Privacy Policy

PlateHaven (platehaven.app) is operated by TCC Solutions Group LLC, a California limited liability company. In this policy, “Company,” “we,” “us,” or “our” refers to that operator.

This Privacy Policy describes how we collect, use, and share information when you use the PlateHaven platform (the “Service”). This policy applies to restaurant clients, their staff, and guests who interact with menus and ordering features.

Our role

For information about a restaurant's guests and orders, the restaurant decides why the information is collected and PlateHaven handles it on the restaurant's behalf as its service provider. For restaurant accounts, billing, security, our own text-message program, and the running and improvement of PlateHaven, we decide, and we act as the business responsible. A guest who wants their order information corrected or deleted can ask us, and we may also direct the request to the restaurant that holds the order.

1. Information We Collect

1.1 Information You Provide

• Account Information: When restaurants register, we collect business name, contact email, and account credentials. If you sign in with Google, we receive your name and email address from Google. We do not receive your Google password.
• Menu Content You Upload: Menu text, logos, food photographs, PDFs and images that restaurants upload, which may be shown publicly on the restaurant's menu.
• Order Information: When guests place orders (if ordering is enabled), we collect name, email, phone number (optional), and order details including items, quantities, special instructions, and table number (for dine-in).
• Payment Information: Payment card details are collected and processed by Stripe, Inc., or by Square, Inc. when the restaurant takes its online payments with Square. We do not store full payment card numbers.
• Communications: When you contact us, we collect the content of your messages and contact information.
• Terms Acceptance Records: When you accept our Terms of Service, we log your email, IP address, timestamp, and the version of terms accepted.

1.2 Information Collected Automatically

• Device and Browser Information: Browser type, operating system, device identifiers, and screen resolution.
• Usage Data: Pages viewed, features used, time spent, and interaction patterns, counted with Vercel Web Analytics (see Cookies and Tracking below).
• IP Address: Your IP address for security, fraud prevention, and compliance purposes.
• AI Assistant Interactions: Questions submitted to the AI menu assistant and responses provided, for quality improvement. Please do not type sensitive personal details, such as health information, into the assistant.
• Text and Email Preferences: Which messages you agreed to, when and how you agreed, the wording you saw, and when you opted out.

2. How We Use Information

• Provide the Service: Display menus, process orders, send order confirmations and status updates.
• Process Payments: Facilitate payment processing through Stripe, or through Square for a restaurant that chooses it.
• Communications: Send transactional emails (order confirmations, receipts, ready-for-pickup notices), optional marketing/retention emails and SMS when opted in.
• Analytics: Provide restaurant clients with order analytics and insights.
• Improve the Service: Analyze usage patterns and AI interactions to improve features and accuracy.
• Security: Detect and prevent fraud, abuse, and unauthorized access.
• Legal Compliance: Comply with legal obligations and enforce our Terms of Service.

3. Information Sharing

We share information only as described below:

• With Restaurants: Order information is shared with the restaurant fulfilling your order, including name, contact info, and order details. If the restaurant has connected its Square point of sale, the order is also sent into its Square account.
• Service Providers: We use third-party providers for:
  • Payment processing and restaurant payouts (Stripe, including Stripe Connect and Stripe Tax)
  • Payment processing and the point of sale, for restaurants that connect Square (Square)
  • Email delivery (Resend, with Bird as a backup sender)
  • SMS notifications (Twilio, when enabled)
  • Cloud hosting, uploaded image storage and visit counts (Vercel, including Vercel Blob and Vercel Web Analytics)
  • Database (Neon)
  • Abuse and rate limiting, which sees IP addresses (Upstash)
  • AI services (OpenAI). Guest questions to the menu assistant, and the menus and images a restaurant asks us to read or write with AI, are sent to OpenAI through its API. OpenAI states that data sent through its API is not used to train its models unless the customer opts in.
  • Sign-in (Google, only if you choose “Sign in with Google”)
  These providers may use the information only to provide their service to us. We list them again with their purposes in Section 14.
• Legal Requirements: When required by law, legal process, or to protect rights, safety, or property.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred.

We do not sell personal information.

We never sell or rent mobile phone numbers, and we never share them for anyone else's marketing. No mobile information is sold or shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are excluded from every category of sharing described above and are not shared with any third party. Your number is used only to deliver the messages you asked for from PlateHaven about your order, and is disclosed only to the messaging provider that delivers them.

