Privacy Policy

1. Scope

This Privacy Policy explains how personal data is handled when you use GastroGrowth websites, restaurant storefronts, branded customer apps, the business/admin app, and related support services.

If you use a branded restaurant app or storefront, the restaurant operator shown in that app or storefront is responsible for its restaurant-specific privacy notices and lawful basis for processing. GastroGrowth provides the software platform and processes restaurant customer data on the restaurant operator's instructions.

2. Data Protection Roles

Payment providers, delivery partners, marketplaces, app stores, device operating systems, and other third-party services may act as independent controllers or separate processors under their own terms and privacy notices.

3. Personal Data We Process

• Account and contact details, including name, email address, phone number, password credentials, authentication events, and account status.
• Order and cart data, including products, modifiers, notes, fulfillment method, order status, loyalty activity, refunds, and support history.
• Delivery and pickup information, including saved addresses, delivery instructions, location choice, map lookup data, and handoff notes.
• Preferences and consent, including marketing opt-in status, loyalty participation, language, notification settings, dietary preferences, and allergen warnings.
• Payment-related data, including payment status, payment provider references, chargeback or refund metadata, and invoice/tax records. GastroGrowth should not store full card numbers.
• Technical and security data, including IP address, device, browser, app version, logs, crash diagnostics, fraud prevention signals, cookie/session identifiers, local storage identifiers, push tokens, and app/device identifiers used for security, preferences, analytics, or fraud prevention.
• When a visitor allows marketing-site analytics, Google Analytics receives the canonical page path and title, consented interaction names, bounded campaign attribution, and browser/device or cookie identifiers. Demo-form field values, contact details, free text, and complete query strings are excluded from these events.
• Business operator data, including staff accounts, roles, tenant membership, restaurant configuration, menu imports, uploaded assets, support requests, and billing contacts.

Allergy and dietary information can be sensitive. It should be optional, used only to show warnings or help the restaurant prepare an order, and must not replace direct communication with the restaurant for severe allergies or medical needs.

4. How Data Is Used

• To create accounts, authenticate users, manage sessions, and protect accounts from abuse.
• To submit, route, fulfill, update, edit, cancel, refund, and support restaurant orders.
• To save customer preferences, addresses, loyalty state, notification choices, and marketing consent for the relevant restaurant account.
• To operate the business/admin tools used by restaurants and authorized staff.
• To send transactional messages, order updates, account security notices, support replies, and legally required notices.
• To send marketing messages only where the applicable restaurant or GastroGrowth has a valid legal basis and the required opt-in/withdrawal mechanism.
• To remember essential session, security, language, device, cart, checkout, notification, and preference state through cookies, local storage, app storage, or similar technologies.
• To monitor reliability, detect fraud or abuse, fix bugs, secure the platform, enforce terms, comply with law, and maintain audit records.
• To create aggregated or de-identified insights that do not identify an individual or a restaurant customer account.

5. Lawful Bases

For restaurant customer/order data, the restaurant operator decides the applicable lawful basis, such as contract performance, legal obligation, legitimate interests, consent, or explicit consent where required. GastroGrowth processes that data as processor under the restaurant operator's documented instructions.

For GastroGrowth-controlled data, GastroGrowth relies on lawful bases including contract performance, legitimate interests in operating and securing the platform, compliance with legal obligations, and consent where required for optional marketing or non-essential cookies.

Where the restaurant enables marketing, profiling, loyalty, advertising, or non-essential analytics, the restaurant is responsible for choosing the lawful basis and collecting any consent required by applicable law. Refusing optional consent may limit marketing, loyalty, or personalization features, but should not prevent ordinary order processing unless the refused data is necessary for that order.

6. Sharing And Recipients

• Restaurant operators and their authorized staff receive the customer and order data needed to operate their restaurant, loyalty program, delivery, support, and legal obligations.
• Approved subprocessors provide hosting, database, authentication, storage, monitoring, consented website analytics, captcha, maps, email, push notification, AI import, and support infrastructure.
• Payment processors, delivery providers, app stores, marketplaces, POS providers, and integration partners receive data only where enabled by the restaurant or required for the requested service.
• Authorities, courts, advisers, insurers, and transaction counterparties may receive data where legally required, to protect rights, or in connection with a restructuring, financing, or sale of the business.

7. International Transfers

Personal data may be processed in the European Economic Area, the United Kingdom, Switzerland, the United States, or other countries where GastroGrowth, the restaurant operator, or approved providers operate. Where GDPR transfer rules apply, transfers must use an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism.

8. Retention And Deletion

Personal data is kept only for as long as needed for the purposes described above, the restaurant operator's documented instructions, and legal requirements. Order, tax, invoice, fraud prevention, chargeback, accounting, and security records may need to be retained after an account deletion request. In some markets, tax, accounting, civil-law, fraud, chargeback, or legal-defense records may be retained for up to ten years or longer where law requires.

Account deletion can be requested at /account-deletion. GastroGrowth will verify the request, coordinate with the restaurant operator where required, delete or anonymize data that no longer needs to be retained, and confirm the outcome.

9. Cookies, App Storage, And Similar Technologies

The platform may use essential cookies, session storage, local storage, app storage, device identifiers, push tokens, pixel-like request logs, and similar technologies for authentication, session continuity, cart state, checkout security, fraud prevention, language/preferences, analytics, performance, and diagnostics. Optional advertising, profiling, or campaign technologies should be enabled only where the restaurant has configured the required notice and consent flow.

On the public GastroGrowth marketing website, Google Analytics loads only after analytics consent. Advertising storage, ad-user data, Google signals, and ad-personalization signals stay disabled. You can reject analytics initially or withdraw consent later through the persistent Cookie preferences control; withdrawal stops subsequent optional analytics events.

10. Your Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data, and to withdraw consent. You may also have the right to complain to a supervisory authority.

For restaurant customer data, contact the restaurant operator shown in the app or storefront. You may also email privacy@gastrogrowth.com, and GastroGrowth will route or assist the request as required by the controller-processor relationship.

11. Security

GastroGrowth uses technical and organizational measures designed to protect personal data, including access controls, tenant separation, authentication controls, encrypted transport, logging, monitoring, least-privilege access, and incident response procedures. No internet service can guarantee absolute security.

12. Contact

Privacy contact: privacy@gastrogrowth.com. Restaurant operators must keep their own legal identity, privacy contact, and customer-facing notices accurate in each storefront, app, and store listing.