Privacy Policy

The restaurant you place an order with is the controller of your order data — it decides why the data is used (to accept and fulfil your order). TODO — your registered company name, which operates Tilaus, processes that data on the restaurant’s behalf to run the ordering service.

For questions about your data, contact TODO — privacy@yourdomain.example.

• Your name, phone number, and email address.
• Your delivery address, when you choose delivery.
• Your order details (items, options, any notes) and its totals.
• Payment status. Card payments are handled by Stripe — we do not receive or store your full card number.

We use this data to take, confirm, and fulfil your order, to send you an order confirmation, and to let the restaurant contact you about your order. The legal basis is performance of a contract — the order you place — and, where applicable, our legitimate interest in running the service securely and complying with the law (for example, keeping records for tax purposes).

Your order data is shared with the restaurant fulfilling your order. We also use a small number of trusted service providers who process data only on our instructions:

• Stripe — Card payment processing.
• Resend — Sending order-confirmation and notification emails.
• Supabase — Database and file hosting for menus and orders.
• Vercel — Application hosting and delivery.

We do not sell your personal data or use it for advertising.

Order records are kept for as long as needed to fulfil the order, handle any follow-up (such as refunds or complaints), and meet legal and accounting obligations. After that they are deleted or anonymised.

Under data-protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data, where the law allows;
• object to or restrict certain processing;
• receive your data in a portable format;
• complain to your local data-protection authority if you believe your rights have been breached.

To exercise any of these, email TODO — privacy@yourdomain.example. We respond within the time the law requires (normally one month).

We use your browser’s local storage to remember the items in your cart while you order. This stays on your device and is not used for tracking or advertising. We use only the cookies needed to run the service (such as keeping restaurant staff signed in to their dashboard).

We may update this policy from time to time. The current version, with its “last updated” date, always applies.

TODO — your registered company name
TODO — your registered business address
TODO — privacy@yourdomain.example