Privacy Policy

Kayana For Business Ltd is a company registered in England and Wales. We are the data controller for personal data processed through the AskKay platform. Our registered address and ICO registration details are available on request at privacy@kayanaworld.com.

From guests (end users ordering via WhatsApp)

• WhatsApp phone number (provided automatically when you message us)
• Order content — items selected, quantities, modifiers
• Payment status (Stripe handles card data — we never store card numbers)
• Table number or location identifier (from the venue's QR code)
• Conversation history with AskKay's menu assistant
• Timestamps and session identifiers

From venue operators (business customers)

• Business contact details — name, email, phone
• Venue information — trading name, address, menu data
• Stripe Connect account information (processed by Stripe)
• Order history and reporting data
• WhatsApp Business API credentials

From visitors who download a QR code with our free generator

• Your email address (we don't verify it and there is no account)
• Your business name and WhatsApp number, as entered in the generator
• The design and file format you downloaded, and whether you asked for marketing updates
• Your device's time zone, to work out your daily download limit
• A one-way keyed code made from your IP address (not the address itself), to limit downloads per connection

The QR code and print designs are made in your browser. Your logo and pre-filled message are not uploaded to us.

• Guests: to process orders, take payment, send confirmations and (with consent) allow reordering via WhatsApp.
• Venue operators: to provide the AskKay service, generate reports, send product updates and comply with legal obligations.
• QR generator visitors: to apply the free download limits, prevent abuse, record the download in our customer records and let our team contact your business about WhatsApp ordering. Marketing updates only if you tick the box.
• All: to improve our service, detect abuse and comply with law.

We do not sell personal data to third parties. We do not use guest data for advertising without explicit consent.

• Contract performance — processing orders and providing the platform to operators.
• Legitimate interests — improving service quality, fraud detection and security, applying QR generator download limits and following up a download with the business that made it.
• Legal obligation — retaining transaction records as required by tax law.
• Consent — marketing communications (you may withdraw at any time).

We share data only where necessary:

• Stripe — payment processing (Stripe's privacy policy applies to card data)
• Meta (WhatsApp Business API) — message delivery (Meta's privacy policy applies)
• AWS — cloud hosting in eu-west-2 (UK/Europe) and regional data centres
• Your venue operator — the restaurant, café or event you ordered from receives your order details
• Law enforcement — where required by applicable law

We retain order data for 7 years to comply with HMRC requirements. Conversation history is retained for 12 months then anonymised. You may request deletion of your personal data at any time (subject to legal retention requirements) by emailing privacy@kayanaworld.com.

For QR code downloads, the code made from your IP address is deleted after 7 days and each download record after 12 months. Your contact details stay in our customer records until you ask us to delete them.

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

To exercise any right, email privacy@kayanaworld.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO (ico.org.uk) or your national supervisory authority.

AskKay operates in the UK, EU, Australia, Canada, UAE and USA. Data may be transferred to and processed in countries outside the UK/EEA. Where we do this, we use Standard Contractual Clauses or other approved safeguards.

We use industry-standard security including TLS encryption in transit, encryption at rest on Aurora PostgreSQL, access controls and regular security audits. Payment card data is never stored on our systems — Stripe is PCI-DSS compliant.

Our website uses essential cookies only (session management). We do not use advertising or tracking cookies without consent. You can control cookies in your browser settings.

We may update this policy as our service evolves. Material changes will be communicated by email to venue operators and by a notice on this page. The "last updated" date at the top indicates when it was last revised.

For privacy queries, data requests or complaints: