Guest Privacy Notice

1. Who this notice covers

Deally (“Deally,” “we,” “us”) runs the online-ordering technology that restaurants use to take orders on their own websites and on ordering pages we host at order.deal-ly.com. This Guest Privacy Notice (“Notice”) explains what personal information we collect from guests (“you”) who browse a menu, place an order, create a guest account, join a rewards program, buy or receive a gift card, use the AI ordering assistant, or contact a restaurant about an order through Deally.

The restaurant you order from is the seller. It prepares your food, charges your card through its own payment account, and decides how to handle refunds and complaints. Deally provides the ordering site, the guest account, payment technology, email and text delivery, and rewards tools on the restaurant's behalf. Both Deally and the restaurant receive information about your order; section 5 explains what each party does with it. Each restaurant is independently responsible for how it uses the information it receives, and may publish its own privacy policy.

Your guest account is a single Deally account. The same sign-in, saved addresses and order history work at every restaurant that uses Deally, so you do not have to create a new account for each restaurant. Deally controls the account itself; each restaurant sees only the orders, rewards activity and complaints that relate to that restaurant. The terms that apply when you place an order are in our Guest Terms of Sale.

2. Notice at collection (summary)

This table is the summary that California law (the CCPA, as amended by the CPRA) requires us to give you at or before the point where we collect your information. The categories use the names in the California statute. Full detail follows in the sections below. We do not sell your personal information and do not share it for cross-context behavioral advertising.

3. Information we collect and where it comes from

Information you give us.

• Account details: name, email address, phone number and a password; or, if you sign in with Google or Apple, the name, email address and profile photo those services share with us. Creating an account is optional for most orders; you can check out as a guest.
• Order details: the items you order, options and quantities, special instructions and allergy notes you type, order type (pickup, delivery or dine-in), pickup or delivery time, tip, and the name, phone number, email address and delivery address you enter at checkout.
• Saved addresses and preferences: delivery addresses you save to your account, your default order type, and an optional birthday (month and day only; we never ask for the year).
• Payment details: entered directly into payment fields provided by Stripe. Deally receives only a Stripe customer ID, the card brand and last four digits, and the payment result. If you choose to save a card, Stripe stores it on the restaurant's own Stripe account for your future orders at that restaurant.
• Rewards and referrals: if you join a restaurant's rewards program, your points balance, reward redemptions, tier, referral code and the referrals you make.
• Gift cards: when you buy a gift card, your name and email as the purchaser and, if you send it to someone else, the recipient's name, email address and your personal message. When someone sends you a gift card, we receive your name and email from them.
• Complaints: the text of a complaint you submit about an order and up to three photos you attach.
• AI ordering assistant: the messages you type into the ordering chat. Please do not type payment card details into the chat.
• Marketing choices: your “email offers” setting for each restaurant whose rewards program you are in, whether you ticked the optional marketing-text box for a particular restaurant (when, and on which page), and any unsubscribe you make.

Information collected automatically.

• Sign-in and cart data on your device: Firebase Authentication keeps you signed in using browser storage, and your cart is kept in your browser's local storage so it survives a page refresh. See section 11.
• Usage data: through Google Analytics 4, the pages and menu items you view, cart and checkout events, browser and device type, and the approximate location derived from your IP address. Advertising features are turned off (see section 11).
• Security data: a one-way hashed form of your IP address, used only to count requests over a short window so that shared cart links and forms cannot be abused. The hash cannot be turned back into your address.
• Server logs: our hosting providers (Google Cloud and Cloudflare) record standard request logs, including IP address and user agent, for security and troubleshooting.

Information we receive from others.

• The restaurant: order status updates, refunds, responses to your complaints, rewards it grants you, and gift cards it issues to you from its dashboard.
• Stripe: payment confirmations, refund results and saved-card metadata.
• Google or Apple: your basic profile when you choose to sign in with them.
• Email and text providers: delivery, bounce, complaint and unsubscribe events from Resend (email) and Twilio (text), so we can stop sending to addresses and numbers that bounce or opt out.
• Other guests: a person who buys you a gift card gives us your name and email.

