1. Who is responsible
For restaurant owners and staff, and for visitors to our own site, Spicey is responsible for the information. For customers who order or reserve at a restaurant, the restaurant decides how its customers’ details are used, and Spicey handles them on the restaurant’s behalf to run the service.
2. What we collect
- Owners and staff: name, email, phone, password (stored hashed, never in plain text), role, the restaurants you manage, and your activity in the dashboard (audit log).
- Customers: name, email, phone, order details, pickup time, reservation details, notes you add, and your order history if you create an account.
- Payments: card details are entered into Stripe’s secure form and sent to Stripe. We never see or store full card numbers. We keep the order amount, status, and card brand and last four digits.
- Restaurant business details: menus, hours, address, photos, blog posts, job postings and, for applicants, the details and resume they submit.
- Technical data: IP address, device and browser type, pages viewed, and error reports.
3. Why we use it
- To provide the service: take and fulfil orders, manage reservations, send confirmations and receipts, run the kitchen board and notifications.
- To process payments, prevent fraud and handle disputes.
- To bill restaurant subscriptions.
- To keep the service secure, fix errors and improve it.
- To answer support requests and send important service messages.
We do not sell personal information.
4. Who we share it with
We share only what is needed with companies that help us run Spicey:
- Stripe for payments, payouts, identity checks of restaurants and fraud screening.
- Resend to send emails such as order confirmations and password resets.
- Fly.io and Tigris for hosting our servers, database and image storage.
- Sentry for error monitoring and PostHog for product analytics.
- AI services we use for optional features, such as the AI menu helper, which receive only the content you submit to that feature.
We also share information with the restaurant you order from, when the law requires it, or to protect people and the service from fraud and abuse. If our business is sold or merged, information may move to the new owner under this policy.
5. Cookies and analytics
We use essential cookies to keep you signed in and secure the service. We also use analytics to understand how the product is used. You can block cookies in your browser; some features, such as signing in, will not work without the essential ones.
6. How long we keep it
We keep information while an account is active and as needed for the purposes above. Order and payment records are kept as long as tax, accounting and dispute rules require. When it is no longer needed, we delete it or make it anonymous.
7. Where it is stored
Our servers and providers may be located in Canada, the United States and other countries. Information may be processed there and is protected under the laws of those places.
8. Security
We use encryption in transit, hashed passwords, access controls and monitoring. No system is perfectly secure, so please use a strong, unique password.
9. Your choices and rights
You can ask to see, correct, export or delete your personal information, and withdraw consent to marketing, by emailing support@spicey.app. If you are a customer of a restaurant, we may pass your request to that restaurant. Under Canadian privacy law (PIPEDA and applicable provincial laws) you may also complain to the Office of the Privacy Commissioner of Canada.
10. Children
Spicey is not directed at children under 13, and we do not knowingly collect their information.
11. Changes
We may update this policy and will change the date above. For significant changes we will notify account holders. See also our Terms of Service.
12. Contact
Privacy questions: support@spicey.app.