Last updated: 17 August 2026
Momangi ("we", "us") operates momangi.com and the restaurant storefronts under *.momangi.com — a platform that lets independent restaurants publish their menu, take pickup and delivery orders, and run waiter table service. Momangi is operated from North Macedonia and serves restaurants and their customers worldwide, including in the European Union. Two different roles matter here. For the platform itself — your account, sign-in, security logs, and our own business records — Momangi is the data controller. For the contents of an order you place with a particular restaurant, that restaurant is the controller and Momangi acts as its processor, handling the data on the restaurant's instructions under a written agreement. In practice this means questions about your account go to us, and questions about a specific order go to the restaurant (though you can always contact us and we will help). You can reach us anytime at vasilmishkov@proton.me.
Customers: your name, phone number, email address, saved delivery addresses, order history, and — if you sign in with Google — your Google account identifier. If you turn on browser push notifications, we store the push subscription your browser generates. Restaurant staff: name, email, and role for dashboard accounts. Restaurant owners who contact us: the name, restaurant name, email, and phone number you submit in the join form. Technical: IP addresses and request logs, kept for security and rate limiting. We do not collect payment card details at all — the platform takes no payments from customers.
To create and run your account and to deliver your orders to the restaurant (performance of a contract). To keep the platform secure — login codes, attempt limits, rate limiting, server logs (legitimate interest). To notify you about your order by email, SMS, or — only if you enable them — push notifications (contract / consent). To respond to restaurant join requests (steps prior to a contract). Where we rely on your consent — push notifications in particular — you can withdraw it at any time, in your browser settings or by asking us, without affecting anything we did before you withdrew it. We do not sell your data and we do not use it for advertising.
Our servers are located in Nuremberg, Germany (Hetzner, EU). Menu and logo images are stored with Cloudflare (R2). We use Resend to deliver emails, Twilio to deliver SMS where enabled, and Google Firebase solely for optional Google sign-in. Operational alerts (e.g. a new order notification to the restaurant) may be relayed through Telegram. These are our sub-processors; we keep the list on this page current and will update it here before adding a new one. Where a provider processes data outside the EU/EEA, transfers rely on standard contractual clauses or equivalent safeguards.
The restaurant you order from sees what it needs to fulfil your order: your name, phone number, delivery address, and the order itself. Restaurant staff accounts see only their own restaurant's data — the platform enforces this separation on every request. Our service providers listed above process data on our behalf. We may also disclose data where we are legally required to, for example in response to a valid order from a competent authority. Nobody else — no data brokers, no advertisers, no analytics networks.
Your account stays until you ask us to delete it; ask and we will remove it, along with the personal details attached to it, within 30 days. Orders are retained as business and accounting records for as long as the applicable tax law requires (generally up to 10 years), after which they are deleted or irreversibly anonymised. Server and request logs rotate automatically and are kept for up to 30 days. Database backups are kept for 30 days and then deleted, so a deletion request can take up to 30 further days to work through the backup cycle. One-time login codes are deleted as soon as they are used or expire.
Under the GDPR (and similar laws elsewhere) you can ask for a copy of your data, ask us to correct or delete it, restrict or object to processing, withdraw a consent you have given, and receive your data in a portable format. Write to vasilmishkov@proton.me and we will respond within one month; exercising these rights is free, and we will tell you in advance in the rare case a request is so repetitive that a fee or refusal is permitted. You also have the right to lodge a complaint with your local data-protection authority, and you do not have to contact us first.
We use only essential cookies: your login session, your theme (light/dark), and your language choice. These are needed for the site to work, so they do not require consent and there is no cookie banner to click through. There are no advertising, tracking, or third-party analytics cookies, and no cross-site tracking of any kind.
All traffic is encrypted with TLS. Passwords are stored hashed (bcrypt). One-time login codes expire quickly and are locked after repeated wrong attempts. Session cookies are HttpOnly and cannot be read by scripts. Access to production systems is restricted. No system is perfectly secure, but if a breach ever affects your personal data we will notify the competent supervisory authority within 72 hours of becoming aware of it, and notify you directly without undue delay where the law requires it.
We do not profile you and we make no decisions about you by automated means that produce legal effects or similarly significantly affect you. Nothing on the platform scores, ranks, or filters people.
Momangi is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.
When you use Momangi to take orders, you are the controller of your customers' order data and we are your processor. We process that data only on your documented instructions, keep it confidential, apply the security measures described above, use only the sub-processors listed above, help you respond to your customers' data-protection requests, and delete or return the data when your account closes. If you need a separate written data-processing agreement for your own compliance file, ask us and we will provide one.
If this policy changes, we will post the new version here with an updated date. Material changes will be highlighted on this page, and where the change affects how we use data you have already given us, we will tell you directly before it takes effect.