Privacy Policy

1. Commitment to Privacy

At Dishfuls, our mission is to eliminate unfair 15% to 28% delivery app markups and connect diners directly with verified local kitchens. We treat data privacy with the same uncompromising standard: we do not sell, rent, monetize, or harvest user data for third-party advertising.

This Privacy Policy outlines how Christopher Istvan (Founder) collects and safeguards information across Dishfuls.com, our consumer search engine, and the Dishfuls Menu Sync merchant operational infrastructure.

2. Information We Collect

2.1 Consumer Diners

• VIP Waitlist Registrations: Email address and declared municipal city or zip code (e.g., Austin, TX or 78701) to notify you when neighborhood kitchens go live.
• Concierge Communications: Full name, email address, topic, and message details when submitting support requests.
• Outbound Intent Telemetry: Anonymous click-through counters when diners access direct restaurant phone numbers or Google/Apple Maps profiles.

2.2 Restaurant Operators (Merchants)

• Merchant Verification Profile: Restaurant trade name, physical address, owner/general manager name, direct telephone number, and official business email.
• Point-of-Sale (POS) Configuration: Selected POS platform (Toast POS, Clover, Square for Restaurants, Lightspeed, NCR Aloha, SpotOn, Shift4), outlet identifiers, catalog read permissions, and webhook URLs.
• Operational Menu Catalog: Dish titles, three-tier descriptions (POS shorthand, web prose, delivery packaging notes), prices, happy hour promo schedules, modifier groups, and inventory/86 stock states.

2.3 Automated Anti-Bot Telemetry

To defend our servers against bot swarms and automated form abuse, our interactive forms collect ephemeral math verification answers, submission latency intervals, and honeypot confirmation parameters.

3. How We Use Your Information

• Metro Launch Alerts: Sending one-time notifications to VIP diners when regional food profiles and verified kitchens launch in their city.
• POS Menu Synchronization: Ingesting merchant catalog updates and pushing them to merchant website widgets and delivery marketplaces.
• 380ms Real-Time "86" Stock Toggling: Instantly taking sold-out menu items offline across connected web and delivery channels.
• Merchant Verification: Cross-referencing kitchen registrations against municipal business records to prevent fraudulent profile hijacking.
• Platform Security & Defense: Validating math captchas, blocking malicious bots, and preserving server stability.

4. Third-Party Sharing Rules

Data is transmitted only to strictly vetted service providers essential to operational workflows:

• POS Providers (Toast, Clover, Square, Lightspeed): Communicating via authorized webhooks to maintain synchronized catalog data.
• Delivery Platforms (DoorDash, UberEats, Grubhub): Transmitting menu markups (+10% to +25%) and instant out-of-stock "86" signals on behalf of subscribed merchants.
• Infrastructure Providers: Encrypted web hosting servers running native CentOS 7 and Apache environments with isolated SQLite3 databases as a minimum system requirement to run various instances of the platform. Additional systems are in place managing and safeguarding the production environment (specific production architecture details omitted for security purposes).

5. Strict AI Model Training Prohibition

6. Local Storage & Cookies

Dishfuls operates on a minimal, cookie-light architecture. We do NOT use third-party advertising tracking cookies or cross-site tracking beacons.

• dishfuls_coming_soon_theme: Remembers your UI theme preference (Dark or Light Mode).
• Local form cache: Provides client-side fallback storage to prevent lead loss in the event of transient network drops.
• Captcha session tokens: Ephemeral in-memory keys validating human challenge solutions.

7. Cryptographic Data Security

• HMAC-SHA256 Handshakes: Telemetry exchanges between the admin dashboard and internal endpoints are cryptographically signed to prevent packet tampering.
• POSIX File Lockdown: Launch databases are stored in protected directories (chmod 0775 / 0664) with 0600 lockdown on cryptographic keys. Direct HTTP access is blocked via .htaccess.
• Transport Layer Security: All web traffic is encrypted end-to-end via TLS 1.2 / TLS 1.3 (HTTPS).

8. Data Retention Policies

Consumer waitlist leads are retained until the regional launch notification is dispatched or until the user requests erasure. Active merchant records and subscription logs are maintained throughout the active subscription and for statutory tax compliance periods (7 years). Concierge inquiries are archived for 24 months.

9. Your Privacy Rights (GDPR & CCPA/CPRA)

Regardless of your geographic location, Dishfuls extends core data privacy protections:

• Right to Know & Access: You may request a complete disclosure of the personal information we hold regarding your email address.
• Right to Rectification: You may request corrections to inaccurate contact or restaurant profile information.
• Right to Erasure ("Right to Be Forgotten"): You may request the permanent deletion of your waitlist email or claimed profile.
• Right to Opt-Out: You may unsubscribe from launch alerts at any time via email links or by contacting our team.

To submit a verified data request, email privacy@dishfuls.com. We process all legitimate requests within 30 days without fee or discrimination.

10. Children's Privacy & 11. Data Protection Contact

Dishfuls is intended for general audiences and commercial food operators. We do not knowingly collect personal data from children under the age of 13.

For all privacy inquiries, data subject requests, or regulatory communications:

• Data Protection Officer: Christopher Istvan (Founder)
• Platform: Dishfuls.com
• Privacy Email:privacy@dishfuls.com
• Concierge Support:concierge@dishfuls.com