Privacy policy

Snactr Inc. (“snactr,” “we,” “us” or “our”) is a Canadian corporation based in Ontario that provides a multi-tenant online ordering platform for restaurants. This Privacy Policy (the “Policy”) explains how we collect, use, disclose and protect personal information when you use our websites, the ordering pages we host for restaurants, our restaurant dashboard, the snactr Orders app, and any other service that links to this Policy (together, the “Services”).

In this Policy:

• “Restaurant” means a business that uses the Services to take orders and reservations from its guests;
• “Customer” means a person who places an order or requests a reservation with a Restaurant through the Services;
• “Staff” means the owners, managers and employees of a Restaurant who sign in to the dashboard or the snactr Orders app;
• “Ordering Page” means a Restaurant's ordering website, on a snactr address or the Restaurant's own domain;
• “snactr Orders app” means our iOS and Android app that runs on a Restaurant's in-store tablet.

We handle personal information in accordance with Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, substantially similar provincial laws such as Alberta's Personal Information Protection Act and British Columbia's Personal Information Protection Act. Commercial electronic messages are governed by Canada's Anti-Spam Legislation (CASL).

• On behalf of Restaurants. When a Customer orders from or books with a Restaurant, the Restaurant decides how that information is used and is responsible for it. snactr processes it as the Restaurant's service provider, on the Restaurant's instructions, to operate the Services.
• For our own purposes. snactr is responsible for personal information it handles for its own purposes, such as Staff accounts, Restaurant billing, security, fraud prevention and enquiries made to us.

If you are not sure who is responsible for something, contact us (Section 18) and we will answer or direct your request to the right Restaurant.

We use personal information only for the following purposes:

1. to process, fulfil, deliver and track orders and reservations;
2. to send order and reservation confirmations, receipts and status updates by email and text message;
3. to enable Restaurants to manage their orders, refunds and customer records;
4. to administer Staff accounts, authenticate users and alert in-store tablets to new orders;
5. to bill Restaurants for the Services;
6. to secure the Services, prevent fraud and abuse, and maintain an audit record of account changes;
7. to respond to enquiries and support requests;
8. to comply with legal, tax and accounting obligations and to establish or defend legal claims; and
9. for any other purpose with your consent or as permitted or required by law.

We do not sell or rent personal information, and we do not use it for advertising or for profiling.

• Transactional messages. Order and reservation messages are part of the service you request and are sent without separate consent.
• Marketing messages. Consent to marketing is optional and is given only by ticking the consent box at checkout, which records your express consent under CASL. A Restaurant may send you marketing only if you gave that consent, and you can withdraw it at any time using the unsubscribe link we provide.
• Text messages. Replying STOP to any text message from snactr stops all text messages from our number, including order updates from every Restaurant using the Services. Message and data rates may apply.
• Withdrawing consent. You may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawal does not affect messages needed to complete an order already placed.

We disclose personal information only as follows:

• To the Restaurant you order from or book with, to prepare and fulfil your order or reservation and to provide customer service and refunds.
• To service providers that perform services for us, in these categories: payment processing, cloud hosting and storage, content delivery and security, email delivery, text message delivery, mapping and address verification, courier dispatch, and push notification delivery. They may use personal information only to provide their services to us and are bound by contractual obligations to protect it.
• To couriers, for courier-delivered orders: the Customer's name, telephone number, delivery address and delivery instructions, so the order can be delivered.
• In a business transaction, such as a merger, acquisition, financing or sale of assets, to the parties involved, subject to confidentiality obligations and to the protections in this Policy.
• Where required or permitted by law, including to comply with a subpoena, warrant or court order, or to protect the rights, property or safety of our users, the public or snactr.
• With your consent, in any other case.

Payments are processed by our third-party payment processor on its secure checkout page and are paid directly to the Restaurant. snactr never receives or stores full payment card numbers. The payment processor handles card information under its own privacy policy.

We use only technologies that are necessary for the Services to work: a session cookie that keeps Staff signed in, and storage in your browser that remembers your selected Restaurant location and, on your own device, your contact details for your next order. We do not use analytics, advertising or third-party tracking cookies, and we do not use pixels or similar tools to track you across other websites.

Our servers are located in the United States, and some of our service providers process personal information in the United States or other countries. Personal information held outside Canada is subject to the laws of that jurisdiction and may be accessed by its courts, law enforcement and national security authorities. We protect personal information through contractual and organizational measures wherever it is processed.

We keep personal information only as long as necessary for the purposes set out in this Policy, including to meet legal, tax and accounting requirements. Order, payment and refund records are kept for as long as the Restaurant uses the Services and for the period required by applicable tax law afterwards. Staff accounts are kept while access is in place, and sign-in sessions expire automatically. Records of marketing consent are kept as proof of consent. When personal information is no longer required, we securely delete or anonymize it.

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, encrypted connections to our database, password hashing, and access controls limiting each user to the Restaurant and locations they are authorized for. Staff can end every active session from their account, and a password change ends all existing sessions. No method of transmission or storage is completely secure.

If a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada and other regulators as required by law, and we keep a record of every such breach.

Subject to applicable law, you may:

• request access to the personal information we hold about you and information about how it has been used and disclosed;
• request correction of inaccurate or incomplete information;
• withdraw your consent, as described in Section 6; and
• request deletion of personal information we are not required to keep.

To make a request, contact us (Section 18). We may ask you to verify your identity before acting on a request, and we respond within 30 days. Where we process your information on behalf of a Restaurant, we may refer your request to that Restaurant. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

The snactr Orders app is used by Restaurant Staff on in-store tablets to receive and manage orders. In addition to Staff account information, the app processes a device name chosen by the Restaurant, the device platform and app version, when the device was last connected, and a push notification token used to alert the store's devices to new orders. The app does not access your location, camera, microphone, photos or contacts, and contains no advertising or analytics. Signing out, or removal of the device by an authorized Staff member, ends the device's session.

The Services are not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, please contact us and we will delete it.

This Policy is available in alternative formats on request, consistent with the Accessibility for Ontarians with Disabilities Act. Please contact us if you need an accessible format or communication support.

We may update this Policy from time to time. We will post the updated version on this page with a new “Last updated” date and, if the changes are material, notify Restaurants by email or in the dashboard before they take effect.

Our Privacy Officer is responsible for our compliance with this Policy. Questions, requests and complaints may be sent to:

Privacy Officer, Snactr Inc.
[email protected]