Privacy policy

If you order food:

• Your name and email address, and your password (stored only as a one-way hash).
• If you sign in with Google: your name, email address and profile picture from your Google account.
• Your orders, pickup codes and any reviews you leave.

If you list a restaurant:

• The business name, ABN, address, phone number and contact person’s name.
• The bank account we pay you into.
• The documents you upload for verification: your food safety certificate and the owner’s ID.
• The deals you list and the photos you upload.

From everyone who uses the site: your IP address and browser type when you sign in or use the site, which we keep in our server logs to run the service and protect it from misuse.

We never see or store your card details: payments are taken by Stripe, our payment provider.

• To run your account, take your orders and payments, and give the restaurant what it needs to have your order ready.
• To send you emails about your account and orders: verification, password resets, order confirmations and, for restaurants, new orders and payouts.
• To check restaurants before they can sell (their ABN, food safety certificate and ID), and to pay them.
• To keep the service secure, prevent fraud and fix problems.
• To meet our legal obligations, such as keeping financial records.

We don’t sell your personal information, and we don’t send marketing emails.

• The restaurant you order from sees your name and your order, so it can have it ready for you.
• Our service providers, who handle information on our behalf to run the service: Stripe (payments), Bird (sending email), Google (sign-in with Google), Cloudflare (website delivery and file storage), DigitalOcean (our servers), Neon (our database) and Axiom (server logs).
• Others when the law requires it, for example in response to a court order.

Our servers and database are in Sydney, Australia. Some of our providers store or process information overseas, mainly in the United States (Stripe, Bird, Google and Axiom), and Cloudflare serves the website from locations around the world. We use providers that protect information to a standard comparable to the Australian Privacy Principles.

We don’t use advertising or tracking cookies. The site keeps your sign-in and your chosen area in your browser’s local storage so you stay signed in. Google’s sign-in button and Stripe’s checkout page may set their own cookies when you use them.

• Information is encrypted in transit, and passwords are stored only as one-way hashes.
• Restaurant verification documents are private: only that restaurant and our admins can open them.
• We keep your information while your account is open. When it’s closed we delete it, except what we must keep by law — financial and tax records are kept for at least five years.

You can ask to see the personal information we hold about you, correct it, or close your account and have it deleted. Email [email protected]and we’ll respond within 30 days.

If you’re unhappy with how we’ve handled your information, please tell us first and we’ll try to put it right. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If we change this policy we’ll update the date at the top, and tell you by email if the change is significant.