Privacy policy
Last updated: November 9, 2026
Who we are and what this policy covers
Nidaa provides digital customer paging to businesses such as restaurants, cafés and clinics (“venues”). This policy explains how we collect, use, share and protect personal information about the people who use Nidaa: venue owners and staff, and the customers who follow their order or turn on their phone. It applies to the website, the dashboard, the customer page, the screens and the iPhone App Clip.
Person in charge of protecting personal information
Nidaa's president is the person in charge of protecting personal information. They make sure this policy is applied and answer requests about personal information.
Information we collect
Staff accounts: mobile number, name if provided, role, branches, sign-in times and the devices paired by the venue. Customers: the order number and its status, and only if the customer chooses it, a notification address for their browser or iPhone, or a WhatsApp number for the order alert. We never ask customers for their name. Ratings and optional comments are stored with the order. Technical data: IP address, browser type and security logs, used to protect the service. Payments are handled by Stripe; we never receive or store card numbers.
Why we use it
To sign staff in with a one-time code, to ring the customer's phone when the order is ready, to show the venue its reports, to bill the venue, to prevent abuse and fraud, and to keep the service working and secure. We do not sell personal information, we do not use it for advertising, and we do not build profiles of customers.
Consent
Customers choose to scan the code and to allow notifications; WhatsApp alerts need a separate, explicit agreement and are used only for that order. You can withdraw consent at any time by turning off notifications in the browser or phone settings, or by asking the venue or us. Withdrawing consent may mean the phone can no longer be rung.
Venues and their customers
Each venue decides why it uses Nidaa with its own customers. For that information we act on the venue's behalf and under its instructions. A customer can contact the venue directly, or us, about their information.
Service providers and where information is kept
Nidaa's database and servers are in Canada (Toronto and Montreal), and uploaded images are stored in Eastern North America. Some providers we rely on may process information outside Québec and Canada, including in the United States: Twilio (sign-in codes by SMS), Stripe (payments), Apple and Google (push notifications), and Meta (WhatsApp alerts, only when chosen). Before any such transfer we assess that the information receives adequate protection, and providers may use it only to deliver their service to us.
How long we keep it
Sign-in codes are deleted after 7 days, expired sessions after 30 days, and demo orders within two hours. Order history and ratings are kept for the venue's reports for as long as its plan allows and its account is open. When a venue closes its account, its information is deleted or anonymized, except what the law requires us to keep, such as billing records.
Security
Information is encrypted in transit; secrets such as webhook keys are encrypted at rest; access is limited to the people who need it and is logged. We never log phone numbers or message contents. If an incident creates a risk of serious injury, we will notify the people concerned and the authorities as the law requires.
Your rights
You may ask to access your personal information, to correct it, to have it deleted, or to receive it in a structured, commonly used format. You may also withdraw your consent. We answer within 30 days. If you are not satisfied, you may complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.
Cookies and storage on your device
We use only what the service needs: sign-in cookies for staff, and on the customer's phone a key that proves which phone holds the order, plus language and sound preferences. We do not use advertising or tracking cookies.
Changes and contact
If we change this policy we update the date above, and we inform venue owners of important changes before they apply. Questions and requests go to the person in charge of protecting personal information.