Malakand Food
اردو

Privacy policy

Version 1.0, in effect from 6 October 2026.

This policy explains what personal information Malakand Food, a service of malakand.pk ("we", "us"), collects when you use our food delivery service in Malakand Division:

  • the Malakand Food app for customers;
  • the rider app and the restaurant app;
  • the restaurant portal;
  • our website, food.malakand.pk.

It also explains how we use and protect that information, and the choices you have.

What we collect

Everyone who signs in

  • Your mobile number, used to sign in with a one-time code sent by SMS, and your name.
  • Your preferred language (Urdu or English).
  • The device you use: a device identifier and a notification token, so we can send you notifications.

Customers

  • Your delivery addresses, including the map pin and any directions you write.
  • Your current location, only when you tap "use my current location" to set an address. We do not track customers.
  • Your orders: what you ordered, from whom, the amounts, and the delivery and payment status.
  • Ratings, comments and reports you send, including any photos you attach to a report.

Riders

  • Profile: your national identity card (CNIC) number, date of birth, address, emergency contact, vehicle and number plate.
  • Documents and photos: your photo and photos of your identity card, driving licence and vehicle registration.
  • Payout details: your JazzCash, Easypaisa or bank account details.
  • Location while you are online: your precise location, about every 5 seconds during a delivery and every 30 seconds otherwise. We use it to offer you deliveries nearby and to show customers and restaurants where their order is. It is collected only while you are online, with a notification on your phone, and stops when you go offline.
  • Work and payments: your deliveries, earnings, cash collected and deposits.
  • Delivery photos: photos you take as proof of delivery.

Restaurants

  • The owner: name, identity card number, phone and email.
  • Staff: names and phone numbers of the staff you add.
  • Business details: your business and bank details, and your restaurant's address, opening hours, menu and photos.

People who ask to join on our website

  • The details you write in the "Partner with us" or "Ride with us" form: your name, mobile number, town, restaurant name, whether you have a motorbike and an Android phone, and your message.

Automatically

  • Technical logs: the address your request came from, the time and the app version. We use them to keep the service secure.
  • Crash reports from the apps and our servers, without your name or phone number.
  • On our website, one cookie that keeps your session and protects forms against misuse. We use no advertising or tracking cookies.

How we use it

  • To run the service: sign you in, take and deliver orders, show an order's progress, and handle payments, cash and settlements.
  • To keep the service safe: prevent fraud, settle complaints and disputes, and keep the records the law requires.
  • To send messages about your account: order updates, sign-in codes and important changes. We do not send advertising by SMS.
  • To answer people who ask to join: our team calls you back about joining as a restaurant or rider.
  • To improve the service: we use reports built from combined data.

We do not sell your personal information, and the apps show no advertising.

Who we share it with

  • The restaurant you order from sees your first name, your order and your note.
  • The rider who delivers it sees your name, phone number and delivery address, until the order is finished.
  • Customers and restaurants see a rider's first name, phone number and position during their delivery.
  • Service providers who work for us, under contract and only for the service:
    • hosting and storage, including backups;
    • the SMS gateway that sends sign-in codes;
    • Google Firebase, for notifications;
    • Google Maps, for maps in the customer app;
    • Cloudflare, for our domain names and network security;
    • Sentry, for crash reports.
  • Authorities, when the law requires it.

How long we keep it

  • Rider location history: 90 days.
  • Sign-in codes: 7 days.
  • Notification records: 90 days.
  • Requests to join from the website: one year after our team has closed them.
  • Security and audit records: 2 years.
  • Orders, payments and settlements: as long as tax and accounting law requires.

When you delete your customer account, we remove your name, phone number and addresses. Past orders are kept without your name, for the restaurants' accounts and the records the law requires.

How we protect it

  • Information travels encrypted (HTTPS).
  • Identity card numbers and payout details are encrypted in our database.
  • Documents are stored privately and shown only to authorised staff.
  • Staff access is limited by role and protected by two-step sign-in.
  • Every change our staff make is recorded.

Your choices

  • You can see and correct your profile in the app.
  • Customers can delete their account in the app: Profile, then Delete account.
  • Riders and restaurants can ask us to close their account. We keep only what the law requires.
  • People who asked to join can ask us to delete their request at any time.
  • You can turn notifications and location off in your phone's settings. Riders cannot go online without location.

Children

The service is not meant for anyone under 18.

Changes

When we change this policy, we publish the new version on this page and ask you to accept it in the app.

Contact

Malakand Food (malakand.pk), Malakand Division, Khyber Pakhtunkhwa, Pakistan.

For any question about your information, or to use one of the choices above, contact us on WhatsApp or by phone. The numbers are on our help page, food.malakand.pk/help, and under Help in the apps.