Privacy Policy

Who we are

YEBALABS LTD operates nayo. For questions about this policy or your personal information, contact privacy@nayo.rw.

Information we handle

• Venue information: information a restaurant or café provides to set up and use nayo, such as its business details, menu, and authorised team contacts.
• Guest interactions: full name, email address, phone number and, where provided, address, along with menu choices, order details, notes, and feedback.
• Messages: the information you send when you contact us for sales, support, or a privacy request.
• Technical records: basic information generated when the service is accessed, such as an IP address, browser or device details, and access times, where needed to operate and protect it.
• Analytics information: where Google Analytics is enabled, usage events, approximate location, browser and device details, and an analytics identifier. On websites this may use a first-party cookie; in apps it may use an app-instance identifier.

You can choose whether to contact us or provide optional details. Information required to place an order or send feedback is requested in that flow.

How we use information

We use information to show a venue’s menu, send an order and relevant contact details to the venue, deliver guest feedback to the venue, help the venue manage its service, respond to requests, and keep nayo working and secure. Google Analytics helps us understand how the website or service is used.

Who receives information

A guest’s order and feedback, including any details the guest includes, are shared with the restaurant or café that guest interacts with. We do not give that guest’s information to other venues.

We do not sell private business information or disclose it to other venues. A venue’s public menu and related details are shown to guests so they can use the service.

Contabo and Hostinger provide hosting, Resend handles email delivery, and Google Analytics processes usage information. These providers may process information needed for their roles. We require providers handling personal information on our behalf to protect it in line with this policy and applicable law. We may also disclose information where required by law or to protect legal rights.

How long we keep information

We keep venue information while the venue uses nayo and for the time needed to close its account and meet legal or contractual obligations. We keep guest order and feedback information for the time needed to provide the service to the venue and handle related requests. Technical and analytics records are kept only for as long as needed for operation, security, and usage measurement. When information is no longer needed, we delete or anonymise it unless a lawful reason requires us to retain it.

Access and deletion requests

Under applicable Rwandan law, you may ask to access, correct, restrict, or delete your personal information, object to certain uses, or request a portable copy where the law provides for it. Where processing relies on consent, you may withdraw that consent.

To make a request, including an account or data deletion request, email privacy@nayo.rw. Tell us which venue you interacted with if the request concerns an order or feedback. We may need to verify your identity. We will explain if we must retain any information for a legal reason. You may also raise a concern with the Rwanda Data Protection and Privacy Office.

Security and international processing

We use reasonable technical and organisational measures to protect information against unauthorised access, loss, and misuse. Hosting arrangements may involve processing outside Rwanda; where that happens, we follow the safeguards required by Rwandan law.

Changes to this policy

We may update this policy when our service or legal requirements change. The date at the top shows the latest revision. Material changes will be communicated through the service or another appropriate channel.