Privacy Policy

1. Who We Are

Easy Fuud ("we", "our", "the Platform") is an online food ordering platform. We act as a data controller in respect of personal data collected from platform users, and as a data processor in respect of personal data provided by restaurants about their customers.

This Privacy Policy applies to all users of the Easy Fuud platform (easyfuud.com) and is in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

2. What Information We Collect

Account information: When you register, we collect your name, email address, and phone number. Restaurant owners additionally provide business name, address, and billing details.

Order information: When you place an order, we collect your delivery address, order contents, and payment method preference. Full card details are processed exclusively by Stripe and are never transmitted to or stored by Easy Fuud.

Billing information: For restaurant subscriptions, we store your Stripe Customer ID and subscription status. Stripe holds and processes all payment card data under their own PCI-DSS compliant systems.

Usage data: We collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This data is used solely to maintain platform security and improve performance.

Support messages: If you email or WhatsApp our support team, we keep your message, your email address or phone number, and our reply. The text of the message is deleted after 90 days.

Cookies and browser storage: We use one sign-in cookie (httpOnly, Secure) and keep a short-lived sign-in token in your browser's local storage. We do not use advertising, analytics, or third-party tracking cookies.

3. Legal Basis for Processing

We process your personal data under the following legal bases as defined in Article 6 GDPR:

• Contract performance — to process orders and manage your account.
• Legal obligation — to comply with applicable tax, accounting, and consumer protection law, including retention of tax records.
• Legitimate interests — to maintain platform security, prevent fraud, and improve service quality.
• Consent — for any optional marketing communications (you may withdraw consent at any time).

4. How We Use Your Information

• To process and fulfil your food orders
• To send order confirmation and status updates
• To share necessary order details with the restaurant fulfilling your order
• To process and manage restaurant subscription billing
• To issue VAT-compliant invoices and receipts
• To maintain account security and prevent fraud
• To comply with our legal and regulatory obligations
• To improve the platform experience

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Data Sharing and Processors

Your order details (name, phone number, delivery address, and items ordered) are shared with the restaurant fulfilling your order. This is strictly necessary to complete your purchase. For that order data the restaurant is the data controller and Easy Fuud processes it on the restaurant's behalf, under a data processing agreement (Restaurant Data Processing Agreement).

We use the following processors. Each one only receives the data it needs for the job listed:

• Railway: hosting, database and cache. All platform data is stored on servers in the European Union.
• Stripe: card payments and restaurant subscription billing. Privacy policy: stripe.com/privacy.
• Ryft, Dojo or WiPay: card payments, when the restaurant you order from has chosen that provider. WiPay serves Caribbean restaurants and processes payments in Trinidad and Tobago.
• Resend: sends our emails (order confirmations, receipts, password resets, sign-in codes).
• Google (Gemini API): AI that helps draft replies to support messages and powers voice ordering and menu tools. Messages about billing, refunds or legal matters are always passed to a person instead.
• Microsoft 365: our support mailbox.
• Meta (WhatsApp Business): our WhatsApp support channel, when you contact us there.
• Cloudflare R2: storage for images such as menu photos and logos.
• Integrations a restaurant switches on: Xero (accounting), MobiPOS (till), and delivery marketplaces (DoorDash, Uber Eats, Grubhub). These only receive data for the restaurants that connect them.

We do not sell, rent, or share your personal data with anyone for their own marketing.

6. Customers and Restaurants Outside the EU

Easy Fuud serves restaurants and their customers outside the European Union, for example in the Caribbean. Wherever you are, your data is stored on our EU servers and protected to the GDPR standard.

Some data has to leave the EU to complete your order: your order goes to the restaurant in its own country, and your payment goes to the provider the restaurant uses (for example WiPay in Trinidad and Tobago). These transfers are necessary to perform the contract you asked for (Article 49(1)(b) and (c) GDPR) and are covered by the data protection terms in our agreement with the restaurant.

Some of our processors (such as Google, Resend and Meta) may process data in the United States. Where they do, the transfer is covered by the EU-U.S. Data Privacy Framework where the provider is certified, or otherwise by the European Commission's Standard Contractual Clauses.

If you live outside the EU, your local data protection law may also apply. The restaurant you order from is responsible for meeting it for its own customers.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to the following minimum retention periods required by law:

• Order records and VAT invoices: 6 years, as required by tax law.
• Your name, phone and address on orders: removed once the 6-year period ends. The amounts are kept.
• Account data: kept while your account is in use. Deleted straight away when you delete your account (see section 9). Accounts whose email was never confirmed and that never ordered are deleted after 30 days.
• Support messages: the text is deleted after 90 days. A record that a message was received and answered is kept.
• Server and security logs: IP addresses and browser details are removed after 90 days (180 days for security-incident records). The last sign-in address on an account is removed after 12 months without a sign-in.
• Data a restaurant imports from another platform: the original import file is deleted after 90 days.

8. Security

We implement industry-standard security measures to protect your personal data, including:

• HTTPS/TLS encryption for all data in transit
• Bcrypt-hashed passwords (never stored in plain text)
• Short-lived JWT access tokens (15 minutes) with rotating httpOnly refresh cookies
• Role-based access control limiting data access to authorised personnel
• Stripe PCI-DSS compliance for all payment card data

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant data protection authority within 72 hours and affected individuals without undue delay, in accordance with Articles 33–34 GDPR.

9. Your Rights Under GDPR

Under the GDPR and applicable data protection law, you have the following rights in relation to your personal data:

• Right of access — to obtain a copy of the personal data we hold about you.
• Right of rectification — to have inaccurate data corrected.
• Right to erasure — to have your data deleted where there is no overriding legal basis for its retention.
• Right to restrict processing — to limit how we use your data in certain circumstances.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to processing based on legitimate interests, including direct marketing.
• Rights related to automated decision-making — we do not make solely automated decisions with legal or significant effects on individuals.

Do it yourself: when signed in, go to Your data to download everything we hold about you or to delete your account.

For any other request, or if you don't have an account, email privacy@easyfuud.com. We will respond within one month of receiving a verified request, as required by Article 12 GDPR. If your request is about an order, we may pass it to the restaurant, which controls that order data.

If you are not satisfied with our response, you have the right to lodge a complaint with the data protection authority in your country.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 14 days before they take effect. The current version is always available at easyfuud.com/privacy.

11. Contact

For privacy-related enquiries or to exercise your data rights, contact our Data Protection contact at:

privacy@easyfuud.com