Privacy Policy — Call Up
Last updated: 2026-09-30
Call Up is a digital pager that replaces the buzzer in a café. A customer scans a code at their table, and a web page or App Clip tracks their order and alerts them when it is ready.
This page describes what is actually collected and what is not. Every sentence corresponds to behaviour in the code; none of it describes future intentions.
What we collect from customers
Customers create no account and never sign in. Possession of the order link is the only authorisation, and that link grants no access to the staff console.
| Data | Why | How long |
|---|---|---|
| Mobile number | So the cashier can identify whose order it is at the counter. It is always shown to staff masked (05••••67) and never leaves the server in full. | 30 days after the order ends, then erased automatically |
| Device platform | iOS, Android or other — read from the browser to choose the right notification channel, and shown to staff so they can see why an alert may not have arrived. | Kept with the order record (not personal data) |
| Notification token | An address issued by the operating system or browser to deliver one notification: that the order is ready. It is used for nothing else. | 30 days, or as soon as a send discovers the device is no longer registered |
| Browser user agent | Stored truncated alongside the notification subscription, to diagnose delivery failures. | 30 days |
| Order timestamps | Created, ready and collected times — branch reporting is built on these. | Retained with no personal data attached |
What we do not collect
No location. No contacts. No photos. No microphone or camera. No advertising identifiers. No analytics package and no third-party tracker of any kind on the customer page.
We do not track customers across other apps or websites, do not build an advertising profile, and do not sell data to anyone.
The App Clip
The App Clip follows exactly the rules above. It creates no account, asks for no sign-in, and does not read location.
The order token comes from the invocation URL alone and is not persisted on the device after the order ends: possession of the token is the authorisation, so storing it would let a later user of the same phone read someone else’s order.
Notifications
One alert is sent when the order is ready, plus any resend a staff member triggers within a limit the branch configures.
“Sent” does not mean “heard”. Silent mode, Focus, a locked phone and a muted tab all swallow it, and no screen in the product claims otherwise.
We send no marketing messages. The permission a customer grants is used only to alert them about their order, and can be withdrawn in device settings at any time.
Staff data
Console accounts hold a name, an email address and a password hashed with scrypt using a per-account salt. The password itself is never stored and cannot be recovered.
An audit log records role and settings changes: who changed what, and when. It cannot be edited or deleted by any role, including the owner.
Any staff member can delete their own account from inside the console without contacting anyone. Deletion removes the name, email address and password irreversibly; the orders they handled remain, attributed to nobody, because branch reporting is built on them.
An owner can additionally erase the entire organisation — branches, orders, subscriptions, audit logs and every account — after typing the organisation’s name to confirm. This is permanent and there is no backup to restore from.
Where data is stored and who can reach it
Data is held in a managed Postgres database reachable only by the server. Branch staff see only their own branch’s orders, and that boundary is enforced in the database rather than in the interface.
We share data with no third party for their own purposes. Infrastructure providers — hosting, and Apple’s and Google’s push services — process only what is needed to run the service, and notification content is encrypted in transit to the customer’s browser.
Your rights
You may ask what we hold about you, have it corrected, have it deleted, and withdraw your consent. Write to the address below and we will respond within thirty days.
Your mobile number is deleted automatically 30 days after the order ends, without you asking. If you want it removed sooner, tell us the order number.
These rights are granted by the Personal Data Protection Law of the Kingdom of Saudi Arabia.
Children
The service is for café customers, is not directed at children under 13, and we do not knowingly collect their data.
Changes to this policy
When what we collect or how long we keep it changes, this page and its date are updated. Material changes are announced on the order page itself.
Contact
For questions or a deletion request: privacy@callup.run
Call Up — Kingdom of Saudi Arabia.