Privacy Policy

This Privacy Policy applies to:

• Restaurant Partners: businesses using Restorant to manage their restaurant, and their staff, managers, and owners.
• Customers: individuals placing orders through the platform, on restorant.com.ng or on any restaurant's storefront.
• Riders: individuals delivering orders for a Restaurant Partner using Restorant's delivery tools.
• Visitors: anyone browsing our website, marketplace, or a restaurant storefront without an account.

Restorant is a multi-tenant platform: many independent restaurant businesses each run their own branded storefront on our infrastructure. It's important to understand who is doing what with your data:

• The restaurant is the business you're buying from.When you order food, create a loyalty account, or contact support through a restaurant's storefront, that restaurant decides how your order and customer data is used for its own business, for example contacting you about your order or running its own promotions to its customers.
• Restorant is the platform that provides the technology: the storefront, checkout, payments, SMS/email delivery, and dashboard, and processes your data on the restaurant's behalf to make that possible.
• Restorant also acts in its own rightfor platform-wide purposes that aren't restaurant-specific: keeping the platform secure, preventing fraud across all restaurants, operating the restorant.com.ng marketplace, measuring how our own advertising performs, and improving the platform itself.

If you have a question about how a specific order or your customer relationship with a restaurant is handled, the restaurant is usually best placed to answer it first. If your question is about the platform itself, or you can't reach the restaurant, contact us using the details in Section 12.

Information you provide directly:

• Account information: name, email address, phone number.
• Order information: items ordered, delivery or pickup address, special instructions, order history.
• Loyalty, coupons, and referrals: points balance, referral codes used or shared, wallet credit balance.
• Reviews: ratings and comments you choose to leave about an order or menu item.
• Restaurant Partner information: business name, logo and brand assets, menu content, operating hours, bank/settlement details for payouts.
• Rider and staff information: name, phone number, email, role, and, for riders, vehicle and identification details required to deliver orders.
• Communications: messages submitted through our contact form, live chat, or support channels.

Information collected automatically:

• Log data: IP address, browser type, pages visited, referring URLs.
• Device information: device type, operating system, unique device identifiers.
• Usage data: features used, time spent on pages, click and scroll patterns.
• Rider location:if you are a rider, we collect your device's GPS location while you are online and available for deliveries, not only during an active delivery, so restaurants and customers can see delivery progress and dispatch orders to nearby riders. Location tracking stops as soon as you go offline in the rider app.
• Cookies and similar tracking technologies (see Section 8).

Information from third parties:

• Paystack: payment status, transaction references, and settlement information. We do not receive or store your full card number, expiry date, or CVV: Paystack handles card data directly and we only ever see a transaction reference and status.
• Termii: delivery status of SMS messages (e.g. your one-time login code).
• Supabase: authentication session data.

We use your information to:

• Create and manage your account, including passwordless phone (OTP) login for customers.
• Process orders, calculate pricing, and facilitate payment through Paystack.
• Coordinate delivery, including assigning and tracking riders in real time while they are on duty.
• Operate loyalty, coupon, referral, and wallet-credit features you or a restaurant enable.
• Provide customer support and respond to reviews or complaints.
• Send transactional notifications (order confirmations, delivery updates, OTP codes) by SMS (Termii) and email (Resend).
• Send WhatsApp notifications where a Restaurant Partner has enabled them and you have opted in.
• Improve our platform through analytics and product research.
• Measure and improve the performance of our own advertising, and, where a restaurant has enabled it, the restaurant's own advertising (see Section 5, Meta/Facebook Pixel).
• Comply with legal obligations, including Nigerian tax and financial record-keeping requirements.
• Detect and prevent fraud or misuse of the platform.
• Send you marketing communications where you have consented.

Our legal basis for processing under the NDPA includes: performance of a contract (placing and fulfilling your order), legitimate interests (platform security, fraud prevention, and improving our service), legal obligation (tax and financial records), and your consent where indicated (marketing communications, analytics and advertising cookies).

