Privacy Policy

1. Introduction

Deally (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

2. Information We Collect

We collect information that you provide directly:

• Account information: Name, email address, restaurant name, phone number
• Payment information: Processed securely by Stripe; we do not store credit card numbers
• Menu and business data: Menu items, categories, pricing, images
• Customer data: Orders your customers place with you (name, contact details, delivery address, items, instructions), their rewards and gift-card activity at your restaurant, their complaints about your orders, and their marketing consent for your restaurant. Diners hold a single Deally guest account that works across every restaurant on the platform; Deally controls that account, and you see only the activity that relates to your restaurant. Our Guest Privacy Notice describes what we tell diners.

We also collect information automatically: IP address, browser type, device information, and usage analytics through Google Analytics 4 (see Cookies below).

3. How We Use Your Information

• Provide, maintain, and improve the Service
• Process payments and send transactional emails
• Power AI features (upselling, ordering agent) using your menu and order data
• Generate analytics and reports for restaurant owners
• Respond to support requests and communicate service updates
• Detect and prevent fraud or abuse

4. Data Sharing

We do not sell your personal information to third parties. We share data only with:

• Stripe: For payment processing (subject to Stripe's privacy policy)
• Firebase/Google Cloud: For infrastructure and data storage
• Cloudflare: For CDN, performance, and security
• Resend: For transactional email delivery
• Anthropic: For AI features. When you use the AI ordering chat, the messages you type, your current cart and, when you are signed in on the ordering site, a summary of your recent orders at that restaurant are sent to Anthropic to generate replies. Please don't type payment details into the chat. Restaurants using Deally's AI assistant in their dashboard may also have order details (customer name or email, items and special instructions) processed by Anthropic to answer their questions.
• Twilio: For SMS/text delivery (payment links and callbacks requested during phone orders where offered, and opt-in marketing texts)
• Google Analytics: For usage measurement on deal-ly.com, ordering pages and Deally-hosted restaurant websites, with advertising features turned off
• LiveKit and xAI: For AI phone ordering, only where a restaurant enables it; call audio and transcripts are processed to take the order

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties.

5. Multi-Tenant Data Isolation

Deally is a multi-tenant platform. Your business data (menus, orders, rewards programs, reports, team and billing) is isolated by restaurant: one restaurant owner cannot access another restaurant's data. Firestore security rules and server-side access controls enforce this isolation. Diner guest accounts are the one exception by design: a diner's account, sign-in and saved addresses are held once at the platform level so the same login works at every restaurant, but each restaurant sees only that diner's orders, rewards, complaints and consent for its own restaurant.

6. Data Retention

We retain your data for as long as your restaurant account is active. Orders, refunds and gift cards are your transaction records and are kept so you can meet your tax, accounting and dispute obligations; when a diner asks us to delete their account we anonymise their orders (name and contact details removed, amounts and items kept) rather than deleting the transaction. Marketing opt-out and unsubscribe records are kept so no one is ever re-mailed by mistake. When you close your restaurant account, we remove your access and delete or anonymise your data on request, except where we must keep it to comply with law, resolve disputes or enforce our agreements. Aggregate, anonymized analytics may be retained indefinitely.

7. Security

We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, Firebase Authentication, and role-based access controls. Payment data is handled by PCI-compliant Stripe infrastructure.

8. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. To exercise these rights, contact us at support@deal-ly.com from the email address on your account so we can verify the request. We respond to data requests within 45 days; if we need more time we will tell you why and may take up to 45 more days. Diners should use the rights section of the Guest Privacy Notice.

9. Cookies

We use essential browser storage for authentication and session management. We also use Google Analytics 4 on deal-ly.com, ordering pages and Deally-hosted restaurant websites; it sets first-party analytics cookies (for example _ga) to measure page views and usage. Google Analytics runs in Consent Mode with the advertising signals (ad storage, ad user data, ad personalization) denied by default, and we honour the Global Privacy Control signal by also denying analytics storage. We do not use third-party advertising cookies and do not sell or share data for cross-context behavioral advertising. We do not respond to browser Do Not Track headers.

10. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. SMS/Text Messaging

Restaurants on the Deally platform may send text messages to their customers: transactional messages (order-related texts where a restaurant has them enabled, and a secure payment link you ask for when a restaurant offers ordering over its phone line) and loyalty and promotional messages, which are sent only if you tick the optional, unchecked marketing checkbox for that restaurant — at account creation, at rewards signup, or on the account page of its ordering site. Your phone number and SMS consent are collected by Deally on behalf of the restaurant you order from, recorded separately for each restaurant together with the mobile number the consent was given for, and used solely to send you these messages. If you change that number, the consent no longer applies until you tick the box again.

• Message frequency varies. Message and data rates may apply.
• Reply STOP at any time to stop all texts from Deally's number — every restaurant, order-related texts included — or, to stop marketing from one restaurant only, turn that restaurant's preference off on the account page of its ordering site. Reply HELP for help.
• Mobile numbers and opt-in status are never sold or shared with third parties for their own marketing.
• See our SMS Messaging Terms for full program terms.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Your continued use after changes constitutes acceptance.

13. Contact

For questions about this Privacy Policy, contact us at support@deal-ly.com.