Privacy Policy
Effective November 4, 2026
Mhenu is an ordering and point-of-sale platform for food businesses in the Philippines. This policy explains what personal data we collect through our website and mobile app, why we use it, and the choices you have. We handle personal data in line with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).
Data we collect
- Account details: your name, email address, mobile number and password. Passwords are handled by our authentication provider, and we do not see them.
- Google sign-in details: if you continue with Google, we receive your name, email address and profile picture.
- Order details: items ordered, order type, amounts, payment method, notes and order history.
- Delivery details: your address and, if you pin it on a map or allow location access, its coordinates.
- Loyalty details: stamps and rewards with each merchant.
- Proof of delivery: photos, signatures and notes captured by riders.
- Merchant and staff details: business, branch and staff details, rider location during active deliveries, and wallet top-up records and receipts.
- Device details: notification tokens, plus data stored on your device so the app works, including sign-in sessions, your bag and saved addresses.
How we use your data
- To create your account and sign you in
- To place, prepare, deliver and track your orders
- To let riders and stores contact you about an order
- To run loyalty programs and apply promo codes
- To send order and account notifications, based on your settings
- To run merchant tools such as menus, wallets, reports and support
- To keep the service secure, prevent fraud and meet legal duties
We rely on your consent, the need to fulfill our service to you, our legitimate interests in running a secure service, and our legal obligations.
Google user data
We use your Google name, email address and profile picture only to sign you in and set up your Mhenu account. We do not sell this data, use it for advertising, or use it to train general-purpose AI models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Who receives your data
We do not sell personal data. We share it only as needed with:
- Merchants you order from: your contact, order and delivery details and your loyalty record with them. Merchants handle this data for their own operations and are responsible for how they use it.
- Riders: what they need to complete your delivery.
- Service providers: Supabase for database, sign-in and file storage; Vercel for hosting; Google for sign-in, website fonts and push notifications; and OpenStreetMap and unpkg for maps. These services may receive technical data such as your IP address.
- Payment and messaging providers: when a merchant uses online payments or we send SMS messages, the provider receives what it needs to do so.
- Authorities: when the law requires it, or when needed to protect people or our rights.
Some providers may process data outside the Philippines. We use reasonable safeguards when this happens.
How long we keep data
We keep personal data while your account is active and for as long as needed for the purposes above. Merchants may keep sales records for their books after an account is deleted, with details that identify you removed where the law allows. We may keep other records when the law requires it.
Security
We use access controls that limit each account to its own data, encrypted connections and private storage for sensitive files. No system is perfectly secure, so please protect your password and tell us if you suspect misuse.
Your rights and choices
Under the Data Privacy Act, you may ask to be informed about, access, correct, object to, or delete your personal data, and to receive a copy of it. You may also file a complaint with the National Privacy Commission.
- You can edit your name and notification settings in your account.
- You can block location, camera or notification access in your device settings, though some features may stop working.
- To delete your account and related data, email us at hello@mhenu.com. Active orders must be finished first.
Children
Mhenu is not meant for children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, please contact us so we can delete it.
Changes to this policy
We may update this policy. We will change the date above and, for significant changes, give notice in the app or by email.
Contact us
For privacy questions or requests, email hello@mhenu.com.