Data Deletion Instructions

1. Overview

This page explains how to request deletion of personal data held by ElyteFlow, including any data associated with messages we send over WhatsApp. It sits alongside our Privacy Policy, which describes what we collect and why.

Which route applies to you depends on your relationship with us, because we hold two different kinds of data under two different responsibilities.

2. Which Route Applies to You

2.1 You are a restaurant or business using ElyteFlow

We are the data controller for your account: your name, email address, phone number, business details, staff records and billing history. Contact us directly using section 3.

2.2 You are a guest who ordered from a restaurant that uses ElyteFlow

Your profile, order history and loyalty balance belong to that restaurant. They decide what to keep and for how long; we store and process it on their behalf. The fastest route is to ask the restaurant directly — an ElyteFlow operator can delete a guest profile from their own back office, and orders are detached from the profile rather than deleted so their accounting stays intact.

If you do not know which restaurant holds your data, cannot reach them, or would rather not contact them, write to us using section 3 and we will identify the businesses holding data for your phone number or email address and pass your request to each of them.

3. How to Request Deletion

Email privacy@elyteflow.com with the subject line “Data Deletion Request” and include:

• The phone number or email address your data is associated with, in full international format where possible (for example +20 10 1234 5678)
• The restaurant or business name, if you know it
• Whether you want everything deleted, or only a specific part — for example messaging data alone

We will ask you to confirm the request from the phone number or email address in question before we act on it. This is deliberate: a deletion request that anyone could make on someone else’s behalf would itself be a way to destroy another person’s records.

4. WhatsApp and Messaging Data

When a restaurant sends you a receipt, an order update or a verification code over WhatsApp, SMS or email, we store only what is needed to send it and to know whether it arrived:

• Your phone number or email address, in a single standard format
• Which message was sent, when, and its delivery status
• Whether you consented to marketing messages from that specific restaurant, and when

We do not store the contents of messages you send to a restaurant beyond what is needed to answer you, and we do not use messaging data to build advertising profiles or share it with advertisers.

Deleting your data removes your number from our messaging records, which stops further messages. You can also withdraw consent to marketing messages at any time without deleting anything else — consent is recorded per restaurant, so withdrawing it from one does not affect any other.

5. What Gets Deleted

On a completed deletion request we remove:

• Your profile: name, phone number, email address and saved delivery addresses
• Your loyalty balance and its transaction history
• Your verification records and any active sessions, which signs you out everywhere
• Your messaging records and consent entries, other than the consent register described in section 6
• Saved payment methods. Card details are held by our payment providers, never by us, and we instruct them to delete their stored copy

Copies may persist briefly in encrypted backups, which are overwritten on a rolling schedule. We do not restore deleted data from a backup except where a restaurant is recovering from a failure, and any such restoration is re-deleted.

6. What We Must Keep, and Why

Some records cannot be deleted on request because the law requires us or the restaurant to keep them. Where that applies we keep the minimum and delete the rest:

• Transaction and tax records. Completed orders, payments and refunds are financial records. We detach them from your profile so they no longer identify you, and keep them for the period the applicable tax law requires.
• Consent records. Where a restaurant relies on your consent to have messaged you, a record that consent was given and later withdrawn is itself a legal obligation, and is retained for three years.
• Fraud and abuse records. Where an account has been used for fraud or abuse, we may retain the minimum needed to prevent it recurring.

7. Timeframe and Confirmation

We acknowledge requests within five working days and complete them within 30 days. If a request is complex, or involves several restaurants, we will tell you and give a date.

When the deletion is done we write to you to confirm what was deleted and to name anything retained under section 6, along with the reason.

8. Your Other Rights

Deletion is not the only option. You may also ask for a copy of your data, ask us to correct it, or object to a particular use while keeping your account. Depending on where you live, these rights come from Egypt’s Personal Data Protection Law, the GDPR, or comparable law. Our Privacy Policy sets them out in full.

9. Contact

ElyteFlow is operated by Reckless Smoker, the data controller. For deletion requests or any question about this page:

Email: privacy@elyteflow.com

Website: elyteflow.com

If you are not satisfied with how we handled your request, you may complain to your local data protection authority.