Privacy Policy

We act as a controller of the personal information of the restaurant operators and staff who hold accounts with us (for example, account and billing details). For the guest and order information that a restaurant collects through the Service, we act as a processor (service provider) on that restaurant’s behalf — the restaurant is the controller of its own guest data and is responsible for how it is used.

From operators and staff: your name, email, phone number, password (stored only as a secure hash), the restaurant’s business details, and the content you add to run it — menu, orders, stock, staff, guest records, and financial figures. We also record how you found us (for example, referral or campaign information) and your communications with us.

For subscriptions: billing information is processed by our payment processor (e.g., Stripe). We receive limited billing metadata (such as plan, status, and the last four digits of a card) but do not store full card numbers.

From guests ordering on a restaurant’s site: the details needed to fulfill an order — name, contact details, order contents, fulfillment choice, and any loyalty or gift-card identifiers. Guests pay the restaurant directly (for example, on pickup or delivery); we do not collect or process guest card payments. We collect only what an order or feature requires.

Automatically: standard technical and usage data — device and browser information, IP address, and log data — used to operate, secure, and improve the Service.

We use personal information to: provide, operate, and maintain the Service; process subscriptions and prevent fraud; keep accounts and data secure; provide support; understand and improve how the Service is used; and communicate with you about the Service. Where a restaurant sends marketing messages to its guests through the Service, it does so as the controller and is responsible for having the necessary consent. We do not sell personal information.

Where applicable law requires a legal basis, we rely on: performance of our contract with you (to provide the Service); our legitimate interests (to secure and improve the Service); your consent (for example, for certain marketing, which you can withdraw); and compliance with legal obligations.

We share personal information only: (a) with service providers (subprocessors) that help us run the platform — for example hosting and infrastructure, our payment processor for billing, and email or SMS delivery providers — under agreements that limit their use to providing those services; (b) with the restaurant whose site a guest ordered from (that restaurant receives its own guest and order data); (c) where required by law or to protect rights, safety, and the integrity of the Service; and (d) in connection with a merger, acquisition, or sale of assets, subject to this Policy. We do not rent, sell, or trade personal information.

We use strictly necessary cookies and similar technologies to keep you signed in, remember essential preferences, and keep the Service secure. We do not use third-party advertising or cross-site tracking cookies. You can control cookies through your browser, though disabling essential cookies may affect how the Service works.

Each restaurant’s data is logically isolated from every other tenant on the platform. We use reasonable technical and organizational measures — including encryption in transit and access controls — to protect personal information. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. We retain personal information for as long as an account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements; after that, we delete or de-identify it in the ordinary course.

We and our service providers may process information in countries other than the one in which you live. Where we transfer personal information across borders, we take steps to ensure it remains protected in a manner consistent with this Policy and applicable law.

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Operators can manage most account and guest data directly in the app, including exporting data. Guests should contact the restaurant they ordered from (the controller of their data); we will assist that restaurant as its processor. To exercise a right with us directly, contact us using the details below — we may need to verify your identity, and we will not discriminate against you for exercising your rights.

Any marketing messages a restaurant sends to its guests through the Service require the guest’s consent and include a way to opt out; the restaurant is responsible for honoring opt-outs and applicable messaging laws. You can opt out of our own product and marketing emails at any time using the unsubscribe link or by contacting us; we will still send essential service messages.

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this Policy from time to time. If a change is material, we will provide notice in-app or by email. The “last updated” date above shows when this Policy was last revised.

Questions or privacy requests? Email support@kitchra.com.