Privacy Policy

This policy explains how PayperPlates handles personal information across the whole platform — restaurant storefronts, the admin console, the driver portal and app, and payperplates.ca itself.

Our role changes depending on whose information it is:

Diner information

We act as a service provider to the restaurant you ordered from. The restaurant decides why your information is collected; we process it on their behalf under contract, and we also handle it as our own where we need to run the platform (fraud prevention, security, support).

Restaurant & staff information

We act on our own behalf. We decide what account, billing, and usage information we need to provide the service to a restaurant.

Driver information

We act on our own behalf for platform accounts and shift records, and as a service provider to the restaurant that dispatches you.

We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial legislation. Where a restaurant has its own privacy policy, that policy also applies to your dealings with them.

Everyone with an account

• Name, phone number, and email address.
• A password, or a phone number verified by SMS one-time passcode. We store password hashes, never passwords.
• Account preferences and notification settings.

Diners

• Delivery addresses and delivery instructions, and the geographic coordinates we derive from them to calculate fees and routing.
• Order history — items, modifiers, notes to the kitchen, totals, tips, timestamps, and status.
• Payment information: a payment token, card brand, last four digits, and the authorisation result. We never receive or store full card numbers.
• Messages you exchange with the menu assistant, where a restaurant has enabled it.
• Push notification subscriptions, if you opt in.

Restaurant owners and staff

• Business details: legal and trading name, address, phone, hours, tax registration, and banking details for payouts (held by Stripe).
• Staff accounts, roles, and permissions, and an audit record of administrative actions.
• Console usage: which sections are used and for how long, so we can improve the product and support you.
• Merchant Assistant conversations, and — only with the opt-in in section 8 — the order and customer data used to answer them.

Drivers

• Licence and insurance details you provide, and vehicle information.
• Shift records: when you go on and off duty, deliveries accepted and completed, and distance travelled.
• Device location while you are on an active shift only. Collection starts when you go on duty and stops when you go off duty.
• Contact events with diners and restaurants logged through the app, and cash and change amounts you record.

Collected automatically

• IP address, browser and device type, operating system, referring page, and pages viewed.
• Server and security logs, including rate-limit and bot-protection signals.
• Cookies and similar technologies — see section 11.

• To fulfil orders — sending the order to the kitchen, calculating fees and taxes, processing payment, dispatching a driver or courier, and providing tracking.
• To communicate — order confirmations and status updates by SMS, email, and push, and support replies.
• To operate accounts — authentication, role and permission enforcement, and administrative audit trails.
• To take payment and to handle refunds, chargebacks, and disputes.
• To prevent fraud and abuse — payment risk scoring, rate limiting, bot detection, and investigating misuse.
• To provide AI features — subject to the limits and opt-in in section 8.
• To improve the platform — diagnosing faults, measuring performance, and understanding which features are used.
• To market, only with consent — promotional messages from us or from a restaurant you have ordered from, which you can stop at any time.
• To meet legal obligations — tax and accounting records, and responding to lawful requests.

We do not sell personal information, and we do not use diners’ personal information to market to them on our own behalf.

We rely on your consent to collect, use, and disclose personal information, and we aim for that consent to be meaningful — you should know what you are agreeing to before you agree.

• Implied consent covers what is obviously necessary to complete an order you placed.
• Express consent is required for marketing messages, push notifications, driver location collection, and a restaurant’s opt-in to AI processing of ordering data.
• You can withdraw consent at any time, subject to legal and contractual limits. Withdrawing consent for something essential to a service means we can no longer provide that service.

We disclose personal information in these circumstances only:

• To the restaurant you ordered from — your name, contact details, order, and delivery address, so they can prepare and deliver it.
• To the driver or courier handling your delivery — the delivery address, your first name and phone number, and the order, for that delivery only.
• To service providers that run parts of the platform for us, listed in section 7. They may only use the information to provide their service to us.
• Where the law requires it — a valid court order, subpoena, or lawful request from an authority; or to establish, exercise, or defend a legal claim.
• To protect people — where disclosure is reasonably necessary to prevent serious harm, fraud, or a threat to safety.
• In a business transaction — if PayperPlates is involved in a merger, acquisition, or sale of assets, personal information may transfer to the successor, who remains bound by this policy. You will be notified of any change in ownership.

These are the third parties that process personal information on our behalf. We keep this list current; check back for changes.