We share data with the following service providers, each acting on our instructions to help run the platform:

• Paystack: payment processing for all transactions. Paystack is a licensed payment service provider and handles your card details directly; we never see or store them.
• Supabase: database, file storage, and authentication infrastructure.
• Termii: SMS and WhatsApp message delivery, including OTP login codes and order notifications.
• Resend: transactional email delivery (order confirmations, welcome emails, receipts, staff invitations).
• Vercel / Hostinger: web hosting and deployment.
• Anthropic: AI features (menu assistance, business chat, customer chat). Data sent to Anthropic is used only to fulfil your request and is not used to train their models under their API terms.
• Meta (Facebook/Instagram): where advertising pixel tracking is active (see below), we share behavioural data: pages viewed, items viewed or added to cart, checkout started, and completed purchases (order value and currency, not your name, address, or payment details), with Meta for advertising measurement and targeting. This only happens if you have accepted analytics/advertising cookies (Section 8).

Meta/Facebook Pixel: how it's scoped:

• On restorant.com.ng itself, only Restorant's own pixel is active, and only on our public marketing pages (home, about, pricing, contact, login, signup, terms, privacy). It is never active on a restaurant's storefront.
• On a restaurant's storefront, only that restaurant's own pixel is active, if the restaurant has chosen to add one in its dashboard settings. Restorant's own pixel never runs there, and a restaurant's pixel data is never shared with Restorant, Meta on behalf of another restaurant, or any other restaurant on the platform.
• If a restaurant has not set a pixel, no advertising pixel runs on its storefront at all.

We require all third-party service providers to implement appropriate security measures and process your data only as instructed by us. We do not sell, rent, or trade your personal data to third parties for marketing purposes.

We may disclose your data to law enforcement or regulatory authorities where required by Nigerian law or court order.

Restaurant Partners:customer data (names, emails, phone numbers, order history) you access through Restorant remains the personal data of those customers. You must use it only to fulfil orders and provide customer service, and must not use it for unsolicited marketing without the customer's consent.

We retain your personal data for as long as your account is active or as needed to provide our services. If you close your account, we will retain transaction records for 7 years as required by Nigerian financial and tax regulations.

Rider location data is retained only as long as needed for delivery coordination, dispute resolution, and safety records, and is not kept indefinitely once a rider goes offline.

You may request deletion of personal data that is not required for legal compliance by contacting us at hello@restorant.com.ng.

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest.
• Row-level security policies on all database tables, scoped so one restaurant can never see another restaurant's data.
• Access controls and principle of least privilege for our team.
• Regular security reviews and dependency updates.

No system is 100% secure. In the event of a data breach affecting your personal data, we will notify you as required by the NDPA and cooperate with the Nigeria Data Protection Commission (NDPC).

We use cookies and similar technologies to maintain your session, remember your preferences, and (only with your consent) analyse usage and measure advertising.

• Essential cookies: required for login, checkout, and session management. These cannot be disabled and don't require consent, because the service can't function without them.
• Analytics and advertising cookies (Google Analytics, and the Meta/Facebook Pixel described in Section 5): opt-in only. These do not load at all until you accept cookies in the banner shown on your first visit. If you decline, or make no choice, none of these run.

Your choice is remembered on this device. If you accept and later change your mind, clear your browser's local storage for this site, or contact us to have your device-level consent reset.

Under the Nigeria Data Protection Act 2023, you have the right to:

• Access: request a copy of personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data (subject to legal retention requirements).
• Restriction: request that we restrict processing of your data.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdrawal of consent: withdraw consent for marketing communications, analytics, or advertising cookies at any time.

To exercise any of these rights, contact us at hello@restorant.com.ng. We will respond within 30 days. If your request concerns an order or your relationship with a specific restaurant, we may direct part of your request to that restaurant where it is better placed to act on it.

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. Your continued use of our Services after changes are posted constitutes acceptance of the updated policy.

For privacy-related queries or to exercise your rights, contact our Data Protection Officer: