Privacy Policy

Kayana For Business Ltd is a company registered in England and Wales. We are the data controller for personal data processed through the AskKay platform. Our registered address and ICO registration details are available on request at privacy@kayanaworld.com.

From guests (end users ordering via WhatsApp)

• WhatsApp phone number (provided automatically when you message us)
• Order content — items selected, quantities, modifiers
• Payment status (Stripe handles card data — we never store card numbers)
• Table number or location identifier (from the venue's QR code)
• Conversation history with AskKay's menu assistant
• Timestamps and session identifiers

From venue operators (business customers)

• Business contact details — name, email, phone
• Venue information — trading name, address, menu data
• Stripe Connect account information (processed by Stripe)
• Order history and reporting data
• WhatsApp Business API credentials

• Guests: to process orders, take payment, send confirmations and (with consent) allow reordering via WhatsApp.
• Venue operators: to provide the AskKay service, generate reports, send product updates and comply with legal obligations.
• All: to improve our service, detect abuse and comply with law.

We do not sell personal data to third parties. We do not use guest data for advertising without explicit consent.

• Contract performance — processing orders and providing the platform to operators.
• Legitimate interests — improving service quality, fraud detection and security.
• Legal obligation — retaining transaction records as required by tax law.
• Consent — marketing communications (you may withdraw at any time).

We share data only where necessary:

• Stripe — payment processing (Stripe's privacy policy applies to card data)
• Meta (WhatsApp Business API) — message delivery (Meta's privacy policy applies)
• AWS — cloud hosting in eu-west-2 (UK/Europe) and regional data centres
• Your venue operator — the restaurant, café or event you ordered from receives your order details
• Law enforcement — where required by applicable law

We retain order data for 7 years to comply with HMRC requirements. Conversation history is retained for 12 months then anonymised. You may request deletion of your personal data at any time (subject to legal retention requirements) by emailing privacy@kayanaworld.com.

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

To exercise any right, email privacy@kayanaworld.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO (ico.org.uk) or your national supervisory authority.

AskKay operates in the UK, EU, Australia, Canada, UAE and USA. Data may be transferred to and processed in countries outside the UK/EEA. Where we do this, we use Standard Contractual Clauses or other approved safeguards.

We use industry-standard security including TLS encryption in transit, encryption at rest on Aurora PostgreSQL, access controls and regular security audits. Payment card data is never stored on our systems — Stripe is PCI-DSS compliant.

Our website uses essential cookies only (session management). We do not use advertising or tracking cookies without consent. You can control cookies in your browser settings.

We may update this policy as our service evolves. Material changes will be communicated by email to venue operators and by a notice on this page. The "last updated" date at the top indicates when it was last revised.

For privacy queries, data requests or complaints: