Privacy Policy
Version 1 · Effective October 6, 2026
This Privacy Policy explains how CGS Tech Lab ("we", "us", "our") handles personal data in Food Drama: the website at fooddrama.io, the restaurant dashboard, the partner portal, the restaurant Storefronts we host, and the Food Drama staff app (together, the "Service").
1. Who is responsible for your data
How we are involved depends on who you are.
| You are | Who decides how your data is used | Our role |
|---|---|---|
| A restaurant owner, partner, or a restaurant's team member | Us | Controller. This policy applies in full. |
| A diner who orders, books, joins a table, or buys a gift card or voucher from a restaurant | The restaurant | Processor. We process your data for the restaurant, on its instructions. We act as an independent controller only to keep the Service secure, prevent fraud, meet legal obligations, and create anonymised statistics that identify no one. |
| A visitor to our website | Us | Controller for security logs and the cookies described in section 6. |
If you are a diner, the restaurant you ordered from is responsible for your data. Its privacy notice is linked at the bottom of its ordering page (at /online/store/ followed by the restaurant's address, then /privacy). That notice explains how the restaurant uses your data. This policy explains what we, as the platform, do with it and the tools you have to control it.
Contact: developer@fooddrama.io, CGS Tech Lab, 1st Floor, Sai Complex, Kaspate Wasti Road, Wakad, Pimpri-Chinchwad, Pune, Maharashtra 411057, India. Data protection contact: see section 12.
2. Data we collect
Restaurant owners, partners and team members
- Account details: name, email address, password (stored only as a one-way hash), preferred language, two-factor authentication settings, and the date you accepted our Terms and this policy (with the version, date, IP address and browser).
- Business details: restaurant name, address, phone, contact emails, legal entity details and opening hours, plus the menus, photos and settings you enter.
- Billing details: your plan, invoices, billing email and address, and payment status. Card details are collected and stored by our payment provider (Stripe). We keep only a reference and, where available, the card brand and last four digits.
- Team and access: invitations you send, the roles you assign, and which restaurants you can access.
- Activity records: important actions taken in the dashboard (for example, menu price changes, refunds or settings changes), with who made them, when, and from which IP address and browser.
- Staff app: a device identifier and device name (for example, "iPad / Kitchen") for each registered device, and a push notification token if you allow notifications.
- The app uses the camera only to scan QR codes, such as gift cards and vouchers. Camera images are not stored or sent to us.
- It uses Bluetooth and local network access only to find and print to receipt printers.
- We don't collect your location.
- Messages you send us: support emails and other messages, and what they contain.
Diners (processed for the restaurant)
- Orders: name, email, phone number, delivery address and delivery instructions, order contents, notes to the restaurant, payment status and the IP address the order was placed from.
- Reservations: name, phone, email, party size, date and time, and notes.
- Dine-in at a table: the name you enter, and optionally your phone, email, seat, and any dietary preferences or allergy notes you choose to share.
- Gift cards and deal vouchers: buyer and recipient names and emails, any gift message, and the card or voucher balance and history.
- Marketing choices: whether you opted in to marketing from the restaurant, the wording you agreed to, and when.
- Payments: these are handled by the restaurant's payment provider (such as Stripe or PayPal). We never receive or store full card numbers.
Data we get from others
- From a restaurant owner: if you're invited as a team member, the owner gives us your name, email and role.
- From a partner: a partner who manages a restaurant may set it up and invite its owner.
- From a restaurant: a restaurant may import its existing customer list. The restaurant is responsible for that data.
- From payment providers: Stripe and PayPal tell us whether a payment succeeded. We never receive full card numbers.
Everyone who visits
- Security and technical logs: IP address, browser type, the pages and API endpoints you request, and the time, used to keep the Service secure and to investigate faults or abuse.
- Spam protection: on some public forms (for example, signup and password reset), Cloudflare Turnstile checks that you are a person. It does this using information about your browser and device.
3. How we use data, and our legal bases
| Purpose | Legal basis (EU and UK GDPR) |
|---|---|
| Creating and running your account, providing the Service, sending service emails (verification, password reset, invoices, payment reminders, security alerts) | Performance of our contract with you |
| Billing, tax and accounting records | Legal obligation |
| Keeping the Service secure, preventing fraud and abuse, recording who changed what | Our legitimate interests in a safe, reliable service |
| Telling you about changes to our Terms or this policy | Contract and legal obligation |
| Product announcements in the staff app | Legitimate interests. You can switch these notifications off in the app. |
| Processing diner data: taking orders and bookings, sending order and booking emails, dine-in, gift cards and vouchers | On the restaurant's instructions. The restaurant's legal basis applies. |
| Diners' allergy and dietary notes | The restaurant's basis: your explicit consent, given when you choose to enter them. Deleted 24 hours after your table session closes. |
Where we rely on consent, you can withdraw it as easily as you gave it. Withdrawing doesn't affect processing that already took place.
To use Food Drama, you must give us your name, email and a payment method. Without them we can't provide the Service.
We don't make decisions about you based solely on automated processing.
We do not sell personal data or show advertising. We do not use personal data to train AI models. We may use anonymised, aggregated data that identifies no person or restaurant to improve and promote the Service.
4. Who we share data with
We share data only with the providers we need to run the Service ("sub-processors"), with the restaurant where you are a diner, and with others where the law requires it.
| Provider | What for | Data involved |
|---|---|---|
| DigitalOcean, Amsterdam (Netherlands, EU) | Servers, database and backups | All data in the Service |
| DigitalOcean Spaces, Amsterdam (Netherlands, EU) | Storing images and files | Menu photos, logos, uploaded files |
| VayVix | Sending emails | Recipient name and email, email content |
| Stripe | Restaurant subscriptions (and diner payments, where the restaurant uses Stripe) | Billing details and payment data |
| PayPal | Diner payments, where the restaurant uses PayPal | Payment data |
| Google (Maps Platform) | Address search and delivery maps | Address you type, your IP address |
| OpenStreetMap (Nominatim) | Postcode and address lookup | Postcode or address you type, your IP address |
| Google (Firebase Cloud Messaging) | Push notifications to the staff app | Device push token, notification content |
| Cloudflare (Turnstile) | Spam protection on public forms | Browser and device signals, IP address |
| Twilio (if SMS alerts are enabled) | SMS alerts to restaurant staff | Staff phone number, message content |
| Apple, Google (Wallet) | Adding a deal voucher to a phone wallet, if you choose to | Voucher details |
We also share data in these cases:
- With restaurants: diners' data goes to the restaurant they ordered from, booked with or joined.
- With partners: if you are a restaurant owner whose restaurant is managed by a partner, that partner can see your restaurant's data in the partner portal.
- When required by law: with authorities, courts or advisers where the law requires it, or to protect our rights or someone's safety.
- Business transfers: with a buyer or successor if our business is merged or sold. They would be bound by this policy.
5. International transfers
We are based in India. Our servers, database and file storage are hosted by DigitalOcean in Amsterdam, the Netherlands (EU). Our providers may process data in other countries, including the United States. Where data protection law requires it, we use safeguards for these transfers: the European Commission's Standard Contractual Clauses for the EU, and the UK International Data Transfer Agreement or UK Addendum for the UK.
6. Cookies and similar technologies
We only use cookies that are needed for the Service to work. We don't use advertising or third-party analytics cookies, so we don't ask for cookie consent.
| Name | Purpose | Lasts |
|---|---|---|
| token, refresh_token | Keep you signed in (restaurant dashboard, partner portal, admin) | Until you sign out or the session expires |
| active_restaurant | Remember which restaurant you're working in | Your session |
| dine_in_guest | Link you to your table when you join with a QR code | The table session |
We also save a few preferences in your browser's local storage, such as language, display settings and whether you dismissed a notice. These never leave your device.
