Privacy policy

Who we are

Nouba is run by Clinaude. For anything about your data, write to [email protected].

In short

• Customers collecting an order never give us their name, email or phone number, and never create an account.
• We use data only to tell a customer their order is ready, and to run the accounts of the businesses that use Nouba.
• No advertising, no analytics, no trackers. We don't sell data.

Customers collecting an order

What we process:

• the order number and its status, entered by the business;
• if you add the order to Apple Wallet: an identifier for your device and a notification token that Apple gives us, so we can update the pass;
• if you add it to Google Wallet: the pass, stored with Google;
• if you turn on browser notifications: the delivery address your browser gives us for them;
• your IP address, briefly, to limit abuse (for example too many wrong order numbers). It isn't saved in our database.
• if the restaurant invites reviews: that the invitation was shown and whether you tapped the Google link (not who you are), and any private message you choose to write to the restaurant. In that case your pass or browser notification also shows one reminder about 45 minutes after pickup, then the pass closes.

Why: to send you the alert you asked for. That's the legal basis: providing the service you requested.

How long: device tokens and notification addresses are deleted from our servers 30 days after the order. The pass expires when the order ends; you can remove it from your Wallet, and Google keeps its copy under its own rules. The business keeps the order number and its times for its statistics; they aren't linked to you.

You can remove the pass from your Wallet at any time, or turn notifications off in your browser.

A review you post on Google is between you and Google; we never see it. Private messages are read by the restaurant and deleted after 12 months; review counts after 13 months.

Businesses and their staff

What we process: the owner's email address, the business name, branches, logo and pass colours, the tablets paired to a branch, API keys (stored hashed), and the subscription and invoices. Card details go straight to Stripe; we never see or store them.

Why: to provide the account and the service under our terms. How long: while the account is open. Deleting the account (Account page) deletes the business and its data.

Demo requests

If you ask for a trial or a demo on this website, we receive your name, phone number, business, city and number of locations. We keep them in our team's follow-up list and receive them by email, only to contact you about Nouba. We delete them when they are no longer needed, and within 12 months at most.

Signing in with Google, Microsoft, Facebook or Apple

If you choose one of them, we receive your name, your email address and a technical identifier for your account there. Nothing else: no contacts, no posts, no friends list, and we never post anything. You can disconnect it on your Account page or at the provider. For Facebook you can also remove Nouba under Settings → Apps and websites; Facebook then tells us and we delete the link.

Cookies

Only the ones the service needs: one keeps an owner signed in, one keeps a tablet paired. No advertising or analytics cookies. A third remembers which sign-in method you used last, so it's shown first (one year). This website sets no cookies; it only remembers your language choice in your browser.

Who else handles data for us

• Vultr: our servers, in Amsterdam (Netherlands).
• Cloudflare: network and protection; traffic passes through it.
• Brevo: sends sign-in emails to owners and forwards demo requests to our team.
• Stripe: takes subscription payments and keeps the card details.
• Microsoft, Meta (Facebook) and Apple: only if you choose to sign in with them.
• Apple: delivers Apple Wallet pass updates.
• Google: stores Google Wallet passes; in Chrome, browser notifications go through Google's push service; shows a restaurant's own rating to its owner (Places API, no customer data).
• Mozilla or Apple push services, if you turn on notifications in Firefox or Safari.

Some of them are outside Morocco (in the European Union and the United States). Each only gets what it needs to do its job.

Your rights

You can ask to see, correct or delete your data, or object to its use, by writing to [email protected]. We answer within 30 days. You can also complain to the CNDP in Morocco (cndp.ma) or, in the European Union, to your data protection authority.

Changes

If this policy changes, we update this page and its date. Important changes are announced to businesses by email.