4. How we use your information

We use the information above to:

• show you the restaurant's menu and let you build and place an order;
• pass your order to the restaurant and take payment on its behalf;
• send transactional emails about your order (confirmation, status changes, schedule changes, refunds, complaint responses and gift-card receipts) and, during a phone order, a payment link or callback you ask for by text;
• run your guest account: sign-in, saved addresses, order history and reorder;
• run the restaurant's rewards, referral and gift-card programs that you take part in;
• generate replies from the AI ordering assistant (section 6);
• send a restaurant's rewards and promotional emails to members of its rewards program who have not turned them off, and marketing texts only to guests who opted in to that restaurant's texts (section 12);
• produce sales and menu reports for the restaurant and aggregate statistics for Deally;
• keep the service secure, limit abuse, and detect and prevent fraud;
• respond to your questions and privacy requests; and
• comply with law, enforce our terms and protect our rights and those of restaurants and other guests.

We do not use your information to build advertising profiles, and we do not make decisions about you using automated processing that has legal or similarly significant effects.

5. How restaurants use your information

When you order, the restaurant receives everything it needs to serve you: your name, phone number, email address, delivery address, the items and options you ordered, your special instructions, tip and totals, and the payment result. The restaurant also sees your activity in its own rewards program, gift cards bought at or sent through it, complaints about its orders, and your marketing preferences for that restaurant. Restaurant staff see this in their Deally dashboard and in their own Stripe account.

The restaurant uses this information to prepare and deliver your order, contact you about it, handle refunds and complaints, keep its own sales and tax records, and, if you opted in, send you its offers. Deally's agreement with each restaurant limits it to using Deally's tools for lawful purposes, but each restaurant is independently responsible for how it handles the information it receives, including any use outside Deally. A restaurant may also ask Deally's AI assistant in its dashboard questions about its orders; in that case order details (customer name or email, items and special instructions) may be processed by Anthropic to answer the restaurant's question.

A restaurant never sees your orders at other restaurants, your saved cards for other restaurants, or your rewards balances elsewhere.

6. AI ordering assistant

Some restaurants offer an AI ordering assistant in chat. When you use it, the messages you type, your current cart and, when you are signed in on the ordering site, a summary of your recent orders at that restaurant (the items and quantities, not your name or contact details) are sent to Anthropic, our AI provider, to generate replies and to add items to your cart. The restaurant's menu and ordering rules are sent with them.

The assistant can only build your cart. It cannot see or take payment, so please do not type card numbers or other payment details into the chat. The assistant can make mistakes about menu details; always review your cart before you pay.

7. AI phone ordering (when a restaurant enables it)

Deally offers restaurants an AI assistant that answers their phone line and takes orders. This feature is not yet in use on the live Deally platform. When a restaurant turns it on, calls to that restaurant's number are answered by the assistant and you will hear a notice at the start of the call.

During such a call we collect the number you call from, the audio of the call, a transcript, the outcome, and any order you place. The audio and transcript are processed by:

• Twilio, which connects the telephone call and sends any payment link you ask for by text;
• LiveKit, which carries the real-time audio between the phone network and the assistant; and
• xAI, whose speech model listens and responds during the call.

The restaurant can review transcripts in its dashboard. Transcripts are deleted automatically after the restaurant's retention period, which is 30 days unless the restaurant sets a different period. If you would rather not speak with an AI assistant, you can order online or ask to be transferred to staff where the restaurant offers it.

8. Who we share information with

We share personal information only as described here.

• The restaurant you order from — as described in section 5.
• Gift-card recipients and senders — the recipient sees the sender's name and message; the sender sees the recipient's name and email they entered.
• Service providers that process information under contract for us and may use it only to provide their service:
  • Google Cloud / Firebase — hosting, authentication, database, server functions and file storage;
  • Stripe — payment processing and saved cards, on the restaurant's Stripe account. Stripe also acts independently as a payment processor under its own privacy policy;
  • Resend — email delivery and marketing-email list management;
  • Twilio — text messages and, where enabled, phone calls;
  • Anthropic — the AI ordering assistant and the restaurant dashboard assistant;
  • Google Analytics — usage measurement (advertising features off);
  • Cloudflare — DNS, content delivery and security in front of restaurant websites and ordering pages; and
  • LiveKit and xAI — AI phone ordering, only where a restaurant enables it.
• Legal and safety — when required by law, subpoena or court order, or when reasonably necessary to investigate fraud, abuse or security incidents, or to protect the rights and safety of Deally, restaurants or guests.
• Business transfers — if Deally is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction, subject to this Notice.

We do not share your information with data brokers or with other restaurants on the platform.

9. We do not sell or share your information for advertising

Deally does not sell personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined in California law. We have not done so in the preceding 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. Google Analytics runs with its advertising features (ad storage, ad user data and ad personalization) turned off, and Google Signals is disabled on our Google Analytics property, so no analytics data is used to build advertising audiences.

