Privacy Policy

1. Introduction

This Privacy Policy explains how Spiceup-Lite collects, uses, and shares ("processes") personal information in connection with the Spiceup-Lite restaurant ordering platform ("Restaurant Services"). It also explains your privacy rights.

Spiceup-Lite provides software that lets restaurants ("Restaurant Partners") run their own branded ordering website, covering delivery, pickup, and table reservations.

As used here, "personal information" means information relating to an identified or identifiable individual — for example, your name, address, email, phone number, or order history.

2. Scope

This Privacy Policy covers:

• Guests — when you place an order or make a reservation through a Restaurant Partner's Spiceup-Lite-powered page, we process your contact and transactional information.
• Restaurant Partners — individuals who own, operate, or manage a restaurant using Spiceup-Lite.

This Privacy Policy does not cover our processing as a data processor on behalf of a Restaurant Partner. When you place an order, the Restaurant Partner is the party responsible for deciding how your data is used to fulfil that order — Spiceup-Lite processes it only on their instructions, under a data processing agreement between us and the Restaurant Partner. Restaurant Partners are independent businesses with their own policies; if you have questions about how a specific restaurant handles your data, contact that restaurant directly using the details on their ordering page.

3. Who Is Responsible

Spiceup-Lite, operating under registered details in Portugal, is responsible for the processing described in this Privacy Policy. For inquiries, you can reach out via email at privacy@orderpad.app.

4. What We Process

Depending on whether you are a Guest or a Restaurant Partner, we may process:

• Contact information: name, email, phone number, delivery address
• Order information: items ordered, order value, payment method used, delivery or pickup preference, reservation details
• Restaurant Partner account info: business name, login credentials, dashboard configuration (menu, delivery zones, pricing rules)
• Support information: messages sent to us requesting help
• Technical information: IP address, device/browser type, cookie identifiers

5. Why We Process It

We process personal information to:

• provide the ordering, reservation, and dashboard functionality of the Restaurant Services;
• generate aggregated, anonymized analytics for Restaurant Partners (e.g. daily/weekly order volume, repeat-customer rates) — never identifying an individual Guest to a Restaurant Partner beyond what the order itself already discloses;
• respond to support requests;
• maintain the security and proper operation of our systems; and
• comply with legal obligations (e.g. tax and accounting record-keeping).

6. Legal Basis (GDPR)

For individuals in the EU/EEA and UK:

• Processing needed to provide the Restaurant Services (taking an order, managing a dashboard) relies on contractual necessity.
• Aggregated analytics for Restaurant Partners relies on our legitimate interest in helping our Restaurant Partners understand and improve their own business — Restaurant Partners remain responsible for any consent needed to message their own Guests directly.
• Where required, certain processing relies on compliance with a legal obligation (e.g. responding to a lawful data request).

7. Retention

We retain personal information only as long as necessary for the purpose it was collected, or as required by law (for example, invoicing records are generally kept for the statutory period applicable in your country).

8. Who We Share Information With

We share personal information with:

• Supabase (database and authentication) — data is stored in the EU (Frankfurt region)
• Vercel (website hosting) — delivered via a global CDN that includes EU-based servers
• Stripe and PayPal (payment processors) — to process subscription payments (Restaurant Partners) and, where applicable, order payments (Guests)
• Other service providers who support our operations (e.g. transactional email delivery, once configured)

9. International Transfers

Based on the hosting configuration, your personal information is stored within the EU/EEA, and no international transfer safeguard is currently needed for primary storage. Some third-party processors (e.g. Stripe, PayPal) may process limited data outside the EU/EEA as part of their own global fraud-prevention infrastructure; where this occurs, it is covered by Standard Contractual Clauses under each provider's own data processing terms.

10. Cookies

Spiceup-Lite and, where applicable, Restaurant Partners use cookies and similar technologies as described in our Cookie Policy.

11. Your Rights

Subject to applicable law, you have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• request deletion;
• restrict or object to certain processing;
• request a portable copy of your data; and
• lodge a complaint with your local data protection authority.

To exercise these rights, contact privacy@orderpad.app. If your question concerns a specific order, we may need to direct you to the relevant Restaurant Partner, who is the responsible party for that transaction.

12. Sensitive Information and Children

Please do not share sensitive personal information (health data, religious beliefs, political opinions, etc.) with us beyond what is necessary — for example, an allergen note on an order should be addressed to the Restaurant Partner preparing your food, not treated as a general health disclosure to us.

Spiceup-Lite is intended for use by adults placing orders or managing a business account. It is not directed at children.

13. Complaints

If you believe we have not complied with this Privacy Policy, contact us at privacy@orderpad.app. You also have the right to lodge a complaint with your national data protection authority.

14. Contact

Spiceup-Lite

Av. da Liberdade 110, 1250-146 Lisboa, Portugal

Email: privacy@orderpad.app

Phone: +351 920 360 222