U.S. Privacy Policy & Notice at Collection
Effective Date / Last Updated: November 12, 2026 · Entity: RestoHub Inc., 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801
RestoHub does not sell personal information (including mobile phone numbers or SMS opt-in records) for monetary consideration and automatically honors browser Sec-GPC signals. Manage browser preferences or submit an Access, Deletion, Correction, or Opt-Out request anytime at Your Privacy Choices.
1. Scope & Roles (RestoHub vs. Independent Restaurants)
This Privacy Policy applies across restohub.us, beta.restohub.us, Merchant storefronts (*.restohub.us and custom domains), dash.restohub.us, POS, KDS, and Driver applications. When you visit our platform site or sign up as a Merchant, RestoHub acts as a Business / Controller. When you place a food Order with an independent Merchant Restaurant, that Restaurant is an independent Business / Controller of its diner relationship and RestoHub acts as its Service Provider / Processor under our U.S. Data Processing Addendum (and independently for payment security, fraud prevention, and legal compliance).
2. Personal Information We Collect & PCI-DSS Card Isolation
- Diner Checkout & Account Info: Name, email, mobile phone, delivery address, kitchen/delivery notes, hashed password, and order history.
- Payment Card Data (Stripe Level 1 PCI-DSS): Raw credit/debit card numbers, expiry dates, CVC codes, Apple Pay, and Google Pay tokens are collected directly by Stripe, Inc. via encrypted
Stripe ElementsorStripe Terminalhardware. RestoHub never stores raw card PANs or CVCs. - Merchant KYB & Tax Info: Legal business name, EIN/TIN, beneficial owner verification, and checking routing/account numbers processed via Stripe Connect for daily ACH payouts and IRS Form 1099-K reporting.
- Active Driver Shift Location: When an authorized delivery courier signs into an active shift in the Driver app, GPS route coordinates are processed solely for dispatch distance, ETA, and delivery completion. Drivers stop sharing location by ending their shift or disabling OS location permissions.
- Cookies & Device Data: IP address, browser headers,
Sec-GPCsignal, auth tokens, and cart storage as itemized in our Cookie Notice.
3. Statutory Notice at Collection & 12-Month CCPA/CPRA Disclosure Table
| Statutory Category | Examples Collected | Business Purposes | Service-Provider / Fulfillment Recipients | Sold / Shared? |
|---|---|---|---|---|
| A. Identifiers | Name, email, phone number, delivery address, account UUID, IP address | Order fulfillment, auth, receipts, fraud prevention, support | Selected Restaurant, assigned driver, cloud/payment/email subprocessors | No |
| B. Customer Records (Cal. Civ. Code § 1798.80(e)) | Name, address, phone, tokenized card brand/last-4 (full PAN isolated in Stripe) | Payment processing, refunds/chargebacks, Merchant KYB & 1099-K compliance | Stripe, Inc., selected Restaurant, cloud database provider | No |
| D. Commercial Information | Food/beverage orders, modifiers, totals, voluntary tips, timestamps | Kitchen prep, receipts, Merchant accounting & reporting | Selected Restaurant, cloud & payment subprocessors | No |
| F. Internet / Network Activity | HTTP request metadata, pages viewed, error logs, Sec-GPC privacy signal | Multi-tenant security, WAF protection, debugging & uptime | Cloudflare, Inc., Supabase, Inc. | No |
| G. Geolocation Data | Diner delivery coordinates; active-shift route GPS (Authorized Drivers only) | Delivery zone validation, mileage calculation, live order dispatch | Selected Restaurant, Google Maps API, cloud database | No |
| H. Professional / Staff Data | Restaurant Owner/Staff role, store assignment, POS/Driver shift timestamps | Multi-tenant RBAC access control & shift cash reconciliation | Applicable Merchant Restaurant employer, cloud database | No |
| Sensitive Personal Information | Hashed login credentials; Merchant EIN/bank routing via Stripe; active Driver GPS | Strictly limited to statutory exempt purposes (Cal. Civ. Code § 1798.121) | Stripe, Inc., Supabase Auth, applicable Restaurant | No (Never used to infer traits) |
4. Data Retention & Security Safeguards
Transaction, payout, and Form 1099-K tax records are retained for seven (7) years as required by federal/state tax law (IRC § 6050W). Account profiles are retained while active and deleted or de-identified within 45 days of a verified deletion request (subject to legal/fraud exceptions). Security logs rotate within 30–90 days. We protect personal data using TLS 1.2/1.3 in transit, AES-256 encryption at rest, multi-tenant PostgreSQL Row-Level Security (RLS), and never use personal data to train public third-party AI models.
5. Your U.S. State Privacy Rights (CA, VA, CO, CT, TX, OR, UT, NV & All Enacted States)
Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Jersey, Iowa, Nebraska, New Hampshire, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Nevada—and voluntarily all U.S. users—may exercise the following rights free of discrimination:
- Right to Know / Access & Portability: Confirm processing, view categories/specific pieces of personal data, and obtain a portable copy (including specific third-party recipient lists where applicable under OR/MN law).
- Right to Delete & Right to Correct: Request deletion of personal information or correction of inaccuracies.
- Right to Opt Out of Sale, Sharing, Targeted Ads & Profiling: Toggle opt-out preferences instantly via Your Privacy Choices or automatically via your browser's
Sec-GPCsignal. - Right to Appeal: If we decline a privacy request, you may appeal within 60 days by emailing contact@restohub.us (Subject:
Privacy Appeal). We respond to verifiable requests and appeals within 45 days and provide your State Attorney General's contact link if an appeal is denied. - California Shine the Light (§ 1798.83) & Nevada (NRS 603A): We do not disclose personal information to third parties for their own direct marketing without opt-in consent, nor sell covered information under Nevada law.
6. Children's Privacy (COPPA) & Contact Information
The Services are strictly for individuals aged 18+; we do not knowingly collect data from children under 13 or 16. For privacy questions or requests, visit /legal/privacy-choices, email contact@restohub.us, call +1 (202) 455-4088, or write to RestoHub Inc., Attn: Privacy Officer, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801.