Because we do not sell or share personal information, we do not offer a “Do Not Sell or Share” link. We still honour the Global Privacy Control signal as described in section 11.

10. Sensitive personal information

The only sensitive personal information we collect is your account password (stored only in hashed form by Firebase Authentication; Deally cannot read it) and, where you choose to include them, allergy notes, dietary or religious preferences in your order instructions or chat messages. We use this information only to sign you in and to pass your instructions to the restaurant so it can prepare your order. We do not use or disclose sensitive personal information for any purpose that would give you a right to limit its use under California law, and we do not infer characteristics about you from it.

11. Cookies, analytics and Global Privacy Control

Strictly necessary storage. The ordering site uses browser storage (not advertising cookies) to keep you signed in through Firebase Authentication and to keep your cart between pages. The contact form on deal-ly.com uses Cloudflare Turnstile to block automated submissions. None of this can be turned off without breaking ordering.

Analytics. We use Google Analytics 4 on deal-ly.com, on order.deal-ly.com and on restaurant websites that Deally hosts. It sets first-party cookies (for example _ga) to recognise the same browser across visits and records the pages and menu items you view, cart and checkout events, device and browser type and approximate location from your IP address. We configure Google Analytics in Consent Mode with the advertising signals (ad storage, ad user data, ad personalization) denied by default; analytics storage is granted unless you send the Global Privacy Control signal. Google acts as our processor for this data. You can also block Google Analytics with Google's browser add-on or any cookie-blocking browser setting.

Global Privacy Control (GPC). If your browser or extension sends the GPC signal, we treat it as a request to opt out: analytics storage is set to denied as well, so Google Analytics does not set or read its cookies in that browser. GPC works per browser, so you will need to enable it on each browser you use. The signal does not affect the strictly necessary storage above, and it does not stop transactional emails about your orders.

Do Not Track. There is no industry standard for responding to browser “Do Not Track” headers, and we do not respond to them. GPC is the signal we honour.

12. Email and text messages

Transactional messages. We always send order confirmations and refund confirmations by email. Order status and schedule updates, complaint responses and gift-card receipts are also sent by email where they apply, unless the restaurant has turned a particular update off. If you ask for a payment link or a callback during a phone order, we send it by text. You cannot unsubscribe from transactional messages while you keep ordering, but we send no more than the order needs.

Promotional email. When you join a restaurant's rewards program, or earn points on an order at a restaurant whose rewards program is on, that restaurant may send you rewards news, offers, birthday rewards and campaigns by email through Deally once your email address is confirmed (accounts that sign in with Google or Apple count as confirmed), until you turn them off. You can turn a restaurant's email offers off (or back on) at any time with the “Email offers” switches on the account page of its ordering site, and every promotional email carries a one-click unsubscribe link and header. Unsubscribing stops promotional email from that restaurant; you can also ask us to stop all promotional email from every restaurant on Deally, and we keep a suppression record so you are never re-added. Guests who are not in a restaurant's rewards program do not receive its promotional email. Deally may itself run email campaigns on a restaurant's behalf; they go only to that restaurant's rewards members who have not opted out.

Promotional texts. Marketing texts are sent only to guests who tick an optional, unchecked box for a particular restaurant, as explained on our SMS Opt-In & Consent page. Consent is recorded for that restaurant and the number you gave it for, and is never a condition of purchase. Message frequency varies; message and data rates may apply. Reply STOP to stop all texts from Deally's number (every restaurant, payment links and callbacks included) or turn off a single restaurant's texts on the account page of its ordering site. Reply HELP for help. Mobile numbers and opt-in status are never shared with third parties or affiliates for their marketing.

Your marketing choices for each restaurant are shown on the account page of that restaurant's ordering site, where you can change them at any time.

