Privacy & Policy

1. Privacy Policy Agreement

This policy explains what personal data Slync Restaurant ("we", "us") collects, why, who can see it and how long we keep it. It covers restaurant owners and staff who use the platform, and the customers of those restaurants whose data we process on the restaurant's behalf. By using the service you agree to this policy.

2. What we collect

• Account data. Owner and staff name, email, phone, password (stored hashed), role, two-factor settings and sign-in activity.
• Restaurant data. Restaurant name, category, subdomain and custom domains, branches and addresses, menu, images, website pages, app branding (name, logo, colours, package name), payment-gateway keys you enter, plan, invoices and payment proofs.
• Order and customer data, processed for the restaurant. Customer accounts, names, phone numbers, delivery addresses, orders, payments, wallet and loyalty balances, chat messages, reviews and push-notification tokens. The restaurant decides what it collects from its customers; we store it for the restaurant.
• Delivery rider data. Rider accounts and, while a rider is on duty in the rider app, their live location, used to assign and track deliveries.
• Marketplace and webhook data. Orders received from connected marketplaces, and the delivery log of webhooks you send to your own endpoints.
• Technical logs. IP address, browser and device details, request logs, error logs and the audit log of actions taken in the admin panel.
• Messages to us. Contact-form messages, support tickets and newsletter sign-ups.

3. How we use it

• To run your restaurant's ordering site, apps, panel, POS, kitchen and delivery tools.
• To sign you in, send login links, verification emails and two-factor prompts.
• To bill your subscription, issue invoices and verify offline payments.
• To build your branded Android apps from the branding you provide.
• To answer support tickets and contact messages.
• To keep the platform secure, find abuse and fix errors.
• To send you the newsletter if you subscribed; you can unsubscribe at any time.

We do not sell personal data and we do not use your customers' data for our own marketing.

4. Who can see it

• Your restaurant's staff, according to the roles and permissions you give them in the panel. Branch managers see their branch; kitchen staff see kitchen orders; riders see their assigned deliveries.
• Platform staff, for support, billing and security. When a platform administrator opens your panel to help you (impersonation), that action is recorded in the audit log.
• Service providers we need to run the platform: hosting, email delivery, map and push-notification services, and the payment gateways you connect. Your customers' card details go to the gateway, not to us.
• Marketplaces you connect receive your menu and order status updates for the orders they send you.
• Authorities, when the law requires it.

5. Cookies

The platform and restaurant sites set session and security cookies needed to sign in, keep a cart and protect forms against forgery. These are required for the service to work. A restaurant may add its own Google Analytics id to its website in the website builder; that analytics cookie belongs to the restaurant's site, and the restaurant is responsible for telling its visitors about it.

6. Retention and deletion

Account, restaurant and order data stays in your restaurant's account for as long as the account exists, because you need order history for your own records. Invoices are kept for as long as we must keep accounting records. Technical and audit logs are kept for security purposes. Email verification links expire after 24 hours. To close your restaurant and ask for its data to be removed, open a support ticket from your panel or use the contact page.

7. Security measures

• All traffic to the platform and to restaurant sites uses HTTPS; SSL certificates are issued for subdomains and verified custom domains.
• Passwords are stored as hashes. Payment-gateway keys and other secrets you enter are encrypted at rest.
• Two-factor authentication (TOTP) is available to every owner and staff account.
• Actions in the admin panel, including sign-ins and platform-staff impersonation, are written to an audit log you can review.
• Each restaurant's data is separated by tenant; one restaurant cannot read another's records.
• Webhook deliveries to your endpoints are signed so you can verify they came from us.

8. Your rights

You can see and edit your account and restaurant data in the panel, and export menus and reports to Excel from there. You may ask us to correct, export or delete personal data we hold about you, and to stop the newsletter at any time. If you are a customer of a restaurant that uses Slync Restaurant, please contact that restaurant first; it controls its customer data and we will help it respond.

9. Contact

Privacy questions or requests: open a support ticket in your panel, or write to us through the Contact page.