Privacy Policy

1. Who this policy covers

A website "Find Your Setup" / restaurant-intake path is a separate marketing lead workflow from account signup. Submitting it may create an inquiry record but does not establish a paid subscription, customer tenant, or operating account.

This Policy describes personal information handled through DineStack's website, restaurant onboarding, administrator applications, POS and driver applications, support operations, and any activated receipt links. DineStack provides software to restaurant customers. The restaurant usually determines why its staff, guest, order, transaction, and menu information is collected and used; DineStack ordinarily processes that information to provide the contracted service. For DineStack's own website visitors, leads, subscriber contacts, service operations, and subscription billing, the Company determines its own uses of information. Additional legal rights vary by jurisdiction.

2. Categories of information

Depending on enabled features and actual use, information may include: submitted restaurant-fit/intake answers (business type, location count, POS setup, hardware needs, requested contact time, stated concerns, and lead source), lead status and consent evidence; restaurant and business contacts; owner and staff names; work email, telephone number, and invitation/verification status; credentials, role assignments, sign-in logs and audit events; restaurant locations and business configuration; menus, product photographs and uploaded files; customer names/contact information when supplied by a restaurant; order, refund, tender and receipt records; register, device, network, printer and driver-app identifiers; device diagnostics, security events and synchronization logs; support correspondence; and subscription identifiers, invoices and payment status.

Sensitive employee identifiers. If a restaurant's owner chooses to record them, DineStack stores two sensitive identifiers for a team member: a U.S. Social Security number (or ITIN) and a date of birth. They are kept in a separate protected store, and each value is encrypted with its own key, which is itself protected by a key held in Microsoft Azure Key Vault; if that protection is unavailable, nothing is stored. Once saved, the full value is never shown again by DineStack: the restaurant sees only that a value is on file and, for a Social Security number or ITIN, its last four digits. Only users holding the permission to manage sensitive identity — by default, the restaurant's owner — can see that status or replace a value, and replacing one requires them to verify their identity again. These identifiers are not included in order or payment records, receipts, registers, kitchen screens or exports, and the audit trail records that a value was replaced, not the value.

Owner telephone number at signup. The person who signs a restaurant up gives a US or Canadian telephone number. DineStack uses it only to reach that person about onboarding and their account; it is visible to DineStack staff who help restaurants with onboarding and account questions. Giving it is not consent to marketing calls or text messages, and DineStack does not use it for either.

Help-center requests. A request sent with the support form on the DineStack help center holds the contact details and message the person enters and a record of how DineStack handled it.

We do not intend to ask restaurants to transmit full card numbers or CVVs to DineStack's own support channels.

Device location. DineStack does not collect or store the location of a phone or tablet, and clocking in or out does not read a device's location. Where a restaurant has enabled card acceptance at the door (Tap to Pay) on a business phone that the restaurant's owner has approved for taking payments, the DineStack Driver app asks for the phone's approximate (coarse) location, at the moment a driver starts a card payment, because the payment provider's software (Stripe Terminal) requires it on Android for fraud prevention and compliance. The Driver app never asks for precise (GPS) or background location. That approximate location is used by Stripe's software under Stripe's own terms and privacy notice; DineStack's apps do not send it to DineStack, and DineStack does not store it. On a restaurant register that uses a Bluetooth card reader, Android may also ask for location permission because Stripe's software requires it to find and connect to the reader; DineStack does not store that location either. Card acceptance at the door is not yet available in DineStack.

3. How we obtain information

We may receive information directly from restaurant account administrators, their workforce, visitors who contact us, service devices, and approved providers such as authentication, SMS verification, cloud-hosting and payment services. Restaurants may upload photographs or import menus. If local/offline modes are used, order and operational data may temporarily reside on authorized devices and later synchronize when a connection is available. Public receipt links, if activated, may be accessible to a person holding the receipt token; restaurants should avoid putting highly sensitive data into receipt content.

4. Purposes of use

Website lead intake information may be used to respond to a requested inquiry, assess product fit and route a prospect to self-service signup or human follow-up; optional marketing messages require the lawful consent and unsubscribe controls applicable to the channel.