4. Data Retention

• Order Data: Retained for the duration of the restaurant's subscription plus 3 years for tax and legal compliance.
• Account Data: Retained while the account is active and for 1 year after termination.
• Terms Acceptance and Text/Email Consent Records: Retained for as long as you have an account and for 6 years after it closes, so we can show what you agreed to. A text or email consent record holds the wording you agreed to, the date and time, your phone number or email, the restaurant, and, when you agreed on a web page, the IP address and browser you used.
• Security and Abuse Logs (including IP addresses): Kept only as long as needed to detect and investigate abuse, fraud and outages.
• AI Interaction Logs: Retained for 90 days for quality improvement, then anonymized or deleted.

5. Your Rights (California Residents)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out: Opt out of the sale or sharing of personal information. Note: We do not sell personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at platehaven2025@gmail.com with the subject line “CCPA Request,” or call +1 530 334 6503. We will answer within 45 days of a request we can verify; we may take a further 45 days if we tell you why. To protect you, we confirm a request by matching it to information we already hold, such as the email on an order. You may use an authorised agent, who must show written permission. If we decline a request, you may appeal by replying to our answer, and we will respond within 60 days.

We do not collect sensitive personal information as the law defines it for the purpose of inferring characteristics about you, and we do not knowingly sell or share the personal information of anyone under 16. We offer the same rights to every person who asks, wherever they live, though we may be unable to act on a request that the law requires us to refuse or that the restaurant must answer.

6. SMS Communications

If you opt in to SMS/text notifications when placing an order, you agree to receive transactional messages from PlateHaven about that order. PlateHaven is the sender; the restaurant you ordered from is named inside the message only as the context of the order. Transactional SMS categories may include order confirmations, pickup or ready alerts, and order status updates.

• Consent to transactional SMS is optional and is not required to purchase or place an order.
• Message frequency varies based on your order activity and restaurant updates.
• Message and data rates may apply.
• Reply STOP to opt out of SMS messages.
• Reply HELP for help.
• SMS is provided through Twilio. See Twilio's privacy policy for details.

Marketing or retention messages (email and/or SMS), such as review requests, holiday reminders, or promotions, are sent only if you separately opt in at checkout. An order-status SMS opt-in does not authorize marketing or retention messages.

7. Email Communications

We send transactional emails about your order (for example receipts and ready-for-pickup notices) to the email address you provide at checkout. Marketing or retention emails are sent only if you opt in separately at checkout. Every marketing email carries an unsubscribe address and a List-Unsubscribe header, so you can unsubscribe from marketing emails using the link in each message.

8. Cookies and Tracking

We use essential cookies for authentication and session management, and for unlocking a private menu with its access code. We do not use third-party advertising cookies or tracking pixels for advertising purposes.

We also store small items in your browser's local storage, only to make the Service work: your most recent order on a restaurant's menu, kitchen-screen settings (sound, which orders have been seen) and, for kitchen staff, the kitchen PIN and a device key so the screen stays signed in. Kitchen screens should only be used on devices the restaurant controls, because anyone using the same browser can see what is stored there. You can clear this data in your browser settings.

To count visits we use Vercel Web Analytics, which does not use cookies and does not follow you from one website to another. When you pay or sign in with Google, you are on a page run by Stripe, Square or Google, and their own policies apply there.

Do Not Track. We do not collect information about your activity over time and across other websites, and we do not allow other parties to collect it through PlateHaven. Because of that we treat every visitor the same, and there is nothing for a browser “Do Not Track” signal to switch off.

9. Security

We use reasonable administrative, technical and physical safeguards for the size of our service. Examples as of the date above:

• Encryption of data in transit (TLS/HTTPS)
• Stored data kept with infrastructure providers that encrypt it at rest
• Account passwords stored only as salted hashes, never as readable text
• Kitchen-screen access that needs a PIN, the owner's approval of each device, and a key issued to that device and stored by us only as a hash
• Rate limiting on sign-in and on kitchen-screen access
• Access to production systems limited to authorized personnel

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

If we learn of a security breach that affects personal information, we will tell the affected restaurants and, where the law requires, the affected individuals and regulators, without unreasonable delay.

10. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately. Restaurant accounts are for adults aged 18 or over.

11. International Users

The Service is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify restaurant clients of material changes via email. The “Effective Date” at the top indicates when this policy was last revised.

13. Contact Us

For privacy-related questions or to exercise your rights:

• Email: platehaven2025@gmail.com
• Address: 2929 Alder Drive, Camino, CA 95709, United States
• Subject Line: “Privacy Inquiry” or “CCPA Request”
• Website: platehaven.app

14. Service Providers We Use

Each provider below handles personal information for us only to provide the service named. The list is current as of the date at the top of this page; we update it when it changes.

Categories of Personal Information Collected

For CCPA compliance, the following categories of personal information may be collected. We collect them to run the Service as described in Section 2, and we disclose them only to the restaurant that fulfils the order and to the service providers in Section 14. We do not sell or share them for advertising.