Privacy policy
1. Who is responsible for your data
1.1. The website umamo.app, the application app.umamo.app and the restaurant menus on subdomains (the "Service") are operated by 2 Code Solutions Ltd., UIC 207500451 ("UMAMO", "we"). For privacy matters: office@umamo.app.
1.2. This Policy forms part of the Terms of Use (umamo.app/terms). The terms "Restaurant", "Restaurant User", "Guest", "Visitor", "Restaurant Content" and "Guest Data" have the same meaning as in the Terms.
1.3. Two roles.
- For the data of Restaurants and Restaurant Users (account, contact details, logins, subscription) and of Visitors to the UMAMO Site, UMAMO is the database controller (בעל השליטה במאגר; controller).
- For Guest Data (orders, reviews and notification subscriptions in a particular restaurant's menu), the database controller is that Restaurant, and UMAMO is the holder (מחזיק; processor) and processes such data solely on the Restaurant's instructions (Terms, section 10). A Guest with questions about their orders and reviews will find it most convenient to contact the restaurant; we will help if you write to us.
2. What data we collect and why
| Whose data | What we collect | Purpose | Legal basis |
|---|---|---|---|
| Restaurant User | name, e-mail, phone number, password (stored only as a secure hash) or Google sign-in, language, role in the establishment | to create an account, sign in, and communicate regarding the Service | contract (Terms) |
| Restaurant | name, address, phone number, opening hours, kashrut, logo, menu, photos, menu files for import | to display the menu to Guests and to generate translations and descriptions | contract |
| Restaurant | selected Plan, payment dates, subscription status, Paddle identifiers | to manage the subscription and access | contract, legal obligations (record-keeping) |
| Guest (on behalf of the Restaurant) | name, phone number, delivery address, order text | to forward the order to the Restaurant | the Restaurant's instructions |
| Guest | rating and review text, name (if provided) | to show the review to the Restaurant and in the menu | the Restaurant's instructions |
| Guest | push notification subscription (the browser's technical subscription address) | to deliver notifications the Guest has subscribed to themselves | the Guest's consent |
| Visitor and Guest | language, theme, cart, technical logs (IP address, browser, time, errors) | operation and security of the Service | legitimate interest, Data Security Regulations |
| Menu visitor | anonymized view statistics (how many times the menu was opened, which dishes) | statistics for the Restaurant | legitimate interest; without identifying any individual |
2.1. We do not receive card data. The card number and payment details are entered in the Paddle window and are processed by Paddle as an independent controller under its own policy (paddle.com/legal/privacy). From Paddle we receive only the payment status, the amount, the country and the payer's e-mail address.
2.2. You are not legally required to provide data; however, a Restaurant cannot be registered without account data, and the Restaurant cannot accept an order without a name and phone number.
2.3. We do not sell personal data, do not use Guest Data for our own purposes, and do not send Guests our own advertising.
3. Artificial intelligence
3.1. For translations, dish descriptions and menu recognition from files, we transfer to AI and translation providers only Restaurant Content (menu texts, files and photos). Guest Data is not transferred to them.
3.2. Our AI providers are contractually bound not to train models on the data transferred to them.
4. Who we share data with
4.1. We share data only with providers without whom the Service cannot operate, only to the extent needed for their task, and only under contracts that require them to keep the data confidential and to protect it at least to the standard required by law. Categories of recipients:
| Recipients | Purpose |
|---|---|
| Hosting and cloud infrastructure | storage of the database and files, operation of the Site, the application and menus, secure connection and attack protection |
| Payment partner — Paddle | subscription payments, invoices, taxes and refunds (clause 4.2) |
| AI and machine translation providers | menu translations and dish descriptions, menu recognition from files — Restaurant Content only (section 3) |
| E-mail and notification delivery services | Service e-mails, push notifications, order notifications to a messenger if the Restaurant has connected one itself |
| Development and technical support contractors | development and maintenance of the Service on our instructions, under a confidentiality obligation |
4.2. Payments through Paddle. Our order process is conducted by our online reseller Paddle (Paddle.com Market Limited), which is the Merchant of Record for all our orders. Paddle accepts the payment, issues the invoice, is responsible for taxes and refunds, and processes payment data as an independent controller under its own policy (paddle.com/legal/privacy). What we receive from Paddle is described in clause 2.1.
