Privacy Policy

1. Who we are

YUM is a food discovery, ordering and delivery service operated by YUM Food Technology Co (“YUM”, “we”, “us”). We are the controller of the personal data described in this policy, which applies to the YUM apps, the YUM website and our support channels.

This policy is written to meet the Saudi Personal Data Protection Law and its implementing regulations.

2. What we collect

• Account details: your mobile number (used to sign in with a one-time code), your name, and an optional nickname you choose for social features.
• Delivery details: the addresses you save, their map location, and delivery notes.
• Orders and payments: what you order, prices, fees, invoices, refunds and support cases. Cards are processed by our licensed payment provider; YUM does not receive or store your full card number.
• Activity in the app: videos you watch, like or save, restaurants you visit or save, searches, the taste preferences you pick, and the ratings you give.
• Social features (only if you use them): people you follow, posts you choose to share, comments you write on clips, clips you like or save, people you block, the visibility you set, and the consents you give.
• Device and technical data: device type, operating system, app version, language, IP address, and logs needed to run and secure the service.
• Messages with us: what you send to support and our replies.

If you deliver with YUM through a logistics partner, the courier app also uses your location while you have an active trip, and records pickup and handover confirmations. It does not track you between trips.

3. How we use it

• To create your account, sign you in and keep it secure.
• To take, prepare and deliver your orders, show live order status, and issue tax invoices.
• To take payments and process refunds.
• To personalise your feed and recommendations (see section 4).
• To run social features you turn on, such as following friends and sharing orders.
• To give support and resolve problems with orders.
• To prevent fraud and abuse, moderate content, and protect customers, restaurants and riders.
• To improve YUM, using aggregated or de-identified data where possible.
• To meet legal obligations, including tax, consumer-protection and law-enforcement requests made under Saudi law.

We rely on the legal grounds allowed by the PDPL: your consent (for example for sharing posts), the contract with you (to provide the service), legal obligations, and our legitimate interests in keeping YUM safe and working, which never override your rights.

4. Personalisation

Your feed is ranked using the tastes you pick, what you watch, save and order, the dishes you like, the ratings you give, and, if you choose to follow a friend's taste and they allow it, a summary of the cuisines that friend enjoys. We never show your orders, addresses, spending or dietary choices to friends.

You can change your taste picks at any time in the app. Personalisation does not produce decisions with legal or similarly significant effects on you.

5. Who we share it with

• The restaurant you order from: your order, your first name and what it needs to prepare and hand over the order.
• The logistics partner and rider delivering your order: your name, delivery address, delivery notes and the handover code. Riders do not see your payment details.
• Service providers who work for us under contract and only on our instructions: payment processing, SMS delivery of sign-in codes, cloud hosting, and customer support tools.
• Other users, only for content you choose to share. A shared order shows your nickname or first name, the restaurant, the dishes, your note and rating; it never shows price, address, phone number, order number or exact time.
• Authorities, when Saudi law requires it, or when needed to protect someone's safety.
• A buyer or successor, if YUM's business is transferred, under the same protections.

We do not sell personal data, and we do not share it with advertisers.

6. Where your data is stored

We store data with cloud providers we select for security and reliability, and we prefer hosting in the Kingdom. If any personal data is transferred outside Saudi Arabia, we do so only in the cases and with the safeguards the PDPL allows.

7. How long we keep it

We keep your account data while your account is open. When you delete your account, we delete or anonymise your personal data within 30 days, except records we must keep by law, such as tax invoices and payment records, which we keep only for the legally required period and only for that purpose.

Some data has shorter lives: shared posts disappear when you delete them or withdraw consent, and yearly recap stories are deleted when their retention period ends.

8. Your rights

• To be informed about how your data is used (this policy).
• To access your data and get a copy of it.
• To correct data that is wrong or incomplete.
• To ask us to delete your data, subject to what the law requires us to keep.
• To withdraw consent at any time, for example for sharing, without affecting what was done before.

Many of these are in the app (Me → Sharing & privacy). For anything else, contact us using the details below. We answer within 30 days. If you are not satisfied, you can complain to the Saudi Data & AI Authority (SDAIA).

9. Deleting your account

You can ask us to delete your account and its data at any time. See the Delete your account page for the steps and what happens next.

10. Children

YUM is meant for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

11. Security

We protect data with encryption in transit, access limited to people who need it, logging of sensitive actions, and one-time sign-in codes that are never stored in readable form. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

12. This website

This website does not use advertising or analytics cookies and does not track you. Your hosting provider's servers keep standard access logs (such as IP address and pages requested) for security.

13. Changes to this policy

We will update this policy when our practices change and show the new effective date at the top. If a change is significant, we will tell you in the app before it takes effect.