13. How long we keep information

We keep personal information for as long as needed for the purposes in this Notice, then delete or anonymise it. In particular:

• Account and profile (name, contact details, saved addresses, preferences, birthday): kept while your account is open. When you ask us to delete your account we delete the account, its profile and your sign-in credentials.
• Orders, refunds and gift cards: these are the restaurant's transaction records, needed for its tax, accounting and dispute obligations. When you delete your account we anonymise them: your name, email, phone and delivery address are removed from each order and gift card, while the items, amounts, taxes and times remain under an anonymous reference.
• Rewards, referrals and gift-card balances: deleted with your account. Unused points and rewards are forfeited; a gift card you received keeps its balance but is no longer linked to you.
• Complaints and photos: deleted with your account.
• Saved payment cards and Stripe customer records on each restaurant's Stripe account: deleted with your account. Stripe keeps the underlying payment transactions under its own retention rules and legal obligations.
• Marketing email lists: your contact is removed from Resend when you delete your account. Unsubscribe and opt-out records are kept so that we never email or text you again by mistake; they contain only a hashed email address, the address itself, and the date.
• AI chat messages: held in your browser for the current chat session and sent to our servers only to generate each reply; Deally does not store the conversation in its database. Anthropic processes the messages under its API data policies, which do not use them to train its models.
• Phone-order transcripts: deleted after the restaurant's retention period (30 days by default).
• Analytics data: kept according to the data-retention setting of our Google Analytics property; aggregate statistics that no longer identify anyone may be kept indefinitely.
• Logs and security data: hosting logs expire on the short cycles set by our providers; hashed rate-limit counters cover a one-minute window and cannot be linked back to you.

We may keep information longer where the law requires it or where we need it to resolve a dispute or enforce our terms.

14. Your privacy rights

Depending on where you live, you may have the right to:

• Know and access the personal information we hold about you, including the categories, sources, purposes and recipients, and receive a copy in a portable format;
• Correct inaccurate information (you can edit your name, phone, addresses and birthday on your account page at any time);
• Delete your personal information, subject to the exceptions described in section 13;
• Opt out of the sale or sharing of personal information and of targeted advertising — we do none of these, and we honour Global Privacy Control;
• Limit the use of sensitive personal information — we already use it only to provide the service;
• Not be discriminated against for exercising these rights. We will never deny you service, charge a different price or provide a different level of service because you made a privacy request; and
• Appeal a decision we make on your request, where your state's law provides for it (for example Virginia, Colorado, Connecticut, Texas and Oregon).

How to make a request. Email support@deal-ly.com from the email address on your account, or use the “Delete my account” link on the account page of any restaurant's ordering site, which opens a pre-filled email to us. Tell us which right you are exercising. We will confirm receipt within 10 business days and respond within 45 days; if we need more time we will tell you why and may take up to 45 more days.

Verification. Because requests reach us by email, we verify your identity by confirming the request from the email address on your account (or, for guest checkouts, the email address used on the order). If we cannot match the request to an account or order, we will ask for enough information to do so, and we will not use that information for any other purpose. We will not delete or disclose information until we are reasonably sure the request comes from you.

Authorized agents. You may use an authorized agent to make a request for you. We will ask the agent for proof of your written permission (or a power of attorney) and may ask you to confirm the request directly with us.

Appeals. If we decline all or part of your request and your state gives you a right to appeal, reply to our decision at the same email address within the time your state allows. A different person will review the appeal and we will respond in writing with the reasons. If we still decline, we will tell you how to contact your state attorney general.

Requests to the restaurant. Because the restaurant holds its own copy of your order information in its systems, you may also need to contact the restaurant directly to exercise rights over information it keeps outside Deally. We will forward deletion requests that relate to a specific restaurant to that restaurant where we can.

Shine the Light. California residents may ask once a year whether we have disclosed personal information to third parties for their own direct marketing. We do not do so.

15. Children

Deally ordering sites are not directed to children under 13, and you must be at least 13 to create a guest account. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us at support@deal-ly.com and we will delete it. We do not sell or share the personal information of anyone, including guests under 16.

16. Security

We protect personal information with encryption in transit (TLS) and at rest, Firebase Authentication with hashed passwords, per-restaurant access rules enforced in our database and on our servers, signed links for shared carts and unsubscribe pages, rate limits, and restricted administrator access. Card data is handled by Stripe, a PCI DSS Level 1 service provider, and never passes through Deally's servers. No system is perfectly secure; if we learn of a breach affecting your information we will notify you and the relevant authorities as the law requires.

17. Changes to this notice

We will update this Notice when our practices change. The date at the top shows when it was last revised. For material changes we will post a notice on the ordering site or email account holders before the change takes effect. We review this Notice at least once every 12 months.

18. Contact us

Questions about this Notice or about your information: email support@deal-ly.com.

Questions about a specific order, refund or the food itself should go to the restaurant; its phone number is on its ordering page and in your confirmation email. Related documents: Guest Terms of Sale · Accessibility Statement · SMS Opt-In & Consent · for restaurants, the Privacy Policy and Terms of Service.