Privacy Policy

Who we are

DineHarbor is restaurant software: a point of sale, kitchen display, waiter, kiosk, driver and manager app, online ordering storefronts, reservations and a back office, run at dineharbor.com and on each restaurant's own storefront address. DineHarbor is operated by Respiresoft LLC, 32 N Gould St, Sheridan, WY 82801, United States. In this policy "DineHarbor", "we" and "us" mean the operator of the service.

This policy covers the website, the storefronts, the back office, six apps - DineHarbor POS, DineHarbor Kitchen, DineHarbor Waiter, DineHarbor Kiosk, DineHarbor Driver and DineHarbor Manager - and the ordering app a restaurant publishes under its own name on DineHarbor (a "customer app").

Two roles: controller and processor

• We are the controller for the people who hold a DineHarbor account (restaurant owners and the staff they invite), for visitors to dineharbor.com, and for subscription billing. We decide why and how that data is used.
• We are a processor for each restaurant for its diners' data (orders, accounts, bookings, reviews, loyalty and wallet), its couriers' delivery data and its devices. The restaurant is the controller: it decides what to collect and how long to keep it, and requests about that data go to the restaurant first. We act on its instructions and help it answer them.

What we collect

Restaurant owners and staff (back office, Manager app)

• Name, email address, password (stored only as a one-way hash), language, time zone, optional photo and bio.
• A POS PIN, if the restaurant uses PIN sign-in on its terminals. We keep only a hash of it.
• Two-factor authentication secret and recovery codes, if you turn two-factor on; Google account id if you sign in with Google.
• Sign-in history (IP address, browser and time), active sessions, and API tokens you create.
• What you do in the back office that the audit log records, such as changing a price or a setting.
• Copilot conversations and any AI answer you report as wrong (see "AI features").
• Staff chat, in every staff app: the messages, photos, files and voice notes you send colleagues, your reactions, when each message reached and was read by each person, and a record of each call (who called whom, when, and for how long). Calls are audio sent directly between the two devices - or, when a direct connection is impossible, through our relay server - and are never recorded. "Typing…" signals are not stored.
• Support tickets and feedback you send us.
• For owners: the restaurant's business details and subscription status. Card details for the subscription are entered on Stripe's page; we never see the full number.

Diners on a restaurant's storefront, QR table ordering and the kiosk

• Order details: items, prices, taxes, payment status, time, and the order type (delivery, collection, dine-in).
• For delivery: the address, contact name and phone number, and delivery notes.
• If you create an account: name, email, phone, password hash or passkey, saved addresses, favourites, language, and whether you opted in to marketing.
• Loyalty points and stored wallet balance, if the restaurant offers them.
• Reservations and waitlist entries: name, phone, email, party size, and any notes you add, including allergy or access notes.
• Reviews you write: your display name, rating and text.
• Card payments are taken by the restaurant's payment provider on the provider's own page or terminal. We receive the result and, for card-present payments, the card scheme and last four digits. We never receive a full card number.
• QR table codes record a daily scan count per code, not who scanned.
• The menu assistant ("Ask the menu"), if the restaurant offers it and you agree first: your question and the menu go to the restaurant's AI provider (see AI features). If you are signed in, so does a short summary of your orders there (how often, what you order most, your last order, your favourites - no address, phone, email or payment), and the assistant keeps a one-line note of what you like on your account instead of the conversation. You can clear it from the assistant at any time; it is deleted with your account. A guest's note lasts an hour. Questions are limited per person per day.
• Order updates on your phone or browser, if you turn them on: a notification address (a push token, or your browser's push endpoint) tied to your account or, for a guest, to that one order.
• A restaurant's customer app shows that restaurant's storefront, so it collects the same things. The app itself adds only a notification address, if you allow notifications.

Terminals: POS, Kitchen, Waiter and Kiosk apps

• A device identifier generated for the app on that device, the device model, platform, app version, the name the restaurant gives it, last check-in time and IP address.
• A device access token issued when the device is paired. Pairing codes are single-use, expire, and are stored only as a hash.
• Orders and tickets are cached on the device so it keeps working offline. That copy is protected by the device's own app sandbox and encryption; the app does not add a second layer of encryption. App data is excluded from device backups.

Couriers: the Driver app

• Precise location, only while you are on shift. While the app is open, it records your position (with accuracy, heading and speed) and uploads it in batches about every 30 seconds. While you are carrying an order - from pick-up until it is delivered - it keeps recording when the screen is locked or another app is in front, and shows that it is doing so the whole time (a notification on Android, the location indicator on iPhone). It never records when you are off shift or not carrying an order with the app closed, and never asks for "always" location access.
• Who sees it: the restaurant you are delivering for, and the diner whose order you are carrying while it is on its way.
• Your courier profile: name, phone, vehicle type and registration, licence number and expiry dates, as entered by the restaurant.
• Shift times and the last known position on a shift.
• Proof of delivery: outcome, recipient name, signature, where it was left, the location at hand-over, notes, and, for age-restricted goods, whether an age check passed and how.
• Automated dispatch records: which courier was offered a job and why, so a person can review the decision.

Speaking instead of typing

• Where an app or storefront offers a microphone - asking the Manager's Ask by voice, dictating a chat message, or asking a storefront's menu assistant - your voice is streamed to Soniox, which turns it into text as you speak. Only the text comes back. We do not keep the recording; we keep how many seconds were transcribed, for billing.
• Voice notes in staff chat are different: they are messages, kept like a photo or a file.

