Privacy Policy

Last updated: July 11, 2026

Introduction

Daimenu ("we", "us", or "our") operates a food delivery marketplace platform that connects customers with local merchants. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR), which applies uniformly across the European Union. As a Bulgarian-registered company, Daimenu is also subject to the Bulgarian Personal Data Protection Act, which implements GDPR in our jurisdiction. Daimenu is available to users across the EU, and you may exercise your data protection rights with the supervisory authority in your country of residence as well as with the Bulgarian Commission for Personal Data Protection (CPDP).

Data Controller

The data controller responsible for your personal data is:

Data We Collect

We collect the following categories of personal data when you use our platform:

Account Information

• Full name, email address, and phone number
• Password (stored in encrypted/hashed form only)
• Language preference
• Third-party authentication provider ID (if you sign in via Google or Apple)

Delivery Addresses

• Street address, building number, flat/apartment number, town
• Geographic coordinates (latitude and longitude) for delivery location accuracy

Order Information

• Order details including items, quantities, prices, delivery fees, and order notes
• Payment method chosen (cash or online) and payment status
• A snapshot of your contact details and delivery address is saved with each order for record-keeping

Technical and Session Data

• IP address and browser user agent (collected during active sessions)
• Device information (derived from user agent)
• Session activity timestamps (creation, last use, expiry)
• Basic Google Analytics data such as a sanitized page path, approximate location, browser and device category, and pseudonymous session activity. Query strings, URL fragments, credential-bearing path segments, and account profile fields are not sent. Google Analytics is not configured with an authenticated user ID.

How We Use Your Data

• To create and manage your account
• To process and deliver your orders by sharing necessary details with the merchant
• To process online payments securely through our payment provider (Stripe)
• To send transactional emails: account verification, password resets, order confirmations, and order status updates
• To send in-app notifications about your order status
• To maintain platform security, prevent fraud, and enforce our terms of service
• To understand aggregate page usage and improve platform reliability

Legal Basis for Processing

• Contract performance - processing your orders, managing your account, and providing the platform services you requested
• Legitimate interest - maintaining platform security, preventing fraud, improving our services, understanding aggregate platform usage, and session management
• Legal obligation - retaining transaction records as required by tax, accounting, and consumer protection regulations

Third-Party Services

We share data with the following third-party services as necessary to operate our platform:

• Stripe - processes online payments securely (card, Google Pay, Apple Pay, Revolut Pay). Payments go directly from you to the merchant's Stripe account. Stripe receives transaction details and payment information. See Stripe's privacy policy at stripe.com/privacy.
• Google - provides OAuth sign-in, Maps for delivery address selection, geocoding services, cloud file storage, and Google Analytics for basic page and session measurement. Google Signals and advertising personalization are disabled. See Google's privacy policy at policies.google.com/privacy.
• Apple - provides OAuth sign-in. See Apple's privacy policy at apple.com/legal/privacy.
• Cloudflare - provides bot protection (Turnstile) on login and registration forms. Cloudflare may receive your IP address and browser fingerprint for challenge verification. See Cloudflare's privacy policy at cloudflare.com/privacypolicy.
• Sentry - receives error reports for platform stability monitoring. Personal data is not included in error reports (PII transmission is disabled).

Data Retention

• Account data — retained while your account is active. If you delete your account, your personal data is permanently anonymized and no longer accessible through the platform.
• Order records — retained for 24 months with your personal details (name, email, phone, delivery address). After 24 months, personal details within order records are automatically anonymized. Order financial data (amounts, items, merchant) is retained for tax and accounting compliance.
• Session data — automatically deleted after 30 days of inactivity or upon session expiry.
• Google Analytics user-level event data — retained for up to 14 months. Aggregate reporting may be retained for longer.
• Notifications — automatically deleted after 7 days.
• On account deletion — your name, email, phone, and delivery addresses within all order records are anonymized immediately, regardless of the 24-month retention period.

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — correct any inaccurate or incomplete data via your profile settings.
• Right to erasure (Art. 17) — delete your account and personal data via the "Delete Account" option in your profile. Your personal details within order records are anonymized immediately.
• Right to restriction (Art. 18) — request that we limit how we process your data.
• Right to data portability (Art. 20) — export your personal data in JSON format via the "Data Export" page in your profile. You can download data directly for periods up to 1 month, or receive it by email for longer periods (up to 1 year).
• Right to object (Art. 21) — object to the processing of your data based on legitimate interests.

The right to erasure may be limited for financial data required by tax and accounting regulations. In such cases, your personal details within order records are anonymized (replaced with non-identifiable placeholders) while financial totals are retained.

Data Security

We implement appropriate technical and organizational measures to protect your personal data. Passwords are stored using strong cryptographic hashing. Authentication tokens are stored in HTTP-only, secure cookies inaccessible to client-side scripts. All data is transmitted over encrypted HTTPS connections. Payment details are handled entirely by Stripe and never stored on our servers.

Children's Privacy

Our platform is not intended for children under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete that information.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the platform after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: