1 Introduction
Welcome to iMenu ("we", "us", "our"). iMenu is a food delivery mobile application operated by KGC Technologies. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Android mobile application (the "App") and related services (collectively, the "Services").
By downloading, installing, or using the App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the App.
This policy complies with: Google Play Developer Program Policies, General Data Protection Regulation (GDPR), Pakistan's Personal Data Protection Bill, and applicable international data protection laws as of 2026.
2 Information We Collect
2.1 Information You Provide Directly
When you create an account, place orders, or interact with our Services, we may collect the following information:
| Data Category | Examples | Purpose |
|---|---|---|
| Account Information | Full name, email address, phone number, profile photo | Account creation, identity verification, communication |
| Authentication Credentials | Password (encrypted), Google/Facebook authentication tokens | Secure sign-in and account access |
| Delivery Address | Street address, city, geographic coordinates (latitude/longitude) | Order delivery and distance calculation |
| Order Information | Selected items, quantities, prices, special instructions, delivery instructions | Order processing and fulfillment |
| Payment Information | Selected payment method (Cash, JazzCash, Easypaisa), payment evidence screenshots | Payment verification and processing |
| Communications | Chat messages between you and delivery riders | Order coordination and dispute resolution |
2.2 Information Collected Automatically
When you use the App, certain information is collected automatically:
- Device Information: Android device identifier (Android ID), device model, operating system version
- Push Notification Tokens: Firebase Cloud Messaging (FCM) token for delivering notifications
- Location Data: Precise location when you use the location picker to set a delivery address (only when you grant permission)
- Usage Data: App interactions, pages viewed, features used, and crash reports
- Network Information: Wi-Fi connection state and network availability status
2.3 Information from Third-Party Services
If you choose to sign in using third-party authentication providers, we may receive:
- Google Sign-In: Name, email address, and profile photo from your Google account
- Facebook Login: Name, email address, and profile photo from your Facebook account
We do not receive or store your Google or Facebook passwords. Authentication is handled securely through Firebase Authentication and the respective platform's OAuth protocols.
3 How We Use Your Information
We use the information we collect for the following purposes:
- Service Delivery: To process your food orders, assign delivery riders, and facilitate order delivery to your designated address
- Account Management: To create and manage your user account, authenticate your identity, and maintain session security across devices
- Payment Processing: To verify payment evidence for mobile wallet payments (JazzCash, Easypaisa) and manage your in-app wallet balance
- Communication: To send order status updates, payment confirmations, delivery notifications via push notifications, and enable real-time chat with delivery riders
- Location Services: To display nearby restaurants, calculate delivery distances, and show your delivery location on maps
- Customer Support: To resolve disputes, handle complaints, and improve our customer service
- App Improvement: To analyze usage patterns, diagnose technical issues, and improve App performance and user experience
- Safety and Security: To detect and prevent fraud, unauthorized access, and other illegal activities
4 Data Sharing and Disclosure
We do not sell your personal information to third parties. We may share your information only in the following circumstances:
4.1 Service Partners
- Restaurants: Your order details and delivery address are shared with the restaurant fulfilling your order
- Delivery Riders: Your name, phone number, delivery address, and order details are shared with the assigned rider for order delivery
4.2 Third-Party Service Providers
We use the following third-party services that may process your data in accordance with their own privacy policies:
| Service Provider | Purpose | Data Shared |
|---|---|---|
| Google Firebase | Authentication, push notifications, real-time chat | Email, authentication tokens, FCM tokens, chat messages |
| Facebook SDK | Social login authentication | Authentication tokens (only when Facebook login is used) |
| OpenStreetMap / Nominatim | Map display and location search | Search queries, geographic coordinates (anonymized) |
4.3 Legal Requirements
We may disclose your information if required to do so by law, in response to valid requests by public authorities (e.g., a court order or government agency), or to protect our rights, privacy, safety, or property.
5 Data Storage and Security
We implement industry-standard security measures to protect your personal information:
- Encryption in Transit: All data transmitted between the App and our servers is encrypted using TLS/SSL (HTTPS)
- Secure Authentication: Passwords are hashed using industry-standard algorithms before storage; we never store plain-text passwords
- Token-Based Sessions: We use JWT (JSON Web Tokens) with refresh token rotation for secure session management
- Secure Storage: Sensitive data on your device is stored in Android SharedPreferences in private mode, accessible only to the App
- Server Security: Our backend servers use PostgreSQL with parameterized queries to prevent SQL injection, and are hosted in secure environments
While we take reasonable precautions, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.
6 Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy:
- Account Data: Retained for the duration of your account. When you delete your account, your personal data is deleted or anonymized within 30 days
- Order Data: Order history is retained for up to 24 months for customer support and legal compliance
- Payment Evidence: Payment screenshots are retained for 12 months for verification and dispute resolution purposes
- Chat Messages: In-app chat messages are retained for the duration of the associated order plus 6 months
- Device Tokens: FCM tokens are updated automatically and old tokens are replaced upon each login
7 Your Rights and Choices
You have the following rights regarding your personal data:
7.1 Access and Portability
You can request a copy of the personal data we hold about you by contacting us at the email address provided below.
7.2 Correction
You can update your name, email, phone number, and profile photo through the App's profile settings at any time.
7.3 Deletion
You can request the deletion of your account and associated personal data by contacting us. Upon request, we will delete your data within 30 days, subject to any legal retention requirements.
7.4 Opt-Out of Notifications
You can disable push notifications through your device's system notification settings at any time. Please note that disabling notifications may affect your ability to receive order status updates.
7.5 Location Permissions
You can revoke location permissions at any time through your device settings. The App requests location access only when you use the location/address picker feature. The App does not track your location in the background.
7.6 Withdraw Consent
Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
8 App Permissions
The App requests the following Android permissions:
| Permission | Reason |
|---|---|
| INTERNET | Required to communicate with our servers, load restaurant menus, place orders, and process payments |
| ACCESS_NETWORK_STATE / ACCESS_WIFI_STATE | To detect network availability and display offline status when no internet connection is available |
| ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION | To allow you to set your delivery address using the map-based location picker. This is requested at runtime and can be denied or revoked |
| POST_NOTIFICATIONS | To deliver real-time order status updates, payment verifications, and chat messages via push notifications |
No background location: The App does not access your location in the background. Location is accessed only when you actively use the location picker feature within the App.
9 Children's Privacy
The App is not intended for use by children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal data from a child under the age of 13, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us immediately.
10 International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence, including countries where our third-party service providers (such as Google Firebase and OpenStreetMap) operate their servers. These countries may have data protection laws that differ from those in your jurisdiction. By using the App, you consent to such transfers. We ensure that any international data transfers are conducted with appropriate safeguards in place.
11 Third-Party Links and Services
The App may contain links to third-party websites, services, or applications that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party services. We strongly advise you to review the privacy policy of every site or service you visit or use.
12 Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Effective Date" at the top of this page
- Post the updated Privacy Policy on this page
- Notify you via the App or by other appropriate means for significant changes
We encourage you to review this Privacy Policy periodically for any changes. Your continued use of the App after changes are posted constitutes your acceptance of the updated Privacy Policy.
13 Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us:
Email: info.hippo@hippo.school
Website: https://hippo.school/
We will respond to your inquiries within 30 days of receipt.
14 Consent
By using the iMenu App, you hereby consent to this Privacy Policy and agree to its terms. Your use of the App following the posting of changes to this Privacy Policy will be deemed as your acceptance of those changes.