Notifications

• When you allow an app or browser to show notifications, we keep its notification address (a push token) and which app and person it belongs to. Notifications are delivered by Google's Firebase Cloud Messaging (Android), Apple's Push Notification service (iPhone and iPad) or your browser's own push service, and carry what the notification says - for example a new order's number, or the first words of a chat message.

Referral partners

• If you join the partner programme: your name, email, company, partner code, the restaurants you referred, the commission they earned, and the payout and tax details you give us (stored encrypted) so we can pay you.

When DineHarbor support signs in to help

• To fix a problem, a DineHarbor administrator can see a restaurant's account as one of its people. Each visit needs a written reason, ends on its own after a time limit, cannot change passwords, sign-in settings or billing, and is recorded: who, as whom, why, when, and every change made.

Visitors to dineharbor.com

• Two essential cookies (a session cookie and a security token). No analytics, advertising or tracking cookies. See the cookie policy.
• If you use the chat assistant on the website, what you type is sent to DeepSeek to generate an answer. We do not store the conversation on our servers; your browser keeps it until you clear it.

AI features

The Manager Copilot, and drafting a reply to a diner's review, both only run after the staff member using them has agreed, and that agreement is recorded per user and checked on our server on every request. It is one agreement covering both features, because both send data to the same provider. You can withdraw it at any time in Manager settings. When either feature is used, we send the following to the third-party AI provider the restaurant has chosen in Manager settings: DeepSeek (servers in China) unless it chooses another, OpenAI (United States), or, where this deployment offers them, Anthropic or Google Gemini (United States) or Mistral AI (European Union). The agreement names the provider, and when a restaurant changes it, everyone is asked again before anything goes to the new one:

• the question you type into the Copilot;
• order and sales figures for the branch;
• menu and product details;
• customer names, phone numbers and email addresses, when you ask about a customer;
• staff names and email addresses, when you ask about a staff member;
• a customer review's rating, title and text, when you ask the assistant to draft a reply to it (the reviewer's name is never sent);

If AI product-photo generation is enabled on this deployment, generating a picture for a menu item sends that product's name, description and ingredients to Gemini, a separate third-party AI provider, to create the image. That, too, only happens after the same per-user agreement above.

Importing a menu from an uploaded file also uses the restaurant's chosen provider (DeepSeek when the chosen one cannot read photos, and Google Vision for a scanned PDF) when a staff member starts it, and does not require that agreement: it sends the uploaded file's text - category, product and price information - which is the restaurant's own menu copy, not personal data about anyone. Nothing is sent to an AI provider unless someone starts one of these features.

Why we use it, and the legal basis

We do not sell personal data, show advertising, or build profiles across restaurants.

Who processes data for us

Payment providers used by a restaurant are chosen and contracted by that restaurant. Geocoding results are cached for 30 days under a hashed key, so the same address is not sent to Google again.

International transfers

DineHarbor's servers are in Germany, in the European Union. Data leaves the UK and EU in these cases:

• DeepSeek, China. China does not have an adequacy decision from the UK or the EU, so its laws are not recognised as protecting personal data to the same standard. We send data there only when someone uses an AI feature with DeepSeek as the restaurant's provider, and for the Copilot only after that person has consented, knowing the data goes to China.
• Google, Apple, Soniox and Stripe, and OpenAI or Anthropic when a restaurant chooses them, United States. These providers process data under their own data-processing terms for international transfers.

How long we keep it

These periods are enforced by a job that runs every night.

Deleting your data

Every path is described on the account deletion page. In short:

• Staff and owners delete their account in Settings → Profile. Your name, email, password, PIN, two-factor secrets, photo, sessions, tokens, sign-in history, Copilot conversations and staff chat messages, files and reactions are erased. Owners must first remove or transfer other members.
• When an owner deletes their account, the restaurant closes and a job removes its diners', couriers' and guests' personal data.
• Diners delete their storefront account under Account → Security on the restaurant's site.
• What stays: the restaurant's sales records (amounts, items, taxes, payments) without your name or address, and the tamper-evident order history, which records which account acted by number only. Tax law requires the restaurant to keep these.

Security

• All traffic to DineHarbor and between the apps and our servers uses HTTPS.
• Passwords, PINs and pairing codes are stored only as hashes. Two-factor sign-in is available for staff, and passkeys for diners.
• Sign-in, PIN and pairing attempts are rate-limited. A lost or stolen device can be revoked, which ends its access at once.
• Each restaurant's data is kept separate from every other restaurant's.
• Order history is hash-chained, so a changed or deleted entry can be detected.
• We never receive or store full card numbers.

No system is perfectly secure. If a breach affects your data, we will tell the affected restaurants and people, and the regulator, as the law requires.

Your rights

Under UK and EU data protection law you can ask to see your data, correct it, delete it, restrict or object to how it is used, receive a copy to take elsewhere, and withdraw consent at any time without affecting what happened before.

• Staff can download a copy of their data, and delete their account, in Settings → Profile.
• Diners: download a copy of your data, or delete your account, in Account → Security on the restaurant's storefront. For anything else, contact the restaurant, which controls your data - if you cannot reach it, contact us and we will pass your request on and help.
• Anyone else: use the contact page.

You can also complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), or the authority in your EU country.

Children

DineHarbor is a business tool and is not directed at children. The staff apps are for people at work. We do not knowingly collect data from children under 13 through the storefronts; a restaurant that learns it holds such data should delete it, and can ask us to help.

Changes

We will update this page when what we collect or who processes it changes, and change the date at the top. For significant changes we will also tell restaurant owners in the back office before the change takes effect.

Contact

Respiresoft LLC, 32 N Gould St, Sheridan, WY 82801, United States. Use the contact page, or see support for how to reach us.