Privacy Policy

NoFee LLC ("NoFee", "we", "us") respects your privacy. This Privacy Policy explains how we collect, use, share, and protect information when you use nofee.restaurant and the related NoFee Service (the "Service"). Our business address is 9100 Conroy Road, Suite 200, Windermere, FL 34786, United States.

1. Information We Collect

1.1 Information You Provide

• Restaurants: business name, owner name, email, phone, address, menu items, photos, bank/payment account details (via Stripe).
• Customers: name, email, phone, delivery address, order details, payment info (processed directly by Stripe — we do not store full card numbers).
• Ambassadors: name, email, phone, password (hashed), referral activity, payout history.
• Communications: messages you send us via email or support.

1.2 Information Collected Automatically

• Usage data: pages visited, clicks, device type, browser, language, approximate location (city-level).
• Cookies and similar technologies: see our Cookie Policy.
• Error and performance data: via Sentry, to debug bugs (does not include passwords or payment info).
• IP address & device fingerprint: for fraud prevention.

1.3 Information From Third Parties

We may receive information from Stripe (payment status), Twilio (SMS/WhatsApp delivery status), Google (when you sign in with Google, if available), and from public business directories when verifying Restaurants.

2. How We Use Information

• Provide, operate, and improve the Service;
• Process Restaurant subscriptions and Customer orders;
• Send transactional notifications (SMS, WhatsApp, email) about your account or orders;
• Validate Ambassador referrals and release rewards;
• Prevent fraud, abuse, and unauthorized access;
• Comply with legal obligations, including tax and law-enforcement requests;
• With your consent, send marketing communications. You can opt out at any time.

3. Legal Bases (GDPR)

If you are in the European Economic Area or the UK, we rely on the following legal bases:

• Contract: to perform the Service you signed up for;
• Legitimate interests: to improve the Service, prevent fraud, secure our systems;
• Consent: for marketing communications and non-essential cookies;
• Legal obligation: tax, accounting, and law-enforcement requests.

4. How We Share Information

We do not sell your personal information. We share information only as follows:

• With Restaurants: Customer order details necessary to fulfill the order;
• Service providers (Stripe, Twilio, MongoDB Atlas hosting, Sentry, Cloudflare): only as needed to operate the Service, under data processing agreements;
• Legal compliance: when required by subpoena, court order, or law;
• Business transfers: in connection with a merger, acquisition, or sale of assets — you will be notified;
• With your consent: any other sharing requires your explicit opt-in.

5. Your Rights (CCPA & GDPR)

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete data;
• Delete your personal information ("right to be forgotten");
• Portability — receive your data in a machine-readable format;
• Opt out of sales/sharing of personal information (we do not sell, but you may still object);
• Limit use of sensitive information;
• Non-discrimination for exercising your rights.

To exercise any of these rights, email support@nofee.restaurant with the subject line "Privacy Request". We will respond within 30 days.

6. Data Retention

We retain personal information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations (tax records, fraud investigation, dispute resolution). Order records are typically retained for 7 years for tax and accounting purposes.

7. Data Security

We implement industry-standard safeguards including TLS/HTTPS encryption in transit, bcrypt password hashing, JWT authentication, restricted database access, and regular security reviews. No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Children's Privacy

The Service is not directed to children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

9. International Data Transfers

Our servers are located in the United States. If you access the Service from outside the U.S., your information may be transferred to, stored, and processed in the U.S. By using the Service, you consent to such transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app banner. The "Last updated" date at the top reflects the most recent revision.

11. Contact Us

For any privacy questions or to exercise your rights:

NoFee LLC
9100 Conroy Road, Suite 200
Windermere, FL 34786, United States
support@nofee.restaurant