Privacy Policy

DRAFT — replace with reviewed legal text before launch. Outline to fill in — what's actually collected today: - Business owners: name, email, password, billing address, payment details (handled by Stripe, not stored on our servers) - Diners: no account or login — orders are tied to a table number and an anonymous order ID, nothing else is collected - Where data is stored (Supabase/Postgres) and processed (Stripe for billing, SendGrid for email) - How long order history is retained - Data subject rights (access, deletion) and how to exercise them - Cookie usage (auth session cookies only — no tracking/analytics cookies today)