Mal Al Sham
Order
Resources
Guide

Privacy policy

4 min read

Last updated: September 22, 2026

This policy explains what information Mal Al Sham, 388 E Main St, El Cajon, CA 92020, collects through the Mal Al Sham app and malalsham.com, and how we use it. Questions: [email protected] or (619) 401-1055.

What we collect and why

  • Catering requests. When you send one, we receive your name, phone number, your email if you add it, the event date, the number of guests and your message. We use them only to reply with a quote.
  • Chat with our AI agent. We receive and keep your messages and the replies so the agent can answer and so we can improve its answers. Replies are generated by our AI provider, OpenAI, which processes the messages for us.
  • Notifications. If you turn them on, we store a notification token from Google Firebase Cloud Messaging, your language and the branch you follow, so we can send you specials and news.
  • Rewards. If you join Mal Al Sham Rewards, we keep your email, your name, a member number, your language and, if you give them, your birthday (month and day, no year) and favorite branch. We use them to run your account, email your sign-in codes and send birthday and branch offers, which you can turn off.
  • Receipts you scan. The app reads the receipt on your phone and sends us the photo, the text it read and a random code for your phone. We look up the order in the restaurant's Clover register (order and payment numbers, amounts, time, branch and the card's last 4 digits) to confirm the visit and count your points. Our AI provider, OpenAI, also reads the photo for us as a check. We remove the photo's location data when it arrives and delete photos after 30 days.
  • Points, rewards and feedback. We keep a record of the points you earn and use, the rewards and offers you use and which staff member confirmed them, and the messages you send the team from the app with their replies. Feedback is private and never published.
  • Hearts. When you love a dish, we store a random code created on your phone, not linked to your name, to count hearts.
  • Order taps. When you tap DoorDash, Uber Eats or Grubhub, we record which service, branch and dish you tapped, with no personal details, to learn how guests order.
  • Location. If you allow it, the app uses your phone's location on your phone only, to show the nearest branch. It is never sent to us.

Ordering and payment

Orders are placed and paid on DoorDash, Uber Eats or Grubhub under their own privacy policies. The app never takes payment.

Sharing

We do not sell your information. We share it only with service providers that run the service for us (our hosting, Google Firebase, OpenAI, Clover and our email provider), or when the law requires it.

Security

Information travels encrypted between the app and our servers.

Children

The app is not directed to children under 13, and we do not knowingly collect their information.

Your choices

You can turn notifications off and deny location access in your phone settings. Rewards offers and activity notifications can be switched off in the app under Rewards, Account. To see or delete the information we hold about you, email [email protected]. California residents have the right to know, delete and opt out of the sale of their personal information. We do not sell it.

Deleting your data

If you have a Rewards account, you can delete it yourself in the app: Rewards, Account, Delete account, confirmed with a code we email you. We then remove your name, email, birthday, branch and receipt photos, unlink your phone and sign you out everywhere. We keep, without your name or email, the receipt records that stop a receipt being used twice, your feedback messages, and a one-way fingerprint of your email so the welcome points cannot be claimed again. To have your feedback messages removed too, email us.

To delete anything else the Mal Al Sham app holds about you, email [email protected] with the subject "Delete my data". Include the name, phone number or email you used, and the date of any AI chat you want removed. Within 30 days we delete your catering requests, the chats you point us to and your notification registration, and confirm by email. Hearts and order taps are not linked to your name. We keep only the records the law requires. To stop notifications at once, turn them off in your phone settings.

Changes

We will post any changes on this page with a new date.