Privacy Policy

Pane is a restaurant business operating in Cairo, Egypt. This policy explains how we handle personal information when you order from our website, when you order at one of our counters, and when you contact us about an order.

It applies to the ordering platform we run ourselves. It does not cover other companies’ services — if you order our food through a delivery marketplace, that marketplace collects your details under its own policy, and we receive from it only what it chooses to pass on.

Website

https://paneclub.com

Most food sites ask you to invent a password, remember it, and trust them to store it well. We decided not to hold that risk on your behalf.

Instead, your identity is your mobile number. When you first order, we send a one-time code to that number and you type it back to us. That proves the number is yours. There is no sign-up form, no password, no security questions, and no password-reset email that an attacker can hijack.

• The one-time code is stored only as a cryptographic hash, never as the code itself, and it is deleted the moment it is used or expires — a matter of minutes.
• A wrong code can only be guessed a small number of times before the code is destroyed and you have to request a new one.
• We limit how many codes can be sent to one number in an hour, so nobody can use us to bombard someone else’s phone.
• Once your device is verified we leave a small token on it so you are recognised next time and do not have to repeat the code. You can clear it at any time by signing out, or by clearing your browser data.

We collect what an order needs, and little else.

Your name

So the rider and the counter know who the order belongs to. Whatever you type is fine; it is a label, not proof of identity.

Your mobile number

Required. It identifies you, it is how we send your one-time code, and it is how the branch and the rider reach you about the order.

Your email address

Optional. If you give one we can use it to reach you about an order, and it is one of the addresses a one-time code can be sent to. Leaving it blank changes nothing about your order.

Your delivery address

For delivery orders only. That includes the address line, apartment, floor and any directions for the rider. If you choose to drop a pin, we also store the map coordinates that pin represents — sharing your location is always your choice, and you can type an address instead.

Your order history

What you ordered, when, from which branch, what it cost, how it was paid for and how it was fulfilled. This is what lets you reorder in one tap, and it is also the accounting record we are required to keep.

Payment outcome

Whether an order was paid in cash or online, the amount, and the reference our payment provider returns. We never receive the full card number.

Technical information

The usual server records a website cannot operate without: the pages requested, the time, the general type of device and browser, and error diagnostics. We use these to keep the site working and to detect abuse.

We do not ask for, and do not want, your national ID, your date of birth, your workplace, your family details, or anything about your health, religion, politics or opinions. If you type something like that into a delivery note, please do not — a note is read by a rider and a kitchen.

• To take, prepare, pack and deliver the order you asked for, and to hand it to the right person.
• To contact you about that specific order — to accept it, to ask about a sold-out item, to say it will be late, or because a rider cannot find the building.
• To take payment for it, and to refund it if something goes wrong.
• To decide what an order has to satisfy before the kitchen starts. A large order from a number we have never seen is checked more carefully than a small one from a regular; that judgement uses how many orders the number has placed before, and nothing else about you.
• To keep the accounting and tax records that a business in Egypt is required by law to keep.
• To answer a complaint, and to have the facts in front of us when we do.
• To detect and prevent fraud and abuse — repeated fake orders, stolen cards, attempts to use someone else’s phone number.
• To understand which dishes sell and how long orders take, so the kitchen improves. This is done from order records, not from tracking you around the internet.

We rely on your instruction to us when you place an order, on our need to run a lawful business and keep proper records, and on your consent where you have given it — for example, when you choose to share your location. Where we rely on consent, you can withdraw it at any time without affecting an order already placed.

We handle personal information in line with Egyptian law on the protection of personal data, and with the consumer protection expectations that apply to businesses selling to the public in Egypt. We are an Egyptian business serving customers in Egypt, so we do not claim to be governed by foreign data protection regimes — what we describe on this page is what we actually do.

We send you very little, and we would rather say exactly what than imply more.

Your one-time code

The only message the platform sends automatically. It goes to the number or address you are signing in with, and it is part of ordering — there is nothing to turn off, because without it we cannot tell that the number is yours.

A phone call about your order

How we tell you anything that needs telling: that an item has sold out, that we cannot deliver to your address, that the order will be late. A person calls. We do not send automatic status updates, so your order page is where you watch an order progress.

Offers and news

We do not run a marketing list today and we do not send promotional messages. If we start, it will be something you ask for rather than something you are opted into, every message will say how to stop, and stopping will be immediate and will not affect your orders.

Orders can be paid in cash at the door, by card on the terminal at a branch, or online. Online payment is built so that your card details never touch our servers.

