YataiRun Privacy Policy

1. Who this policy covers

YataiRun provides online ordering pages and order management tools for restaurants. This policy explains what information we handle and why, for two groups of people: customers who order from a restaurant through its ordering page, and restaurant owners, managers, and staff who use the YataiRun dashboard.

When you order from a restaurant, your purchase is from that restaurant. YataiRun processes your order information on the restaurant's behalf to run the ordering page, deliver your order to the kitchen, and keep the records described below.

If you contact us through the form on our website, this policy covers that too: we keep your name, contact details, and message so we can respond and keep a record of the conversation.

2. If you order from a restaurant: what we collect

When you place an order we collect your name, your phone number, your order (items, options, any special instructions you type, tip), and the pickup time you choose. An email address is optional; if you provide one it is stored with your order for the restaurant's records. We do not create customer accounts and we do not ask you for a password.

Your phone number is required because it is how the restaurant identifies your order at pickup and reaches you if something goes wrong with it. It is also used, per restaurant, to protect against repeated no-shows and abusive orders.

When you place an order we also record the network address (IP) the order came from. It is used only to limit automated and abusive ordering, is never used for anything else, and is deleted in routine cleanups rather than kept long-term.

Card payments are processed by Stripe. Your card details go directly from your browser to Stripe and never touch our servers. We receive confirmation that a payment succeeded, its amount, and Stripe's reference for it, not your card number.

The checkout page uses Cloudflare Turnstile to block automated abuse. Turnstile evaluates technical signals from your browser to tell people from bots; we do not receive those signals, only the pass or fail result.

The ordering pages set no advertising or analytics cookies, and we do not use advertising or cross-site tracking. Your cart is stored in your own browser (localStorage) until you check out.

3. If you order from a restaurant: how it is used and shared

Your order information goes to the restaurant you ordered from: to its order queue, its kitchen ticket printer if it uses one, and its order history. Each restaurant sees only its own customers and orders, never another restaurant's.

We use order records to operate the service, to show the restaurant its own order history and totals, and to keep the dispute and audit records described in Section 6. We do not sell personal information, we do not share it with advertisers, and we do not use it to market to you.

The restaurant decides its own policies for cancellations, refunds, and no-shows, and is responsible for how it uses your contact details outside the platform.

4. If you run a restaurant on YataiRun: what we collect

For your account we collect your name, email address, and password (stored as a hash by our authentication provider, Supabase), and, if you choose to answer when you sign up, how you heard about us. For your restaurant we store the details you enter: name, address settings, hours and locations, menu content and photos, tax rate, policies, and device pairings.

When you accept the owner terms, and if you ask to close your account, we also record the network address (IP) and browser the request came from, as evidence of that action. The records themselves are kept. The address and browser are removed from the terms record two years after the account closes, and from a closure request two years after it was made or when it finishes or is withdrawn, whichever is later. A record that is part of an open legal matter keeps them until the matter ends.

Online payments run through your own Stripe account. We store your Stripe account identifier and the status of its capabilities, not your bank details; those live with Stripe.

We send you transactional email: sign-in and password messages, and operational alerts such as ordering being paused. We do not send marketing email to your customers, and we do not send you marketing email without your consent.

5. Service providers

We use a small set of providers to run the service, each processing data only to provide their function to us. Today they are: Stripe (payments), Supabase (database and authentication), Vercel (hosting), Cloudflare (bot protection at checkout), Resend (email delivery), Anthropic (reading the menu photos an owner uploads during menu setup), and Sentry (error and performance monitoring, production only). Each provider receives only what its function needs, and we will keep this list current as the service changes.

6. Order records, disputes, and retention

Completed orders are financial records. They are the evidence used to resolve payment disputes, chargebacks, refunds, and tax questions, so they are kept after the order is done, and they survive a restaurant closing its account, for as long as tax and dispute obligations require.

We keep an audit trail of order events (when an order was placed, accepted, ready, picked up, refunded) for the same reason. Operational logs are kept short-term, phone numbers are not written to them, and the network addresses used for rate limiting are deleted in routine cleanups rather than kept long-term.

7. Cookies and browser storage

On a restaurant's ordering page we set no cookies of our own. While you are building it, your cart is kept in your browser's local storage on your own device, and the page keeps the link codes of your own recent orders there too, so it can show you their status again. Storing them that way does not send them to us: what reaches us is the order you place, as Section 2 describes, and the status checks the page makes with an order's own link code while that order is open. Clearing your browser data clears both.

The checkout page loads Stripe's payment library, which sets two cookies of its own to help Stripe detect fraud: one that lasts about a year and one that lasts about half an hour. Stripe sets and reads them; we do not, and they are not set on the menu page. Checkout, the contact form on our own website, and the sign-in, sign-up, password-reset, invitation and tablet-setup screens each run a Cloudflare bot check, which loads a script from Cloudflare and shows its challenge in a frame. It sets no cookie on our pages.

When you sign in to the restaurant dashboard at app.yatairun.com, our authentication provider sets a sign-in cookie on that address so your browser stays signed in from page to page. It is set when you sign in and removed when you sign out. The platform administration address works the same way. Neither is ever set on a restaurant's ordering page.

A tablet set up as a counter or kitchen screen signs in as a device rather than as a person, and the same kind of sign-in cookie holds that device session. When a staff member starts a shift on a shared counter tablet we also set one cookie that records who is on shift, so tickets can show who took an order. It expires 12 hours after the shift starts, or when the shift ends, and page scripts cannot read it.

The dashboard also remembers small preferences in the browser you use it in, such as whether the new-order sound is switched on. Those stay on that device.

We set no advertising, analytics, or cross-site tracking cookies anywhere in the service, and we run no advertising or web-analytics script. The error and performance monitoring named in Section 5 stores nothing in your browser. We do not use cookies to build a profile of you.

8. Your choices and rights

You can ask us what information we hold about you, ask us to correct it, or ask us to delete it by contacting privacy@yatairun.com. We will verify the request and respond within the time applicable law requires. Records we must keep by law, including completed order records within their retention period, are exempt from deletion; we will tell you when that applies and when the retention period ends.

If you ordered from a restaurant, you can also contact the restaurant directly about your information; for anything the platform holds, the address above works for you too.

9. Children

The service is not directed at children under 13 and we do not knowingly collect their information. If you believe a child has provided us information, contact us and we will delete it.

10. Where this applies

The service operates in the United States and Canada, and data is stored in the United States. If you use the service from elsewhere, your information is transferred to and processed in the United States.

11. Changes and contact

If we change this policy materially, we will post the new version here with a new effective date, and notify restaurant accounts by email. Questions about this policy: privacy@yatairun.com.