Privacy Policy

This Privacy Policy applies to:

• Restaurant Partners (businesses using Restorant to manage their restaurant).
• Customers (individuals placing orders through the platform).
• Visitors to our website and marketplace.

Information you provide directly:

• Account information: name, email address, phone number, business name.
• Profile data: restaurant logo, brand colours, operating hours, menu content.
• Order data: delivery address, order items, special instructions.
• Payment information: card details processed by Paystack (we do not store full card details).
• Communications: messages submitted through our contact form or support channels.

Information collected automatically:

• Log data: IP addresses, browser type, pages visited, referring URLs.
• Device information: device type, operating system, unique device identifiers.
• Usage data: features used, time spent on pages, click patterns.
• Cookies and similar tracking technologies (see Section 7).

Information from third parties:

• Payment information from Paystack (transaction status, reference numbers).
• Authentication data from Supabase Auth.

We use your information to:

• Create and manage your account.
• Process orders and facilitate payments.
• Provide customer support.
• Send transactional notifications (order confirmations, delivery updates).
• Send SMS and WhatsApp notifications where you have opted in.
• Improve our platform through analytics and product research.
• Comply with legal obligations.
• Detect and prevent fraud or misuse of the platform.
• Send you marketing communications where you have consented.

Our legal basis for processing under the NDPA includes: performance of a contract, legitimate interests (platform improvement and fraud prevention), legal obligation, and your consent where indicated.

We share your data with:

• Paystack: payment processing for all transactions.
• Supabase: database and authentication infrastructure.
• Termii: SMS and WhatsApp notification delivery.
• Vercel / Hostinger: web hosting and deployment.
• Anthropic: AI features (menu assistance, business chat). Note: data sent to Anthropic is used only to fulfil your request and is not used to train their models under their API terms.

We require all third-party service providers to implement appropriate security measures and process your data only as instructed by us.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

We may disclose your data to law enforcement or regulatory authorities where required by Nigerian law or court order.

Restaurant Partners: customer data (names, emails, phone numbers, order history) you access through Restorant remains the property of those customers. You must use it only to fulfil orders and must not use it for unsolicited marketing without the customer's consent.

We retain your personal data for as long as your account is active or as needed to provide our services. If you close your account, we will retain transaction records for 7 years as required by Nigerian financial and tax regulations.

You may request deletion of personal data that is not required for legal compliance by contacting us at hello@restorant.com.

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest.
• Row-level security policies on all database tables.
• Access controls and principle of least privilege for our team.
• Regular security reviews and dependency updates.

No system is 100% secure. In the event of a data breach affecting your personal data, we will notify you as required by the NDPA and cooperate with the Nigeria Data Protection Commission (NDPC).

We use cookies and similar technologies to maintain your session, remember your preferences, and analyse platform usage.

• Essential cookies: Required for authentication and session management. Cannot be disabled.
• Analytics cookies: Help us understand how users navigate the platform. You may opt out via your browser settings.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from logging in or using certain features.

Under the Nigeria Data Protection Act 2023, you have the right to:

• Access: request a copy of personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data (subject to legal retention requirements).
• Restriction: request that we restrict processing of your data.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdrawal of consent: withdraw consent for marketing communications at any time.

To exercise any of these rights, contact us at hello@restorant.com. We will respond within 30 days.

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. Your continued use of our Services after changes are posted constitutes acceptance of the updated policy.

For privacy-related queries or to exercise your rights, contact our Data Protection Officer: