Privacy Policy

Account information — name, email address, password (stored as a secure hash), business name, branch addresses, and role assignments for staff.

Operational data — menus, orders, inventory, expenses, recipes, table layouts, and analytics generated by using the platform. This data belongs to the restaurant.

Diner information — when a customer places an order, the restaurant collects details such as name, phone number, and delivery address. rextroX processes this data on the restaurant’s behalf to fulfil orders.

Payment information — card payments for subscriptions are processed by Paddle, our merchant of record. We never see or store full card numbers. For local payments we store only the transaction reference you submit.

Technical data — logs such as IP address, browser type, and request timing, used for security and troubleshooting.

We use information to operate the Service (process orders, sync kitchen displays, generate reports), to secure it (authentication, fraud and abuse prevention, rate limiting), to bill subscriptions, to provide support, and to send service communications such as payment reminders or important product changes. We do not sell personal information, and we do not use restaurant or diner data for third-party advertising.

The app uses browser local storage to keep you signed in (an authentication token) and to remember interface preferences such as theme. The public ordering pages use local storage for cart contents. We do not use third-party advertising or cross-site tracking cookies.

We share data only with service providers needed to run the platform:

Paddle — subscription checkout, billing, and tax compliance for card payments (acting as merchant of record).

Hosting and infrastructure providers — servers and databases where the Service runs.

Email delivery providers — transactional email such as password resets.

If a restaurant enables WhatsApp features, order messages are exchanged through WhatsApp and are also subject to WhatsApp’s own terms and privacy policy. We may disclose information where required by law or to protect the rights and safety of users and the platform.

We retain account and operational data while the account is active. After account termination we keep data for a reasonable wind-down period (at least 30 days) to allow export, then delete or anonymise it, except where longer retention is required for legal, tax, or accounting purposes. Restaurants can request export or deletion at any time via support.

We protect data using industry-standard measures: encrypted connections (HTTPS), hashed passwords, tenant-isolated data access, role-based permissions, signed webhook verification for billing events, and rate limiting. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you without undue delay.

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Restaurant owners can manage most account data in the dashboard directly. Diners should contact the restaurant they ordered from in the first instance; we will support restaurants in fulfilling such requests. You can also contact us at info@rextrox.com.

We may update this Privacy Policy from time to time. Material changes will be announced in the app or by email. The effective date at the top of this page shows when it was last revised.