• Your account, profile and health data — until you delete them or delete your account.
• One-time sign-in codes — deleted automatically within minutes.
• Orders, payments, refunds, wallet transactions and invoices — for as long as UAE tax law requires. VAT records must be kept for five years after the end of the tax period they relate to, and corporate tax records for seven years, so we keep these records for [seven] years. [Legal review: confirm the period, including any longer period needed for claims.] When you delete your account, these records are kept for that period only, separated from your profile, and then deleted or anonymised.
• Support conversations — [24 months] after the conversation ends, unless they relate to an unresolved dispute.
• Marketing consent records — for as long as you're subscribed, and for [3 years] afterwards as proof of consent.
• Security logs — [90 days], unless needed to investigate an incident.
• Partner records — for the life of the partner agreement and afterwards as tax and commercial law requires.
• Backups — deleted data can survive in encrypted backups for up to [35 days] before the backups are overwritten.

We may keep data that no longer identifies anyone (for example, how many orders a dish received) without limit.

9. Your rights

Under UAE data protection law, you can ask us to:

• give you a copy of the personal data we hold about you, and information about how we use it;
• correct data that is inaccurate or incomplete — most of it you can edit yourself in the app;
• delete your data, subject to the records we must keep by law;
• restrict how we use your data in some circumstances, for example while we check a correction you've asked for;
• stop using your data for direct marketing, or object to other uses in some circumstances;
• transfer your data to you or another provider in a machine-readable format, where it is technically feasible; and
• withdraw your consent at any time, without affecting what we did before you withdrew it.

To use any of these rights, email [privacy@ contact] from the email address on your account, or contact support in the app. We may need to confirm it's you before we act. We'll reply within [30 days]. [Legal review: confirm the response period required by the executive regulations.]

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can also complain to the UAE Data Office.

10. Deleting your account

You can delete your account in the app at Account → App settings → Delete account. When you do:

• your profile, health data, addresses, saved cards, preferences and support history are deleted;
• your saved card tokens are removed from our payment processor;
• any active meal plan is cancelled as described in our Terms of Service;
• order, payment and invoice records are kept only for the period UAE tax law requires (see section 8), and then deleted or anonymised; and
• your ratings and reviews are removed or shown without your name.

Any balance left in your Dieto wallet when you delete your account is dealt with as our Terms of Service describe. [Legal review: settle the treatment of a remaining wallet balance.]

11. How we protect your data

We use technical and organisational measures designed to protect your data, including:

• encrypting data in transit between the app and our servers;
• never storing full card numbers — card data stays with our payment processor;
• storing sign-in codes and partner passwords only in hashed form;
• restricting staff access to personal data to those who need it for their job; and
• keeping health data separate from marketing systems.

No system is completely secure. If a breach of your personal data is likely to put you at risk, we'll tell you, and we'll tell the UAE Data Office as UAE law requires.

12. Children

Dieto is for adults. You must be at least [18] years old — the age of majority under UAE law — to create an account. Someone younger may only use Dieto under the supervision of a parent or guardian, who creates the account and accepts our Terms of Service and this policy on their behalf. [Legal review: confirm the minimum age and the approach for minors, given that the service processes health data.]

We don't knowingly collect data from children without a parent's or guardian's consent. If you believe a child has given us their data, contact us and we'll delete it.

13. Cookies, tracking and advertising

• The app contains no advertising or third-party tracking tools. It does not track you across other companies' apps or websites, and it does not use your device's advertising identifier.
• The website sets no cookies, uses no analytics, and loads no third-party scripts.

If we ever change this — for example, by adding analytics — we'll update this policy first, and ask for your permission where the law or Apple's rules require it.

14. Marketing messages

We send offers and new-kitchen announcements only if you tick the box asking for them, and every marketing message tells you how to stop them. [Legal review: if offers will be sent by SMS or WhatsApp, confirm the requirements of the UAE telemarketing rules (Cabinet Decisions No. 56 and 57 of 2024).] You can change your mind at any time in Account → Notifications, or by using the unsubscribe option in any marketing message. Turning off marketing doesn't stop messages about your orders, plans and account.

15. Changes to this policy

We may update this policy as Dieto changes or the law does. The version and date at the top show when it last changed. If a change is significant, we'll tell you in the app or by email before it takes effect, and where the change needs your consent, we'll ask for it.

16. Contact us

• Email: [privacy@ contact]
• Post: [Dieto legal entity name], [registered address]
• In the app: Account → Help & support