Who we are

EasyGrub provides a food ordering and table booking platform that connects customers with restaurants and food businesses. For questions about this policy, contact us at: support@easygrub.app

What information we collect

We collect information you provide directly when creating an account or placing an order: your full name, email address, phone number, delivery addresses, and profile photo. Payment information is processed securely via Stripe — we do not store raw card details.

We also collect information automatically when you use the app: device identifiers, push notification tokens, order history, transaction records, crash reports, and general location at city/region level. If you sign in with Google or Facebook, we receive your name, email address, and profile photo from those providers.

How we use your information

We use your information to process and fulfil food orders, manage table bookings, display your order and booking history, save your delivery address book, and process payments securely via Stripe.

We also use it to send push notifications about your order status via Firebase Cloud Messaging and OneSignal, send booking confirmations and reminders, respond to support enquiries, analyse usage to improve the app, and comply with applicable laws and regulations.

Legal basis for processing (UK/EU users)

Where the UK GDPR or EU GDPR applies, we process your personal data under the following legal bases: contract performance (to fulfil your orders and bookings), legitimate interests (improving our services, fraud prevention, and security), consent (where you have opted in to marketing or optional features), and legal obligation (where required by law).

Who we share your data with

We do not sell your personal data. Your name, phone number, order details, and delivery address are shared with the restaurant or food business fulfilling your order. Table booking details are shared with the venue for reservation management.

We work with the following trusted third-party providers who process data on our behalf: Stripe (payment processing), Google Firebase (push notifications and analytics), OneSignal (push notifications), Meta/Facebook (optional social login), Google (optional Google Sign-In), and GetAddress (UK address lookup). All providers are contractually bound to protect your data and may not use it for their own purposes.

We may also disclose your information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of our users or others.

How long we retain your data

Account data is retained for the lifetime of your account, plus up to 2 years after deletion to comply with legal obligations. Order records are retained for 7 years for financial and regulatory compliance. Booking records are retained for 2 years. Push notification tokens are deleted when you uninstall the app or revoke permissions.

Data security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted data transmission (TLS/HTTPS) for all communications, PCI-DSS compliant payment handling exclusively via Stripe, and access controls limiting employee access to personal data on a need-to-know basis.

Push notifications

The app uses Firebase Cloud Messaging and OneSignal to deliver push notifications about your orders and bookings. You can manage notification preferences at any time through your device settings (iOS: Settings > Notifications > EasyGrub; Android: Settings > Apps > EasyGrub > Notifications). Disabling notifications will not affect your ability to use the app.

What rights you have over your data

You have the right to access, correct, or request deletion of the personal data we hold about you. You may also request restriction of processing, data portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [contact@yourdomain.com]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority (in the UK: the Information Commissioner’s Office at ico.org.uk).

Children’s privacy

The app is not directed at children under the age of 13 (or 16 where required by applicable law). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it promptly.

Where we send your data

Some of our third-party service providers (including Google and Stripe) may process your data outside the UK or European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, to protect your data to an equivalent standard.

Changes to this privacy policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date and, where changes are material, notify you via a push notification or in-app message. Your continued use of the app after any changes constitutes your acceptance of the updated policy.