This policy covers everyone who uses ogmenu.com (the "Website"): Store Owners who register a restaurant, Staff who are invited to help run one, and Customers who place an Order by scanning a Location's QR code. Placing an Order does not require creating an account.
Store Owner & Staff Accounts
Store Data
Customer Order Data
All payments on the Website are processed by Stripe. When a Customer pays for an Order, their card details are entered directly on Stripe's own hosted checkout page - PISHYS SERV never receives, transmits, or stores full card numbers.
When a Store Owner connects payments, Stripe collects the business's identity, banking, and tax information directly through Stripe's own onboarding flow. We only ever store a Stripe account reference and its status (e.g. whether it can currently accept charges) - never bank account numbers or identity documents.
Stripe acts as an independent data controller for the payment information it collects. Their practices are described in Stripe's own privacy policy.
When a Store Owner or Manager invites someone to help run a Store, we collect the invited person's email address to send the invitation and, once accepted, to create or link their staff account to that Store. Staff and Managers can see the Store data relevant to their role (menu, locations, and/or orders) - Managers and Staff never see a Store's payment/Stripe details.
We use the information above to operate the ordering and payment flow (showing menus, taking Orders, routing payments and payouts), to send account, order, and staff-invitation emails, to keep the Website secure, to comply with legal obligations, and to improve the Website. We do not sell your personal information.
We share data only with the service providers necessary to run the Website:
We may also disclose information where required by law - see Legal Disclosure.
When you access the Website, our infrastructure (via CloudFront/AWS) automatically logs technical information such as IP address, approximate geographic location, browser type, and pages requested. We use this to operate and secure the Website, detect abuse, and diagnose issues - not to build advertising profiles.
We retain account and Store data for as long as the account exists. Order records are kept for the period needed for accounting, tax, and dispute-resolution purposes, even after an account is closed. You can close your account at any time - see Control Your Personal Data.
Passwords are hashed, not stored in plain text. Payment card data never touches our servers - it goes directly to Stripe. We use industry-standard measures to protect the data we do hold, but no method of transmission or storage is ever 100% secure, and we can't guarantee absolute security.
Our infrastructure runs on AWS in the United States. If you're located outside the United States, your information will be transferred to and processed in the United States, and possibly other countries where our service providers (including Stripe) operate.
Depending on your location, you may have the right to access, correct, delete, or export the personal data we hold about you, and to object to or restrict certain processing. Most of these can be exercised directly, without contacting us, via the Control Your Personal Data section below; for anything else, use the Contact page.
If you have a Store Owner or staff account, you can view and edit your personal data from the Account page, and permanently close your account (and delete your personal data) from the Close Account page.
Closing your account deletes your personal data from our database, subject to the retention needs described in Data Retention (e.g. order records tied to a Store you owned, kept for accounting purposes). We do not sell personal data, so there is no "opt-out of sale" feature to offer.
As a Customer, if you provided an email address at checkout, you can request deletion of that Order's contact details via the Contact page.
The Website is intended for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us via the Contact page and we will remove it.
We may disclose information we hold if required by law, legal process, or a government request, or if we believe in good faith it's necessary to protect our rights, prevent fraud, or protect the safety of our users or the public.
Pages on the Website may link to third-party sites (including Stripe's own hosted pages). We aren't responsible for the privacy practices of those sites - review their own policies before sharing information with them.
We may update this policy to reflect changes in our practices, technology, or legal requirements. When we do, we update the "Last Updated" date at the top of this page. Continued use of the Website after a change constitutes acceptance of the updated policy.
Questions about this policy or your data? Reach us via the Contact page.