Privacy policy

1. Who we are

Mumfud ("we", "us", "the platform") is a hyperlocal online marketplace that connects customers with independent home cooks. For personal data processed through the platform, Mumfud acts as the data controller for marketplace operations (accounts, orders, discovery, safety). Individual cooks act as independent controllers for the customer data they receive to fulfil an order (such as your name, pickup/delivery details, and messages), and their own obligations are described in our Terms of Service.

2. Scope of this policy

This policy covers the Mumfud website, web app, and related services. It does not cover third-party websites or services you may reach through the platform (for example Stripe's checkout pages), which are governed by their own privacy policies.

3. Data we collect

We collect the following categories of personal data:

• Account data: email address, display name, authentication credentials (or Google identity if you sign in with Google), profile preferences such as preferred market.
• Order data: listings purchased, quantities, prices, fulfilment method (pickup or delivery), order status history, refund records, and reviews you leave.
• Fulfilment data: pickup or delivery address snapshots attached to an order, delivery fees, and fulfilment status events.
• Communications: messages exchanged with cooks through the platform's chat, and support requests.
• Usage and device data: approximate location derived from IP (used for market resolution), browser locale, pages visited, and diagnostic logs used to keep the service secure and reliable.

4. Additional data for cooks

If you register as a cook, we additionally collect:

• Kitchen name, kitchen address, and — where required for delivery — verified geocoded origin coordinates.
• Verification status and any information submitted for cook verification, as required by the market you operate in.
• Compliance acknowledgements (which market documents you accepted, and which version).
• Payout and earnings data: order revenue, refunds, platform fees, and payout account details needed to pay you.

5. Location and address data

We use location in two distinct ways. First, your approximate location (from IP geolocation or browser locale) helps us show you the correct market — for example Pakistan versus Sweden — and is not stored as a precise record. Second, addresses you explicitly provide (a delivery address at checkout, or a cook's kitchen address) are stored as part of the order or cook profile so the order can be fulfilled. For delivery orders, the delivery address may be geocoded to validate that it falls within the cook's delivery radius.

6. Payment data

All payments are processed by Stripe. We never see or store your full card number, expiry, or security code — those go directly to Stripe. We store only the payment metadata needed to run the marketplace: payment intent and session identifiers, amounts in minor units, currency, payment status, and refund references. Stripe processes your payment data as an independent controller under its own privacy policy.

7. Messages and chat

Customer-to-cook messages (both pre-order questions about a dish and order-related chat) are stored on the platform so both parties can read them and so we can enforce safety rules, investigate reports, and resolve disputes. Please do not share sensitive personal data (such as full payment details or identity documents) in chat.

8. How we use your data

• To create and manage your account and authenticate you.
• To process orders end-to-end: checkout, payment, stock allocation, fulfilment tracking, cancellation, and refunds.
• To route you to the correct market and show prices in the correct currency.
• To enable communication between customers and cooks.
• To verify cooks, enforce compliance acknowledgements, and apply marketplace rules (such as rate limits and listing caps).
• To prevent fraud, abuse, and unauthorised access, and to keep audit logs.
• To produce aggregated, non-identifying statistics for platform operations.
• To comply with legal, tax, and accounting obligations.

9. Legal bases for processing

For users in the EU/EEA (including our Sweden market), we rely on:

• Contract (Art. 6(1)(b) GDPR): account provision, order processing, payments, refunds, and cook payouts.
• Legal obligation (Art. 6(1)(c)): financial record-keeping, tax, and food-safety traceability.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, platform security, service improvement, and dispute handling.
• Consent (Art. 6(1)(a)): where required, for optional cookies or features you explicitly opt into.

For users in Pakistan, we process personal data in accordance with applicable Pakistani law, including the Prevention of Electronic Crimes Act 2016 and evolving data protection regulation, on equivalent grounds of contractual necessity, legal compliance, and legitimate business interest.

10. Cookies and local storage

We use a small number of strictly necessary storage items:

• Authentication session: keeps you signed in (stored by our authentication provider).
• Market preference cookie (mf.market): remembers which market (e.g. SE or PK) you browse, so we show the right meals and currency.
• Theme and UI preferences: stored locally in your browser only.

We do not use third-party advertising or cross-site tracking cookies. Stripe may set its own cookies during checkout for fraud prevention, governed by Stripe's policies.

11. Who we share data with

• Cooks: the customer details needed to fulfil an order (name, fulfilment method, delivery/pickup details, messages).
• Customers: the cook's kitchen name, public profile, listing details, and pickup address needed to complete an order.
• Stripe: payment processing, payouts, and refunds.
• Infrastructure providers: the platform runs on managed cloud hosting and database infrastructure (Lovable Cloud), which processes data on our behalf under data-processing terms.
• Mapping/geocoding providers: address lookups used to validate delivery areas.
• Authorities: where required by law, regulation, or to protect the safety of users and the public.

We do not sell your personal data.

12. International transfers

Platform data is hosted on cloud infrastructure that may be located outside your country of residence. Where personal data is transferred from the EU/EEA to a third country, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses provided by our processors.

13. Data retention

• Account data: kept while your account is active; deleted or anonymised after account closure, subject to legal holds.
• Order, payment, and refund records: kept for the period required by applicable accounting and tax law (typically 7–10 years, depending on market).
• Chat messages: retained while the related order or listing relationship is active and for a reasonable period afterwards for dispute resolution and safety.
• Diagnostic and audit logs: retained for a limited period for security and operations.

14. Your rights

Depending on your market, you may have the right to: access your personal data; correct inaccurate data; request deletion; restrict or object to processing; data portability; and withdraw consent where processing is based on consent. Under GDPR these rights apply in full to EU/EEA users. To exercise any right, contact us via the dashboard or the contact details below. We may need to verify your identity before acting on a request. Some data cannot be deleted immediately where we must retain it for legal, tax, or dispute-resolution purposes.

15. Security

We protect personal data with encryption in transit, row-level access controls on the database, server-side authorisation checks, rate limiting, and least-privilege access to operational data. No method of transmission or storage is 100% secure; if we become aware of a personal data breach that poses a risk to you, we will notify you and the relevant authority where required by law.

16. Children

The platform is not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

17. Automated decisions

We use limited automation for market resolution (showing you the right market from signals like IP country), fraud prevention, and rate limiting. We do not make decisions with legal or similarly significant effect solely by automated means.

18. Changes to this policy

We may update this policy from time to time. Material changes will be indicated by an updated version number and date at the top of this page, and where appropriate we will notify you through the platform. Continued use after changes take effect constitutes acceptance of the updated policy.

19. Complaints and supervisory authorities

If you are in the EU/EEA, you have the right to lodge a complaint with your local data protection authority — in Sweden, the Integritetsskyddsmyndigheten (IMY). Users in Pakistan may use the complaint or court process available under applicable law. As the responsible authority and process can depend on the nature of a complaint, we do not present one body as the universal data-protection regulator for every Pakistan matter. We would appreciate the chance to resolve your concern directly first.

20. Contact us

For any privacy question or request, contact us through the support options in your dashboard. Include the email address associated with your account so we can verify and locate your data.