My Food Friend
Privacy policy
Last updated: 1 October 2026 Effective date: 1 October 2026
These documents are published in Bangla, English and Arabic. If the versions differ, the Bangla version prevails. For customers of our branches in Saudi Arabia, the Arabic version prevails.
1 Who is responsible for your data
The controller of your personal data is FoodExl.
This policy follows the personal data protection law of Bangladesh, and is written with international standards in mind — the OECD Privacy Guidelines, the principles of the EU GDPR, and ISO/IEC 27001 and 27701.
2 What we collect
| Type | Information | Required? |
|---|---|---|
| Account | Name, mobile number, email, password (stored encrypted; not even we can read it), branch, preferred language, time you accepted the terms | Yes |
| Profile (optional) | Photo, date of birth, gender, blood group, nationality, education, present and permanent address, social media links | No |
| Sensitive (optional) | National ID (NID) number, religion, marital status — only if you provide them, with separate explicit consent | No |
| Delivery | Delivery address, map location (latitude/longitude), receiver's name and phone, handover OTP/QR check, proof-of-delivery photo | Only for delivery |
| Transactions | Bookings, meals, invoices, wallet credits and debits, refunds, coupons and referrals, credit bill and limit, payment reference numbers (not cards or PINs) | Needed for the service |
| Communications | Chat and support messages, reviews, contact form messages, notification preferences (SMS/email/reminders) | If you provide them |
| Security and device | Login history, IP address, browser/device information, country, failed sign-in attempts, whether 2FA is on, activity audit logs | Automatic |
| Cookies | Login session, security and language preference — see Cookie Use below | Essential ones yes |
While a rider is bringing your meal we collect the rider's location so you can track it. We do not track your (the customer's) phone location in the background.
3 Why we use it, and the legal basis
| Purpose | Legal basis |
|---|---|
| Account creation, sign-in, booking, meal preparation, delivery, invoices, wallet and refunds | Performance of our contract with you |
| Booking confirmations, reminders, delivery and billing messages | Contract (you can turn reminders off) |
| Keeping VAT, accounting and tax records; responding to lawful requests from authorities | Legal obligation |
| Preventing fraud, securing accounts, detecting unusual sign-ins | Legal obligation and service security |
| Sending promotions, offers and news of new features | Your consent (withdrawable at any time) |
| Storing NID, religion or other sensitive information | Your explicit, separate consent |
| Improving the service (e.g. popular meals, reducing waste) | Aggregated data, de-identified as far as possible |
We make no automated decisions about you that have a serious legal effect. One example of an automated rule: when a credit bill passes its limit, new credit bookings are paused — you can ask the branch to review this.
4 Who we share it with
| Recipient | What and why |
|---|---|
| Your branch (canteen) | What is needed to prepare meals, hand them over and bill you. Branch staff see only what their work requires — for example your NID and date of birth are not shown to them. |
| Riders | Only during delivery: the receiver's name, phone and address. |
| Payment providers (bKash, Nagad, etc.) | Amount and reference, to complete the payment. |
| SMS and email providers | Mobile number/email and message text, to deliver messages. |
| Technology providers | Pusher (real-time updates in the app), Google Firebase (mobile push notifications), Google Maps (turning an address into a map location), OpenStreetMap (delivery tracking map), hosting and backup services. |
| Charities (NGOs) | When surplus food is donated, only details of the food — not your personal information. |
| Government authorities | Only when required by law, or on a lawful written request from a court or law enforcement agency. |
We contractually require all providers to use data only on our instructions and securely. We never sell or rent your data, and we do not share it with advertisers.
5 Transfers outside Bangladesh
- Your main data is stored on servers under our control.
- Some technology providers (Pusher, Google) have servers outside Bangladesh. Only the limited data needed for their service (such as notification text or an address) goes to them, under legally required safeguards and contract terms.
- Sensitive data such as NID, or data classified as "restricted" by law, is not sent outside Bangladesh. Where the law requires, at least one up-to-date copy of data is kept within Bangladesh.
6 How long we keep it
| Information | Retention |
|---|---|
| Account and profile | While the account is active; after closure, deleted or de-identified unless the law requires otherwise |
| Invoices, transactions, wallet and VAT records | For the period required by tax and accounting laws (at least 5 years) |
| Activity logs and SMS logs | 180 days |
| Security audit chain | 730 days (2 years) |
| Failed sign-in attempts | 1 day |
| Password reset links | Valid for 1 hour; deleted after expiry |
| Login session | 2 hours of inactivity |
| Proof-of-delivery photos and rider location history | As long as needed to resolve delivery complaints or disputes, then deleted |
| Server backups | Deleted automatically after a fixed period |
7 Keeping your data safe
- All communication with the website and app is encrypted with HTTPS.
- Passwords are stored with strong one-way hashing (bcrypt); payment gateway secrets and 2FA codes are encrypted.
- Two-step verification (2FA), limits on sign-in attempts, and sign-out from all devices when a password changes.
- Role-based access: each staff member sees only the data their job needs; important actions are recorded in audit logs.
- Regular backups and security reviews.
If a data breach happens: we will notify the relevant authority within the period set by law. If it poses a risk of significant harm to you, we will also tell you as soon as possible and explain what to do.
