Privacy Policy

Stack.Kitchen has two distinct privacy relationships:

• Stackhouse Group ↔ Restaurant Operator (you, our paying Customer): covered by this Policy. We're the data controller for your account, billing, and support data.
• Restaurant Operator ↔ Diner: NOT covered by this Policy. When your diners place orders, contact info goes into your tenant database — you're the data controller for that, and you must have your own privacy notice for your diners. We act only as a data processor on your behalf, per Section 7 below.

• Account info: name, email, phone, restaurant name, restaurant address, country, billing currency, subdomain choice
• Authentication: bcrypt-hashed PINs (we never store plain-text PINs)
• Billing data: Paystack subscription code, payment method tokens (we never see card numbers — Paystack handles those), billing history, currency, plan tier
• Usage telemetry: orders processed, feature adoption (anonymous, aggregate), error logs (which may incidentally contain personal data needed to diagnose issues — kept for 30 days)
• Support communications: emails, chat messages, screenshots you send us

• Service delivery: provisioning your tenant, processing your subscription, sending transactional emails (welcome, payment received, payment failed, suspension, reinstatement)
• Billing: charging your monthly subscription via Paystack, retrying failed payments, issuing receipts
• Support: responding to your inquiries, investigating reported bugs
• Improvement: aggregate, anonymous analysis to understand which features work and where the platform needs improvement
• Legal compliance: meeting tax, regulatory, and law-enforcement obligations

We do not sell your personal data to third parties. We do not use your data for advertising. We do not train AI models on your tenant's data.

We share data only with these processors, each contractually bound to comparable privacy standards:

• Paystack (billing) — payment processing, subscription management. Paystack Privacy
• Railway (hosting + database) — application hosting, Postgres database. Railway Privacy
• Cloudflare (CDN + DNS) — edge caching, DNS management, DDoS protection. Cloudflare Privacy
• Resend (transactional email) — sending welcome, billing, and notification emails. Resend Privacy
• Google Maps (geocoding) — converting customer addresses to coordinates for delivery zone validation. Google Privacy

Stackhouse Group is based in Nigeria. Some of our sub-processors operate globally and may store or process data outside Nigeria — including in the United States, European Union, and other jurisdictions. By using the Platform, you consent to these transfers. Where required (e.g., for EU-based Customers under GDPR), we rely on Standard Contractual Clauses with our sub-processors.

• Account data: retained while your subscription is active and for 30 days after cancellation, then permanently deleted unless legal retention obligations require longer
• Billing records: retained for 7 years for tax-compliance purposes
• Error logs: 30 days
• Support communications: 2 years
• Tenant database (your restaurant's data): retained while your subscription is active. On cancellation, you have 30 days to export, after which we may permanently delete

When your diners place orders or interact with the Platform, the personal data they provide (name, phone, address, order history, loyalty info) is stored in your tenant database, controlled by you. We process this data on your behalf as a Data Processor.

Your responsibilities as Data Controller:

• Have your own privacy notice for diners — covering what you collect, why, and how long you retain it
• Respond to diner data subject requests (access, deletion, portability) — the Platform provides export/delete tools to support this
• Notify diners of any breach affecting their data
• Comply with applicable data protection laws in your jurisdiction (NDPR for Nigeria, GDPR for EU, CCPA for California, etc.)

By signing up to the Platform, you acknowledge this allocation of responsibilities and agree to act as Data Controller for your tenant's data.

We use industry-standard practices: HTTPS everywhere, bcrypt for password/PIN hashing, encrypted database connections (where the underlying provider supports it), least-privilege access for our internal team, and immutable backup snapshots. We're a small team — we know security through systems, not theatre.

If you discover a security vulnerability, please email [email protected]. We commit to acknowledging within 48 hours and to not taking legal action against good-faith researchers who follow responsible disclosure.

Depending on your jurisdiction, you may have rights to:

• Access: request a copy of the personal data we hold about you
• Correction: ask us to correct inaccurate or incomplete data
• Deletion: ask us to delete your data, subject to legal retention obligations (especially billing records)
• Portability: receive your data in a structured, machine-readable format
• Objection: object to certain processing activities
• Withdraw consent: where processing is based on consent, withdraw it any time

To exercise any of these, email [email protected]. We'll respond within 30 days.

If you're not satisfied with our response, you have the right to lodge a complaint with a data protection authority — the Nigerian Data Protection Bureau (NDPB) for Nigerian Customers, your local data protection authority for EU Customers, etc.

The Platform uses cookies and browser local storage for:

• Essential: session authentication, cart persistence, preference storage. The Platform won't function without these.
• Analytics (anonymous): understanding feature adoption — aggregated, no individual identification

We don't use third-party advertising cookies. We don't fingerprint browsers. The Platform is designed to work without consent banners under most jurisdictions because we only use essential cookies — but if your local law requires a banner, that's your responsibility as the Data Controller for your diners.

Stack.Kitchen is a B2B Platform for restaurant operators. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we'll delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be notified by email at least 30 days before they take effect. Non-material changes (typo fixes, new sub-processor additions) take effect immediately.

For privacy-related questions:

• General: [email protected]
• Security: [email protected]
• Legal: [email protected]

Stackhouse Group is the data controller. The legal entity address is available on request.