Privacy & data choices

What we use

• Contact, order, address, and delivery instructions to provide your order.
• Optional precise location and chat to coordinate delivery.
• Delivery and PIN events to protect the handoff. PIN secrets are not included in exports.
• Named driver/staff accounts, audit records, payroll, inventory, rewards, and push endpoints for authorized operations.

Access and retention

Customers see only verified order data. Assigned drivers and named staff see only what their role requires. Financial and security records may be retained for up to seven years; authentication events for one year; closed sessions for 90 days; redacted platform logs for 30 days.

Export, deletion, and unsubscribe

Use a verified order number and checkout email to export your data or request deletion. Deletion removes local chat/location and push data, clears operational delivery fields, and anonymizes rewards while preserving financial and security records required for accountability. Browser notification settings can also revoke push permission at any time.

Backups and incidents

Environment-scoped backups inherit the same access and disposal rules. The store owner is the privacy lead, the administrator on duty is the security incident lead, and customer contact uses the store’s published support channel. Incidents are contained, access is revoked, evidence is preserved without secrets, affected data is assessed, required notices are issued, and recovery is documented and reviewed.