Legal

Privacy Policy

Effective 26 August 2026 · Applies to the Cafe Deli - Manso app for Android and iOS

This policy explains what personal information the Cafe Deli - Manso app collects, why we collect it, who we share it with, and the choices you have.

1. Who we are

The Cafe Deli - Manso app is operated by Cafe Delicioso (“we”, “us”, “our”), of KNUST, Ghana. We are the data controller for the personal information described here. Any question about this policy can go to support@cafe-deli.online.

2. Information we collect

We collect only what the app needs to take your order, take payment, and keep you informed about it.

Category	What it includes	Why we need it
Account details	Your name, mobile phone number, and email address if you choose to add one.	Your phone number is how you sign in and how we send one-time codes. Your name identifies your order.
Order information	Items ordered, quantities, order notes, chosen delivery window, delivery address, and order history.	To prepare and deliver your order and show you your history.
Payment information	Amounts, currency, payment status and references, wallet balance and wallet transactions.	To process payments and keep an accurate record. We never see or store your mobile money PIN or card details.
Device & technical data	A randomly generated device identifier, app version, platform, and a push notification token if you allow notifications.	To send order notifications and keep your session secure.

What we do not collect. The app contains no advertising, no analytics or tracking SDKs, and no third-party profiling tools. We do not track you across other apps or websites, we do not sell your personal information, and we do not collect your precise location.

Using the app without an account

You can browse the menu, search it, look at delivery windows and build an order without signing in, and we collect none of the personal information above while you do — no name, no phone number, no order history. The app does send the randomly generated device identifier described above with its requests, but it is not linked to any person unless and until you sign in.

Information stored only on your device

Your saved default delivery address and your text-size preference are kept on your phone, not on our servers, and are removed when you sign out or uninstall the app. An address you submit with an order is sent to us as part of that order.

3. How we use your information

To create and manage your account and sign you in using one-time codes.
To show the menu and available delivery windows.
To take, prepare, deliver and track your orders.
To process payments, wallet top-ups, refunds and cancellations.
To send order, payment and delivery-window notifications.
To respond to your support enquiries.
To keep the service secure, prevent fraud and abuse, and fix problems.
To meet our legal, tax and accounting obligations.

We do not use your information to make decisions about you by automated means that produce legal or similarly significant effects.

4. Our legal basis

We process your personal information under the Data Protection Act, 2012 (Act 843) of Ghana, and where applicable equivalent law, on these bases:

Performance of a contract — to provide the ordering, payment and delivery service you asked for.
Consent — for push notifications, which you may refuse or withdraw at any time.
Legal obligation — to retain financial and tax records.
Legitimate interests — to secure the service and prevent fraud, balanced against your rights.

5. Who we share information with

Only the service providers needed to run the app, and only as far as each one needs:

Provider	Purpose	What they receive
Hubtel (payments, Ghana)	Processing mobile money payments and wallet top-ups.	Payment amount, reference and your mobile number. You enter your mobile money credentials with Hubtel directly, never in our app.
Supabase (hosting & database)	Hosting our backend, database and secure functions.	The account, order and payment data described above.
Google Firebase Cloud Messaging	Delivering push notifications to your device.	Your push notification token and the notification content.
Google Fonts	Delivering the typefaces used in the app and on this website.	Standard technical request data, including your IP address, when fonts are downloaded.

We may also disclose information where required by law, court order or a competent authority, or to establish or defend legal claims. If our business is transferred, your information may transfer with it and this policy will continue to apply. We do not sell your personal information.

6. International transfers

Some providers process data on servers outside Ghana. Where information is transferred abroad we take reasonable steps to ensure it remains protected to a standard consistent with the Data Protection Act, 2012 (Act 843), including through our contracts with those providers.

7. How long we keep information

Account details — while your account is open, then removed or anonymised after deletion.
Order and payment records — retained as long as tax, accounting and audit law require, even after account deletion, and used only for that purpose.
Push notification tokens — removed when you sign out, disable notifications, or delete your account.
Support enquiries — kept as long as needed to resolve the matter and for a reasonable period afterwards.

8. Your rights and choices

You have the right to ask us to:

access the personal information we hold about you;
correct information that is wrong or incomplete;
delete your account and personal information;
restrict or object to certain processing;
withdraw consent for notifications at any time.

To exercise any of these, contact support@cafe-deli.online or use Account → Help & support in the app. We respond within the time required by law. You also have the right to lodge a complaint with the Data Protection Commission of Ghana.

Deleting your account

You can delete your account from inside the app: Account → Delete account. For your security we send a one-time code to confirm it is you. Once confirmed, your customer profile and device access are permanently removed. Completed financial records are retained only where the law requires, as described in section 7.

If you no longer have the app, you can request deletion here.

Notifications

Push notifications are optional. Refuse them when first asked, or turn them off at any time in your device settings. Turning them off does not affect your ability to order — updates remain available in the app.

9. How we protect your information

All communication between the app and our servers uses encrypted HTTPS. Unencrypted traffic is blocked by the app.
Your session token and device identifier are held in the operating system’s secure storage (Android Keystore / iOS Keychain).
Access to production data is limited to staff who need it.
Payment credentials are handled entirely by our payment provider and never pass through the app.

No system can be guaranteed completely secure, but we take these measures seriously and review them as the service changes.

10. Children

The app is intended for adults able to enter into a contract for food ordering and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the app changes or as the law requires. The effective date above shows when the current version took effect. If a change materially affects your rights we will give notice in the app or by other reasonable means beforehand.

12. Contact us

Email: support@cafe-deli.online
Phone: +233 54 434 3341
Post: Cafe Delicioso, KNUST, Ghana
In the app: Account → Help & support