Google Maps (on address forms) and Cloudflare Turnstile (on some public forms) are loaded from their providers when you use those features, and may set their own cookies under their own privacy policies.
On payment pages (checkout and subscription billing), Stripe and PayPal load their own scripts and set cookies to process the payment and prevent fraud. These are strictly necessary for the payment you asked to make, so no consent is needed. They are governed by Stripe's and PayPal's own privacy policies.
7. How long we keep data
We keep data only as long as we need it. These are our standard periods. For diner data, the restaurant can change some of them in its settings.
| Data | Kept for |
|---|---|
| Your account and business details | While your account is open. Deleted when you delete your account. |
| Invoices and billing records | As long as tax and accounting law requires |
| Diners' personal details on orders | 12 months after the diner's last order, unless the restaurant sets otherwise |
| Sales records (items, amounts, tax), with no diner details | 6 years by default, or as tax law requires |
| IP address an order was placed from | 90 days |
| Diner profiles with no orders | 6 months |
| Dine-in guest details | 7 days after the table session closes |
| Dine-in allergy and dietary notes | 24 hours after the table session closes |
| Security and request logs | 12 months |
| Records of important actions | 24 months |
| Email delivery logs (who an email was sent to, not its content) | 90 days |
| Records of who accepted which version of our Terms | While your account is open |
When a diner's personal details are deleted, the sale record remains, labelled "Deleted customer", because tax law requires the restaurant to keep it.
8. How we protect data
- All connections to the Service are encrypted (HTTPS).
- Passwords are stored as one-way hashes.
- Payment-provider credentials and two-factor secrets are encrypted.
- Two-factor authentication is available for all accounts.
- Restaurants can only access their own data, and team members only what their role allows.
- Important actions are logged.
- Links in diner emails (for example, "download my data") use encrypted, expiring tokens.
No system is perfectly secure. If a breach affects your data, we notify the affected restaurant without undue delay, and the relevant authorities (the UK ICO or an EU data protection authority) and affected people as the law requires.
9. Your rights
Depending on where you live (including under the EU and UK GDPR), you may have the right to:
- access your data and get a copy;
- correct inaccurate data;
- have your data deleted;
- object to or restrict some uses;
- take your data to another provider;
- withdraw consent at any time (this doesn't affect processing that already took place);
- nominate someone to exercise your rights if you die or can't act yourself, where the law provides for this;
- complain to a data protection authority.
Restaurant owners, partners and team members:
- Download your data: go to Your profile → Your data & account → Download my data.
- Delete your account: go to Your profile → Your data & account → Delete my account. If you own a live restaurant, you'll need to transfer ownership or close the restaurant first.
- Anything else: email developer@fooddrama.io.
Diners:
- Download or delete your data: use the Download my data and Delete my data links in your order emails. These work without an account.
- Stop marketing: use the Unsubscribe link in any marketing email. Marketing is sent by the restaurant, which is responsible for your consent under laws such as the UK's PECR and the EU ePrivacy rules.
- Anything else: contact the restaurant, which is responsible for your data, or email us and we'll pass your request to it.
We respond within one month, or sooner where the law requires.
10. Children
The Service is for businesses. Business account holders must be 18 or over. Team members must be at least 16, or the legal working age where they work, whichever is higher. We don't knowingly collect data from children for our own purposes. A restaurant's Storefront may be used by younger diners under the restaurant's own policy.
11. Changes to this policy
We may update this policy. Each version is numbered and dated at the top of this page. If we make a significant change, we'll tell you by email and in your dashboard before it takes effect.
12. Contact and complaints
Email developer@fooddrama.io or write to CGS Tech Lab, 1st Floor, Sai Complex, Kaspate Wasti Road, Wakad, Pimpri-Chinchwad, Pune, Maharashtra 411057, India.
Data protection contact: Sonu Singh, developer@fooddrama.io, at the address above.
We acknowledge requests and complaints within 72 hours and respond within one month.
If you're not satisfied with our response, you can complain to your local data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EU it is the data protection authority of the country where you live or work.