This explains what TAFU’S collects when you use this website or the TAFU’S app for iPhone and Android, why, who handles it, and how you can see, change or delete it. It covers orders placed on this website and in the app. Orders placed through the foodpanda app are covered by foodpanda’s own privacy policy.
Who we are
The website and app are run by TAFU’S, Trident Padel Arena, G-13, Islamabad, operated by TAFU’S Hospitality Private Limited. We decide how your information is used. Salik Labs builds and runs the website and app for us and handles data only on our instructions.
For anything about your data, email tafu@tafusofficial.com or call +923402408777. We reply within 7 days.
What we collect
- Your order: name, mobile number, email address, delivery address and map pin, the items you order, notes, and whether it is pickup, delivery or scheduled.
- Sign-in: your email address and the one-time code we send to check it. If you verify a phone number, that number too.
- Your account: saved addresses and delivery notes, favourites, allergy and dietary notes, order history and, if you are signed in, rewards: your points balance, lifetime points, tier, points history (which order, how many points, when) and the redemption codes you create.
- What you browse and order: on the website and in the app, which dishes you open, add to your cart and order, when you start checkout, what you search for, and when you visit. It is linked to a random ID kept in your browser or phone and, once you sign in or order, to your account or order.
- Payments: how you chose to pay and whether you have paid. This website never sees or stores card numbers.
- Technical data: your IP address, browser and device type, and the result of our bot check, used to keep the site secure. The app also sends its version number with each request.
- Messages: anything you send us about an order or a complaint.
You can order as a guest without an account. Guest orders still need a name, phone number and email so we can confirm and deliver them.
Why we use it
- To take, prepare, deliver and support your order, because you asked us to.
- To run your account and rewards, if you sign in.
- To keep the site and our customers safe: stopping bots, fraud and repeated fake cash-on-delivery orders.
- To personalise offers: we use what you browse and order, and when, to choose which offers and dishes to show you in the app and on the website. We decide this ourselves; it is not sold or shared with other companies. Offers by push notification are sent only if you switch them on.
- To meet legal duties, such as tax and accounting records.
- To send offers by email or SMS, only if you have opted in.
We do not sell or rent your information, and we never use it to market another brand.
Location
We only use your location when you place a pin on the delivery map or tap “Use my location”. Your browser, or your phone for the app, asks your permission first, and you can say no and type your address instead. The app only asks for location while you are using it, and never tracks your location in the background. The address you type into the map search is sent to Google to find it.
Rewards
Rewards are for signed-in members only. You earn points on a completed order, and we record them against your account once the restaurant system reports the order complete. Guests earn nothing. Your points are kept only with TAFU’S, are not shared with other restaurants, and are not marketing consent. Redeeming points creates a code that you show to the restaurant. Points have no cash value.
Notifications
If you allow notifications, the app tells you when your order is accepted, ready or on its way. To send them, the app gives our server a push token for your phone while you are signed in. The token and your phone type (iPhone or Android) are linked to your account, are used only to send order updates (never marketing), and is deleted when you log out, turn off order updates or delete your account. Guest orders do not get push notifications. You can turn them off in the app’s Account page or in your phone’s settings.
Who handles your information
- Bhookly, our restaurant ordering system, receives your order and account details so the kitchen can prepare it and keep your order history.
- Delivery riders, ours or foodpanda’s, see your name, phone number, address and order, only to deliver it. They may not use it for anything else.
- Google Maps shows the delivery map and finds addresses you search for.
- OpenStreetMap supplies the map on our location page. It receives your IP address when the map loads.
- Cloudflare runs the bot check (Turnstile) that protects checkout and sign-in.
- Resend sends the one-time sign-in codes by email.
- Meta (Facebook and Instagram) measures our ads on the website through the Meta Pixel: which pages you visit, what you view or add to your cart, and that an order was placed with its value. It also receives your IP address and browser details. When we know them (you are signed in, saved your details, or just ordered), we also send your email, mobile number and name, and the city, so Meta can match the visit to a Facebook or Instagram account. Your browser scrambles them (one-way hashing) before they are sent, so Meta receives codes rather than the details themselves, and does not keep them after matching. We never send your address, order notes or allergies. The app does not use the Meta Pixel.
- Amazon Web Services delivers the website to your browser and hosts the server the app talks to.
- Expo, Apple and Google deliver push notifications: Expo’s push service passes our order-update message, with no personal details, to Apple or Google, which deliver it to your phone.
- Apple and Google distribute the app through the App Store and Google Play under their own privacy policies.
- Salik Labs builds and maintains the website, the app and their server.
- Authorities, when the law requires it.
Some of these companies store data outside Pakistan, including in the United States, the European Union and Singapore. We only use providers that protect it to a standard at least as strict as this policy.
How long we keep it
- Order and tax records: 6 years, as accounting law requires. If you delete your account, these records stay but are no longer linked to you.
- Accounts: deleted after 3 years without use. We email you first.
- Rewards data (balance, tier, points history, redemption codes): while your account is open, and deleted when you delete it.
- What you browse and order (for offers): 2 years, then deleted. Deleting your account deletes it, including what your browser or phone did before you signed in.
- Sign-in codes and bot checks: a few days at most.
- Things saved in your browser or the app: until you clear them, log out or uninstall the app.
Your choices and rights
- See or correct your data: update it in your account, or email tafu@tafusofficial.com.
- Delete your account: use “Delete my account” on the Account page of the website or app, or email us. How to delete your account. This removes your saved addresses, favourites, notes, phone verification and rewards. You can sign up again any time with a fresh account.
- Stop marketing: use the unsubscribe link or reply STOP, or email us.
- Guests: email us from the address you ordered with and we will help.
These requests are free. If an automated check blocks an order, for example cash on delivery after repeated no-shows, you can ask a person to review it.
Marketing
We only send offers by email or SMS if you opt in, and placing an order never counts as opting in. Every message tells you how to stop them. We do not message numbers on the PTA Do Not Call register. Sign-in codes, order confirmations and delivery updates are not marketing, and you will still get those.
Cookies and browser storage
- Sign-in cookies (
tafus-web-session, tafus-web-session-state) keep you signed in. They are essential and are deleted when you log out. - Cloudflare security cookies may be set by the bot check. They are essential for security.
- Meta Pixel cookies (such as
_fbp) on the website let Meta tell whether people who saw our ads on Facebook or Instagram later visited or ordered, and show our ads to people likely to be interested. You can block them in your browser’s settings or with a tracker blocker, and control ads on Facebook and Instagram in Meta’s ad preferences; ordering still works. - Browser storage keeps your cart, chosen delivery location, saved details and a few settings on your device.
- In the app, the same things and your sign-in are saved on your phone and removed when you log out or uninstall the app.
Apart from the Meta Pixel on the website, we do not use advertising cookies or analytics trackers. The app has none.
Security
Everything is sent over an encrypted connection, and only people who need your information to run your order can see it. If a breach puts your information at risk, we will tell you and the relevant authorities within 72 hours of finding out.
Children
The website and app are for people aged 18 or over. Anyone younger should order with a parent or guardian.
Other companies’ policies
See the Google Privacy Policy, the OpenStreetMap Foundation privacy policy, the Cloudflare Turnstile privacy addendum and the Meta Privacy Policy.
Changes
If we change this policy, we will update the date at the top. If a change affects how we use information you have already given us, we will tell you on the website or by email first.