The platform includes two AI assistants. Both are powered by DeepSeek, an AI provider that operates outside Canada. What reaches it depends on which assistant is in use and, for the merchant one, on the restaurant’s opt-in.

Merchant Assistant — restaurants must opt in for ordering data

When a restaurant has opted in, the following may be sent:

• Order records — numbers, statuses, items, totals, and timestamps.
• Aggregate sales and revenue figures.
• Customer names, email addresses, and phone numbers, where a staff member with customer-data permission asks a question that requires them.

Menu assistant — diners

Where a restaurant enables the storefront assistant, the messages you type and the restaurant’s menu are sent to the provider to generate a reply. Your name, address, payment details, and past order history are not sent.

Limits that apply to both

• We use the provider’s API. We do not enable any option that would allow your data to be used to train the provider’s models, and our agreement restricts use to providing the service to us.
• We do not use AI to make decisions with a legal or similarly significant effect on anyone. The Merchant Assistant cannot change menus, prices, hours, or availability without a human confirming the change.
• Conversations are stored on our infrastructure so you can revisit them, and are retained per section 10.
• Do not enter payment card numbers, government identifiers, or health information into any assistant.

Product documentation is indexed for search using OpenAI embeddings. That index contains our own documentation only — no customer, order, or restaurant data.

Platform data is stored in the United States, in AWS US East (N. Virginia). Several of our service providers also operate in the United States or globally, as shown in section 7.

This means your personal information is subject to the laws of those countries, and may be accessible to their courts, law enforcement, and national security authorities under their legal processes. This is true whether or not you are located in Canada.

We use contractual protections with each provider requiring a comparable level of protection to what applies here, and we limit each provider to the information it needs. We remain accountable for personal information we transfer to a provider for processing.

When a restaurant closes its account, it has 30 days to export its data before deletion begins. We may keep information longer where needed to resolve a dispute, enforce our agreements, or comply with the law.

Necessary

Session and authentication cookies, tenant routing, cart contents, security and anti-abuse tokens, and your theme preference. These cannot be turned off without breaking the site.

Analytics and advertising

Individual restaurants may enable Google Analytics or Google Ads measurement on their own storefront. Where enabled, those services set their own cookies and receive usage events and advertising identifiers. You can opt out using Google’s opt-out add-on or your browser and device advertising settings.

We do not use third-party advertising cookies on payperplates.ca itself. Most browsers let you block or delete cookies; blocking necessary cookies will prevent sign-in and checkout from working.

• Encryption in transit (TLS) everywhere, and encryption at rest for stored data.
• Database row-level security so one restaurant’s data cannot be read from another’s session, enforced at the data layer rather than only in application code.
• Role-based access control, with financial and customer-contact data restricted to senior roles, plus manager-PIN confirmation for destructive actions.
• Phone-verified authentication, session management, and rate limiting and bot protection on sensitive endpoints.
• Card data handled only by our PCI DSS Level 1 processor and never stored by us.
• Audit logging of administrative and cross-tenant support actions.

No system is perfectly secure. If we discover a breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and keep records of breaches as required.

To report a vulnerability, write to security@payperplates.ca. We will not pursue good-faith researchers who follow responsible disclosure.

You may:

• Access the personal information we hold about you, and be told how it has been used and to whom it has been disclosed.
• Correct information that is inaccurate or incomplete.
• Delete your account and information, subject to records we must retain (see section 10).
• Withdraw consent for marketing, push notifications, or — for restaurants — AI processing of ordering data.
• Receive a copy of the information you gave us in a portable format.
• Complain about how we have handled your information.

Much of this is self-serve in your account settings. For anything else, write to privacy@payperplates.ca. We respond within 30 days. We may need to verify your identity first, and we will tell you if we need an extension and why.

If your request concerns an order, we may need to direct part of it to the restaurant, since the information is theirs. We will tell you when that happens and help you reach them.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or to your provincial privacy regulator.

The platform is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact privacy@payperplates.ca and we will delete it.

We may update this policy. When a change is material we post the revised version here with a new effective date and notify account holders by email or in-app before it takes effect.

Our Privacy Officer is responsible for our compliance and can be reached at:

Privacy Officer

privacy@payperplates.ca

Security reports

security@payperplates.ca

General support

payperplates.ca/support

Mail

PayperPlates, Ontario, Canada — write to the Privacy Officer for our current mailing address.