UniBite is a food ordering service for the Misr International University (MIU) community, New Cairo campus. This policy explains what we collect, why, and what you can ask us to do about it. It covers unibite.store only.
What we collect
- Account details — your name, your MIU email address (@miuegypt.edu.eg), your phone number, and a password. Passwords are stored only as a bcrypt hash; nobody at UniBite can read yours.
- Orders — the items you order, any notes you add, the vendor, the amount, the pickup code, and the times at which the order moved through preparation and pickup.
- Payment records — for cash orders, only the amount due. If card payments are enabled for your account, we store the payment reference, the last four digits and the brand of the card, and, only when you tick "save this card", a token issued by our payment provider. We never receive or store your full card number, expiry date or CVV — those go directly to the payment provider's own hosted page.
- Reviews and complaints you submit, together with the order they refer to.
- Notification tokens if you allow browser push notifications, so we can tell you when your order is ready.
- Your email address alone if you subscribe to the newsletter.
- Technical logs — error and request logs kept for diagnosing faults. We do not log passwords, tokens or card data.
Why we collect it
- To place your order with the vendor and let you collect it — this is the core of the service.
- To confirm who you are and keep your account secure.
- To email you order confirmations and password resets, and to notify you when an order is ready.
- To settle money with vendors and to investigate refunds and disputes.
- To keep the service working — rate limiting, fraud prevention and fault diagnosis.
Sign-up is restricted to MIU email addresses because UniBite is a campus service. Verifying that address is how we confirm you are part of the MIU community.
Who else sees your data
We do not sell your data and we do not use it for advertising. We share it only with the parties below, only to the extent each one needs:
- The vendor you ordered from — your name, your MIU email address, your order contents and your pickup code, so staff can prepare the order, hand it to you and look it up if there is a problem with it. If you file a complaint about a vendor and we approve it, that vendor also sees the complaint with your name and email address. Vendors do not see your password, phone number or card details.
- Neon — our database host, which stores the data described above.
- Resend — sends our transactional email (order confirmations, verification and password resets).
- Expo Push Service ? delivers mobile push notifications through Apple and Google, if you allow them.
- Amazon Payment Services — processes card payments when card payments are enabled. Your card details are entered on their page, not ours.
- MIU administrators of the platform — a small number of UniBite operators can view orders, complaints and refunds in order to run the service.
We will also disclose data where we are legally required to.
Cookies
UniBite sets only cookies the service needs to work. There are no advertising or analytics cookies.
- A signed session cookie that keeps you logged in.
- A cross-site request forgery token, which protects your account from being acted on by another site.
- Short-lived cookies carrying your cart total and the order you just placed, so the checkout and confirmation screens can show the right figures.
Your cart contents themselves are kept in your own browser's local storage and are never sent to us until you place the order.
How long we keep it
- Orders and money records are kept for as long as we operate, because they are the record of a transaction between you and a vendor and may be needed for refunds, disputes or accounting.
- In-app notifications are deleted automatically after 30 days.
- Saved card tokens are deleted when you remove the card, and you may hold at most ten.
- Your account is kept until you delete it. Deleting it erases your name, email, phone number, saved cards and notifications straight away; the order and money records stay, without your details attached.
Your choices
- You can view and edit your name, phone number and password from your account page.
- You can delete a saved card at any time.
- You can turn push notifications off in your browser, or from your account page.
- You can unsubscribe from the newsletter using the link in any newsletter email.
- You can delete your account yourself from the Security tab of your account page. This erases the personal details attached to it immediately. Order and money records are retained in a form that no longer identifies you, because we need them for refunds, disputes and accounting.
- You can ask us for a copy of your data, or ask us to correct it.
Email [email protected] for any of the above. We aim to reply within 30 days.
Security
Traffic to unibite.store is encrypted in transit. Passwords are hashed with bcrypt. Session cookies are signed and are invalidated when you log out or change your password. Card data never reaches our servers. No system is perfect: if we discover a breach affecting your data, we will tell you.
Children
UniBite is intended for MIU students and staff and is not directed at children under 13.
Changes
If we change this policy we will update the date at the top of this page. If a change materially affects how we use your data, we will tell you by email before it takes effect.
Contact
Questions about this policy: [email protected].