Privacy Policy

1. Who we are

EateryHub ("we", "our", or "us") provides an all-in-one, AI-first restaurant operating system unifying online reservations (0% commission), Daylight Cloud POS & Kitchen Display System (KDS), 24/7 Voice AI Phone Ordering, guest CRM, and automated retention marketing (Grow Suite).

We are proudly based and made in Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit our website (https://www.eateryhub.ca), use our web and mobile applications, book reservations, or interact with restaurants powered by EateryHub.

2. Information we collect

We collect information depending on how you interact with our platform:

Account and staff information: When you sign up as a restaurant operator or staff member, we collect your name, business name, email address, phone number, hashed password, and staff role. When staff PIN credentials are created for terminal access, PINs are salted and hashed (never stored in plain text).

Restaurant operational data: Details provided by the restaurant operator, including venue address, cuisine type, operating hours, floor plans, table configurations, menus, modifiers, pricing, and registered POS terminal devices.

Guest reservation and dine-in data: When guests book a table online, join a digital waitlist, or dine at a participating restaurant, we collect their name, email address, phone number, party size, reservation date/time, seating preferences, dietary restrictions, and special requests. This data is collected and processed on behalf of the restaurant operator.

Point of Sale (POS) and order data: When orders are placed dine-in, online, or over the phone, we record order items, special preparation notes, course timing, payment statuses, and transaction receipts. For operational loss-prevention audits, manager void/comp reasons and staff PIN attributions are securely logged.

Voice AI phone ordering:When a restaurant enables our 24/7 Voice AI Phone Ordering host, incoming customer phone calls are processed by our automated voice system to answer menu questions, book reservations, and place takeout orders directly into the restaurant's POS and KDS. Callers are informed at the start of the call that it is assisted and recorded for order fulfillment and quality assurance. Audio recordings and generated transcripts are retained strictly on behalf of the restaurant operator.

Marketing and guest CRM data (Grow Suite): Dining history, visit frequency, opt-in communication preferences, automated win-back SMS/email logs, feedback surveys, and Google reviews integration links.

Payment card data: Payment processing is powered directly through Stripe (including Stripe Checkout for deposits/online orders and Stripe Terminal / Tap to Pay for in-person POS transactions). EateryHub never stores, captures, or transmits full credit or debit card numbers on our servers.

Usage data, cookies, and mobile telemetry: We collect standard server logs (IP addresses, browser type, device operating system, request timestamps), session authentication cookies, device push notification tokens (for staff order notifications), and Google Tag Manager (GTM) analytics to ensure platform stability, prevent fraud, and optimize user experience.

3. How we use your information

• To provide, synchronize, and improve Core Operations (reservations, floor status, POS, KDS) and Grow AI (Voice AI, marketing automation).
• To process and fulfill direct table reservations, waitlists, and voice phone orders in real-time.
• To send transactional communications to diners, including reservation confirmations, table-ready SMS notifications, cancellations, and digital receipts (on behalf of the restaurant).
• To allow restaurant operators to view visit history, manage staff shifts, reconcile cash drawer floats (Z-reports), and monitor operational audit trails.
• To deliver automated guest retention marketing and post-visit review requests in compliance with anti-spam laws.
• To process subscription billing and manage restaurant accounts.
• To detect, prevent, and remediate technical issues, security incidents, or fraudulent transactions.

4. Sharing your information & subprocessors

We do not sell, rent, or trade your personal data. We share data strictly with trusted service providers who assist us in operating our platform:

• Cloud hosting and database infrastructure: Supabase (database, authentication, and secure storage) and Vercel (cloud application hosting and edge runtime).
• Payment processing: Stripe (subscription billing, deposits, card payments, and Tap to Pay processing).
• Telecommunications & Voice AI: Telephony and AI model infrastructure providers for transcribing voice phone calls and sending SMS order notifications.
• Email delivery: Transactional email service providers for confirmations and account notices.
• Analytics: Google Tag Manager and Google Analytics (for aggregate usage metrics).
• Legal compliance: Law enforcement or regulatory authorities when required by applicable law, court order, or governmental regulation.

5. Canadian privacy compliance (PIPEDA & CASL)

As a company made and operating in Ontario, Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy principles:

• Accountability & Consent: We collect and process personal data only with knowledge and consent, for reasonable and clearly identified business purposes.
• Canada's Anti-Spam Legislation (CASL): All promotional and marketing messages sent through the platform include clear sender identification, valid contact details ([email protected]), and an immediate unsubscribe/opt-out mechanism.
• Data Controller vs. Processor: For diner data collected on behalf of restaurants (reservations, phone orders, diner CRM), the restaurant operator acts as the Data Controller, and EateryHub acts as the Data Processor. Operators determine guest communication policies and ensure diner consent.

If you are located in the European Economic Area (EEA), the United Kingdom, or California, we also respect applicable GDPR and CCPA/CPRA rights, including rights of access, correction, deletion, and data portability.

6. Data retention and account deletion

We retain account and restaurant operational data for as long as the restaurant account remains active. Reservation and order history are retained to support reporting, tax records, and audit compliance.

Restaurant operators and users may delete their account at any time directly in our applications (under More → Account → Delete account) or by submitting a written request to [email protected]. Upon account termination, associated personal data is permanently deleted or anonymized in accordance with our retention policy.

7. Security safeguards

We implement comprehensive technical and organizational safeguards to protect your personal information:

• All web and mobile traffic is encrypted in transit using Transport Layer Security (TLS 1.3).
• Database records are encrypted at rest with industry-standard AES-256 encryption.
• Multi-tenant PostgreSQL Row-Level Security (RLS) strictly isolates each restaurant's operational and guest data.
• Staff PIN actions (voids, discounts, shift close) require cryptographic HMAC-SHA256 authorization tokens with automatic expiration.

8. Children's privacy

Our platform is designed for restaurant operators and adult diners. We do not knowingly solicit or collect personal information from individuals under the age of 16.

9. Changes to this policy

We may update this Privacy Policy periodically to reflect changes in our platform or legal obligations. When we make material changes, we will update the "Last updated" date and notify active account holders via email or in-app announcement.

10. Contact us

If you have questions, feedback, or wish to exercise your privacy rights, please contact our privacy team: