Draft for legal review. This text has not yet been approved by a lawyer.
Privacy Policy
In short:
- We collect what’s needed to get your order to you: your name, phone, the order, and your address for delivery. Your email only if you give it.
- The restaurant you order from sees your order details so it can make and hand over your food.
- We don’t sell your information, show ads, or use tracking cookies.
- You can delete your account at any time from any restaurant’s ordering page.
1. Who this covers
Cravings (“we”) makes online ordering pages for restaurants and a dashboard restaurants use to run them. This policy covers customers who order through a restaurant’s Cravings page, restaurant owners and staff (including delivery drivers) who use the dashboard, and visitors to cravings.dev.
When you order, the information about your order is also the restaurant’s record of its sale. We store and process it for the restaurant. The restaurant may use it under its own privacy practices, for example to contact you about your order.
2. What we collect
When you order
- Name and phone number, so the restaurant knows whose order it is and can call you.
- Your order: items, choices, notes, tip, totals, pickup or delivery, and its status.
- Delivery address and instructions, for delivery orders. While you type it, the address search is sent to Google to suggest matching addresses.
- Email address, only if you give it for order updates or to sign in.
- Payment: card details go directly to Stripe, the payment processor. We receive only what’s needed to track the payment (for example, whether it was approved, and its amount). We never see or store your full card number.
- Proof of delivery: the driver may take a photo of the order where it was left.
If you sign in
- Your email address, the restaurants you’ve ordered from while signed in, your order history there, and your rewards points at each.
Restaurant owners and staff
- Email address and password (stored securely by our sign-in provider), role, and the restaurants and locations you work with. For drivers: name and phone number, and which orders you were assigned.
- Restaurant details you enter: name, addresses, hours, menus, photos, settings, and payout setup (handled by Stripe).
Automatically
- Basic technical information such as your IP address and browser type, used to deliver pages, prevent abuse (for example, limiting how fast address searches can be made) and keep the service secure. We don’t use analytics or advertising trackers.
3. How it’s used
- To place your order with the restaurant, take payment, and get the food to you.
- To send the order updates you asked for (received, ready, on the way, receipt), and sign-in emails.
- To show your order history and rewards points when you sign in.
- To give restaurants their order screens, reports and refunds.
- To prevent fraud and abuse, keep the service secure, and fix problems.
- To meet legal obligations, such as tax and accounting records.
We don’t sell your personal information and don’t use it for advertising.
4. Who sees it
- The restaurant you order from and its staff see your name, phone, order and delivery address. Owners and managers also see your account email if you ordered signed in. A driver sees your name, phone and address only while your delivery is assigned to them. Restaurants can’t see your email if you only used it for order updates as a guest.
- Service providers who run parts of the service for us, under contracts that limit their use of
the information:
Provider What for Stripe Card payments, refunds and restaurant payouts Supabase Database, sign-in and photo storage Cloudflare Hosting and delivering the websites and service Google Address suggestions while you type an address Resend Sending emails (order updates, sign-in, invites) Clover Only for restaurants that connect their Clover system: menu and stock information - When required by law, or to protect the rights, safety and property of customers, restaurants or Cravings.
- If Cravings is involved in a merger, acquisition or sale of assets, information may be transferred as part of that, under this policy.
5. How long it’s kept
- Orders are kept as the restaurant’s sales records for as long as the restaurant uses Cravings and as needed for tax and accounting.
- Email addresses given for order updates are deleted 30 days after the order is finished.
- Accounts are kept until you delete them. Deleting your account removes your sign-in, saved details, points and order-history links straight away. Orders themselves stay with the restaurant, no longer linked to you.
- Technical logs are kept for a short period for security and troubleshooting.
6. What’s stored on your device
Ordering pages store a few things in your browser so they work: your cart, your recent orders (so you can get back to them), and, if you sign in, your sign-in session. The restaurant dashboard stores your sign-in and simple preferences like sound on or off. These aren’t used for tracking or advertising. Clearing your browser’s site data removes them.
7. Your choices and rights
- Order without an account. Email is optional.
- Stop order emails using the link in any order email.
- Delete your account from the account page on any restaurant’s ordering page.
- Access, correct or delete other information by emailing hello@cravings.dev. For information held as a restaurant’s order records, we may need to involve the restaurant. Depending on where you live (including under New Jersey law), you may have additional rights, such as to request a copy of your information or to appeal a decision about a request. We’ll respond within the time the law requires and won’t treat you differently for using these rights.
8. Security
Information is encrypted in transit. Access is limited by role: for example, restaurants only see their own orders, and drivers only see deliveries assigned to them. Card details are handled only by Stripe. No system is perfectly secure; if we learn of a breach affecting you, we’ll notify you as the law requires.
9. Children
Cravings isn’t directed at children under 13, and we don’t knowingly collect their information. If you believe a child has given us information, contact us and we’ll delete it.
10. Changes and contact
We may update this policy. The date at the top shows when it last changed; significant changes will be announced on ordering pages or by email. Questions or requests: hello@cravings.dev. See also our Terms of Service.