4.3. We provide the current list of providers, with the countries of processing, to a Restaurant on request to office@umamo.app. We notify Restaurants in advance of any change of a provider that processes Guest Data (Terms, clause 10.5).
4.4. In addition, we disclose data where required by law, a court or a competent authority, or to protect our rights in a dispute — to the minimum extent necessary.
4.5. In the event of a sale or reorganization of the business, data may pass to a successor, provided the same level of protection is maintained; we will notify Restaurants of this in advance.
5. Transfer of data abroad
5.1. Some providers process data outside Israel — in EU countries, the United Kingdom and the United States. We transfer data only to countries that ensure a level of protection no lower than that of Israel, or on the basis of contractual undertakings by the recipient, as required by the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001. For transfers from the EU, we rely on the European Commission's adequacy decisions (including in respect of Israel) or the EU Standard Contractual Clauses.
6. How long we keep data
| Data | Retention period |
|---|---|
| Account and Restaurant Content | while the account is active, then 90 days, then up to a further 90 days in backups (Terms, clause 16.4) |
| Account not paid for after the trial period | 90 days after the end of the trial period, then up to a further 90 days in backups |
| Guest Data | for as long as the Restaurant needs it and the account is active; deleted on the Restaurant's instructions or together with the account |
| Guest reviews | until the Restaurant deletes them or while the Restaurant's account is active |
| Push subscription | until the Guest unsubscribes or the menu is deleted |
| Payment data and invoices | for the periods required by tax and accounting legislation |
| Technical logs | up to 90 days |
| Anonymized statistics | without time limit |
7. How we protect data
7.1. We apply measures under the Protection of Privacy Regulations (Data Security), 5777-2017: encryption in transit (HTTPS) and at rest, role-based access control, access logs, automatic logout from the dashboard after inactivity, regular security reviews, and a confidentiality obligation for everyone who has access.
7.2. We report a serious security incident to the Privacy Protection Authority and to the affected Restaurants as required by law, and if the incident affects Guest Data, we help the Restaurant notify the Guests.
8. Your rights
8.1. Under sections 13–14 and 17F of the Protection of Privacy Law, you have the right to access your data and to request that inaccurate data be corrected and that excessive or unlawfully held data be deleted. You also have the right to withdraw consent (for example, to unsubscribe from push notifications) and to object to the use of data for direct marketing.
8.2. If the GDPR applies to you, you also have the right to data portability, the right to restriction of processing, and the right to lodge a complaint with the supervisory authority of the EU country where you live.
8.3. How to contact us:
- A Restaurant and its Users — in the dashboard or by e-mail to office@umamo.app;
- A Guest — the restaurant, using the contact details in the menu, or by e-mail to office@umamo.app stating the restaurant's name and the phone number given with the order. We will forward the request to the restaurant and help fulfil it;
- you can unsubscribe from push notifications in your phone or browser settings.
8.4. We respond within 30 days. If you are not satisfied with our response, you may contact the Privacy Protection Authority, Israeli Ministry of Justice (gov.il/he/departments/the_privacy_protection_authority) or apply to a court.
9. Cookies and local storage
9.1. The Site and menus use only strictly necessary cookies and browser local storage: account sign-in, language, theme, the Guest's cart, and accessibility settings. The Service does not work without them, so consent to them is not requested.
9.2. There are no advertising cookies or third-party trackers. Site speed analytics and menu view statistics do not use advertising identifiers and do not make it possible to identify an individual.
9.3. You can delete cookies and site data in your browser settings.
10. Children
Only persons over the age of 18 may register a Restaurant. We do not knowingly collect children's data; anyone may open a menu, but orders are placed through the Restaurant.
11. Changes to this Policy
We may update this Policy. We notify Restaurants of material changes by e-mail and in the dashboard at least 14 days in advance; the new version is published on the Site with its effective date.
12. Contact
2 Code Solutions Ltd., UIC 207500451
E-mail for privacy matters: office@umamo.app
Last updated: 10.10.2026