8 Your rights
| Right | What you can do |
|---|---|
| Access and copy | See what data we hold about you and get a copy in a usable format |
| Correction | Fix wrong or outdated data (mostly yourself, from your profile) |
| Erasure | Ask us to delete data when no longer needed or after withdrawing consent (except data the law requires us to keep) |
| Withdraw consent | Withdraw consent for promotions or optional/sensitive data at any time |
| Object and restrict | Object to a specific use, or ask us to pause it |
| Complain | If unhappy with our response, complain to the data protection authority established under the law |
To make a request, use in-app support or the contact page. After verifying your identity we will respond within 30 days. Exercising these rights is normally free of charge.
9 Children's data
- Under the law of Bangladesh, anyone under 18 is a child. Collecting and using a child's data requires the consent of a parent or legal guardian.
- We do not target children with advertising, do not build profiles from their behaviour, and do not collect unnecessary data about them.
- A guardian may at any time view, correct or ask us to delete a child's data. If we learn that a child's account was opened without guardian consent, we will close it.
10 Marketing and messages
Booking, delivery, billing and security messages are part of the service and cannot be turned off. Promotional and offer messages are sent only with your consent; you can turn them off at any time from the notification settings in your profile.
11 Changes to this policy
When this policy is updated, the "Last updated" date above will change. For important changes we will notify you by app notification or email before they take effect, and ask for consent again where needed before using data for a new purpose.
12 Contact
FoodExl
Contact page
13 If you use a branch in Saudi Arabia
If you book at a branch in the Kingdom of Saudi Arabia, your personal data is also protected by Saudi Arabia's Personal Data Protection Law (PDPL) and its regulations, overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA). Where this section differs from the rest of this policy, this section prevails for you.
- Your rights. You have the right to be told how your data is used, to see it, to get a copy, to have it corrected or completed, to have it destroyed when it is no longer needed, and to withdraw your consent. We answer within 30 days; if a request needs unusual effort we may take up to 30 more days and will tell you why.
- Complaints to SDAIA. If you are not satisfied with our answer, you can complain to SDAIA, generally within 90 days of the matter you are complaining about.
- Iqama or National ID number. Giving it is optional. If you give it, we check that it is well formed and use it only to identify you; branch staff do not see it.
- Where your data is kept. Our servers are outside the Kingdom. Your data is sent there only as the PDPL's rules on transfers outside the Kingdom allow, with the safeguards they require, and only what the service needs.
- If something goes wrong. If a data breach could harm you, we tell SDAIA within 72 hours of learning of it, and tell you without undue delay.
- Marketing. We send promotional messages only with your consent, which you can withdraw at any time from the notification settings in your profile.
- Language. For you, if the Arabic version of this policy differs from another version, the Arabic version prevails.
Cookie Use
Cookie Use
1 What cookies are
Cookies are small text files a website stores in your browser — for example to remember that you are signed in or which language you chose. Your browser's "local storage" is used for similar purposes. This policy calls both "cookies".
2 Essential cookies (cannot be turned off)
Without these, sign-in, booking and security do not work.
| Name | Purpose | Duration |
|---|---|---|
Auth_session | Remembers that you are signed in; a secure (HttpOnly) cookie that JavaScript cannot read | 2 hours of inactivity |
csrf_cookie_name | Stops other websites from submitting forms in your name (CSRF protection) | 2 hours |
3 Preference cookies
| Name | Purpose | Duration |
|---|---|---|
foodexl_lang | Your chosen language (Bangla/English/Arabic) | 1 year |
lv_theme (local storage) | Light/dark theme | Until you clear it |
sidebar-left-collapsed, sidebar-left-position (local storage) | Menu open/closed state and scroll position | Until you clear it |
customer_filter_collapsed, user_filter_collapsed (local storage) | Whether list filters are open (staff screens) | Until you clear it |
This information stays on your device and contains no personal information.
4 Third-party services
| Service | Why, and what happens |
|---|---|
| Pusher | To show notifications and updates in real time. When its script loads, Pusher receives your IP address and browser information. |
| OpenStreetMap | To show the map on the delivery tracking page. When map images load, your IP address reaches their servers. |
| Google reCAPTCHA (if enabled in future) | To block bots and automated attacks. If enabled, Google may use its own cookies; this policy will be updated at that time. |
Each service's own privacy policy applies. The mobile app does not use cookies; it keeps a secure token inside the app to keep you signed in.
5 Advertising and analytics cookies
None are used today. If we ever add analytics or advertising cookies to improve the service, we will ask for your consent before turning them on, and you can keep using the service as before even if you say no.
6 Managing cookies
- You can view, delete or block cookies and local storage in your browser settings (Chrome, Firefox, Safari and Edge all allow this).
- If you block essential cookies, sign-in and booking will not work.
- If you delete preference cookies, your language, theme and menu settings return to their defaults.
- Signing out ends your session and deletes the language cookie.
7 Changes and contact
If new cookies are added, this list will be updated. For questions, use the contact page.
Standards followed: the personal data protection law of Bangladesh · Digital Commerce Operation Guidelines, 2021 · the EU ePrivacy Directive and GDPR cookie-consent principles (as a comparative benchmark).