Subject to the contract and product configuration, the Company uses information to establish and secure business accounts; authenticate staff; deliver, maintain and synchronize services; process restaurant instructions; provide receipts and reporting; monitor reliability and prevent abuse; respond to support and security incidents; administer subscription billing; meet legal obligations; and maintain appropriate business records.

The Company does not acquire ownership of restaurant data by hosting it.

5. How we share information

Information may be disclosed to authorized staff of the relevant restaurant, approved support personnel subject to access controls, technical vendors that provide cloud infrastructure or messaging, and payment providers as necessary for enabled features.

The service providers DineStack uses are:

Microsoft Azure: cloud hosting, databases, file storage and key management for the DineStack service.

Microsoft Azure Communication Services: transactional email: email address verification, password reset and staff invitations, sent from send.dinestack.app.

Google and Microsoft: sign-in, when a person chooses to sign in to DineStack with a Google or Microsoft account. We receive the account identity those providers return; we do not receive the account password.

Twilio: SMS verification codes, where phone verification is used.

Stripe: card payment processing for restaurants that enable it, under Stripe's own agreement with the restaurant, and billing of DineStack's own subscription fees where enabled.

Information may also be disclosed to comply with valid legal process, protect security or rights, or in a lawful merger/acquisition subject to required protections. We do not represent that no sharing ever occurs.

6. Stripe and payment information

For restaurant in-person card transactions where enabled, the restaurant connects to an eligible Stripe account and enters Stripe's own legal relationship. Stripe may independently collect identity, financial and transaction details, and Stripe's privacy notice applies. DineStack may receive transaction status, identifiers and reconciliation data required to support the restaurant. Separate Stripe Billing processing may be used to charge DineStack's subscription fees. Where card acceptance at the door is used, the approximate phone location described in section 2 is used by Stripe's software, not by DineStack.

For DineStack's own subscription, the card is entered on Stripe's hosted checkout page and held by Stripe. DineStack receives the subscription's status, Stripe's customer, subscription and invoice identifiers, the billing email and name, and whether each payment succeeded or failed; it does not receive the card number.

7. Security

The Company intends to apply administrative, technical and organizational measures appropriate to data sensitivity, including role-based access, protected transport, restricted support access, incident response and service-provider review. No system is guaranteed immune from compromise.

Restaurants must protect their own devices, Wi-Fi networks, printer access, PINs and employee permissions.

8. Retention and deletion

We retain personal information for as long as reasonably necessary for the described purposes, agreed contractual obligations, disputes, accounting, security, and legal retention requirements.

Self-service export of restaurant data is not currently available, and we do not promise an automated export. A restaurant's authorized owner may request an export or deletion of the restaurant's data by email to info@dinestack.app sent from the account owner's email address. We verify the requester's identity and authority before acting, and we provide an export in a commonly used, machine-readable format within a reasonable time and in any case within any period required by applicable law. Legal holds, security requirements and records required to be kept may limit deletion. Individual employees or guests ordinarily should first direct restaurant-record requests to the relevant restaurant, which controls that data.

9. Choices and individual rights

Depending on applicable law, individuals may have rights to receive information, access, correct, delete, or restrict certain uses of personal data, and to challenge a refusal or submit a complaint. Send requests to info@dinestack.app, identifying the business/account relationship but avoiding sending sensitive identity documents unless securely requested. We may verify identity and route restaurant-controlled requests to the appropriate restaurant. Marketing communications, where used, must include applicable unsubscribe choices; essential transaction and security notices may still be sent.

10. Children

DineStack is a business operations service and is not intentionally directed to children under 13. Restaurants should limit the collection of minors' information and comply with applicable law when serving customers or employing eligible minors.

11. International operations

Services may be used in approved U.S. and Canadian markets and may involve service providers or processing outside a user's province or state.

This Policy does not claim blanket compliance with every global privacy regime.

12. Cookies and tracking

Strictly necessary session/authentication technologies may be used.

This website does not use analytics cookies or advertising cookies, and does not load third-party analytics, advertising or tracking tags.

13. Updates and contact

Material changes will be indicated by a revised effective date and additional notice where required. Privacy inquiries: info@dinestack.app, subject "Privacy Request." Legal entity: LEAP RIDE, INC.

Contact address: 967 Little Britain Rd, Suite 300, New Windsor, NY 12553, United States.