• Payment details are entered on a secure page operated by a licensed payment service provider, not by us.
• We receive back only the result: approved, declined or expired, the amount, and a transaction reference.
• We cannot see, store, print or repeat your card number, expiry date, PIN or CVV. Neither can any member of our staff.
• Refunds are sent back to the same payment method through the same provider. We cannot redirect a card refund anywhere else, which is deliberate.
• A card payment taken at a branch counter happens on the bank’s terminal. The card is never read by our software.

We do not sell personal information, we do not rent it, and we do not trade it for marketing. It is shared only where an order cannot happen without it.

Our branch staff

The kitchen sees the items and any note about the food. The counter and the till see what is needed to accept, prepare, hand over and settle the order. Staff sign in individually, and what each person can see depends on their role.

Delivery riders

The rider handling your order sees your first name, your phone number, the delivery address and the directions you gave — and only for as long as that delivery is running.

Our payment service provider

Receives the amount, the order reference and the contact details a receipt needs, so it can take or refund a payment. It holds the payment details; we do not.

Our messaging provider

Delivers your one-time code over WhatsApp or email, depending on how we are set up. It sees the destination number or address and the message.

Our accounting and inventory system

Our own back-office system, run by us, holds the sales and stock record behind every order. It is not accessible to any customer, marketplace or other outside party.

Our hosting provider

Runs the servers our platform sits on. Data is stored on servers we control and is not shared with the provider for its own purposes.

Authorities and professional advisers

Where the law requires it — a tax inspection, a lawful request from a competent authority, or a dispute we have to defend. We disclose the minimum the request actually calls for.

Two of those services — the one that delivers your one-time code and the one that processes online payments — are international, so the limited information each needs is handled outside Egypt. Nothing else about you is sent abroad, and we do not move customer records out of the country for any other purpose.

One-time codes

Minutes. Held only as a hash and destroyed on use or expiry.

Device verification tokens

Until they expire, or until you sign out or clear your browser data — whichever is first.

Baskets you never checked out

A basket holds items and an identifier, and nothing about you. It is removed along with the rest of your information when you ask us to remove it.

Order and payment records

Kept for as long as Egyptian tax and accounting law requires a business to retain its books, and no longer for any other purpose. These records cannot be deleted on request while that obligation runs.

Your saved name, addresses and preferences

Kept while you use us, and removed when you ask us to remove them.

Complaint correspondence

Kept while the complaint is open and for a reasonable period afterwards, in case it is reopened.

• Everything between your device and us travels over an encrypted connection.
• We hold no customer passwords, so there is no password database to breach.
• One-time codes are hashed, rate-limited, attempt-limited and single-use.
• Staff sign in individually with their own credentials and see only what their role requires; sensitive actions such as discounts and refunds record who authorised them.
• Access to the systems that hold customer data is restricted to the people who operate them, and every credential is scoped to the least it needs.
• We keep our systems patched and we log and monitor for abuse.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information in a way that puts you at risk, we will tell you and the relevant authority, and we will tell you what we know rather than what sounds best.

The information is yours. You can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong — a misspelt name, an old address;
• delete what we hold, except records we are legally required to keep;
• stop using a location you shared, and remove any saved pin;
• detach a phone number from the devices verified with it;
• explain anything in this policy that is not clear.

Ask from the phone number you order with, or from the email address on your orders, so we can be sure we are talking to you. We respond within 14 days. If we cannot do what you asked — usually because a record has to be kept for tax — we will say so plainly and tell you why.

If you are not satisfied with how we have handled a privacy question, you can raise it with the competent Egyptian authority responsible for the protection of personal data.

We use a small number of strictly necessary items, and nothing else. There are no advertising cookies on this site, no third-party trackers, and no profiling of your browsing.

Basket reference

Kept in your browser’s local storage so your basket survives a refresh. It holds an identifier, not your details.

Device verification token

A secure cookie set after you verify your phone, so you are recognised on your next order without typing another code.

Staff session

A secure cookie used only by our own staff terminal inside the branch. It is never set on a customer’s device.

Installed app files

If you add this site to your home screen, your browser stores a copy of the site’s own files so it opens quickly and shows a proper page when you are offline. It never stores your orders, your basket or anything else that came from our servers about you.

Clearing your browser data removes all of these. The site keeps working; you will simply be asked for a one-time code again on your next order.

Our ordering service is intended for adults. We do not knowingly collect personal information from children. If you believe a child has given us their details, contact us and we will delete them.

When we change how we handle personal information, we update this page and change the effective date at the top. If a change materially affects you — a new category of information, a new recipient — we will make that clear rather than quietly editing a sentence. The version on this page is always the one that applies.