Current version (April 1, 2026)

Privacy Policy

Last updated: April 1, 2026

PedidoIQ ("we", "us", "our") operates the pedidoiq.app platform. This policy explains how we collect, use, and protect your information when you use our services.

1. Information We Collect

For Restaurant Owners

Account information: name, email, restaurant name, address
Payment information: processed securely by Stripe — we never store card numbers
Restaurant data: menu items, categories, pricing, images
Analytics data: order volumes, revenue metrics, popular items

For Customers

Order information: items ordered, delivery address, order history
Contact information: name, email, phone (when provided)
Device information: browser type, IP address (for security and fraud prevention)

2. How We Use Your Information

To process and fulfill orders between customers and restaurants
To provide restaurant owners with analytics and business insights
To send transactional emails (order confirmations, reservation updates)
To improve our platform and develop new features
To prevent fraud and maintain platform security

We do not sell your personal data to third parties.

3. Data Storage & Security

Data is stored in encrypted PostgreSQL databases with schema-level tenant isolation. Each restaurant's data is completely separated from other restaurants on the platform. All connections are encrypted with TLS 1.2+. We use Cloudflare for DDoS protection and edge security.

4. Third-Party Services

Stripe — payment processing (PCI-DSS compliant)
Cloudflare — CDN, DNS, and security
Resend — transactional email delivery
OpenAI — AI chatbot functionality (no customer data is used for training)

5. Your Rights

You have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and associated data
Export your data in a portable format
Withdraw consent for marketing communications at any time

6. Cookies

Some cookies are essential — they keep you signed in and your order together while you use the site. These are always active, because the site cannot work without them.

We also use Google Analytics to see how the platform is used. Those cookies are set only if you accept them. Until you do, nothing is stored on your device for analytics, and if you decline the site works exactly the same.

We do not use advertising cookies, and we do not share analytics data with anyone for advertising.

7. Data Retention

We retain restaurant data for as long as the account is active. Order history is retained for 3 years for accounting and dispute resolution purposes. When an account is deleted, personal data is removed within 30 days; anonymized analytics may be retained.

8. Contact

For privacy-related inquiries, contact us at [email protected] or through our contact page.

Upcoming version — takes effect October 31, 2026

Privacy Policy

1. Who we are

PedidoIQ is operated by NeuraCode Systems Inc, a New Jersey corporation doing business as DigiAxix ("we"). This policy explains what personal data the Platform handles, why, for how long and who else receives it.

For the orders and reservations a restaurant receives, the restaurant decides what it does with its diners' data, and we handle that data for the restaurant to run the Platform. For accounts, security and the Platform itself, we decide.

2. Data we handle

Restaurant owner account

What: name, email, language, sign-in
From: the owner
Why: run the account, sign-in, service emails
How long: while the account exists
Shared with: our own sign-in service; Stripe (name and contact email, for subscription billing)

Restaurant details

What: name, address, phone, email, website, opening hours, menu, photos, logo, social links
From: the owner
Why: publish the restaurant's page and menu
How long: while the restaurant's account exists
Shared with: public on the restaurant's page

Restaurants listed from public sources

What: name, address, public website and social links, opening hours, map location, photos the business published itself or that are free to reuse. No phone numbers.
From: public sources — the business's own pages; map coordinates from OpenStreetMap
Why: help diners find the restaurant before it joins
How long: until the owner claims the page or asks us to remove it
Shared with: public on the listing

Claims and sign-up requests

What: name, email, WhatsApp number, message, language, IP address, the link you arrived from
From: the person claiming or signing up
Why: check the request is genuine and contact the owner
How long: kept as the record of the request; deleted on request
Shared with: no one

Staff accounts

What: name, email, optional phone, role, last sign-in
From: the restaurant
Why: let staff sign in and do their work
How long: while on the restaurant's staff; the sign-in is disabled when removed
Shared with: our own sign-in service

Diner account

What: name, email, optional phone and WhatsApp preference
From: the diner
Why: sign-in, order history, contact about orders
How long: until the diner deletes the account (section 7)
Shared with: the restaurants the diner orders from

Orders

What: items, notes, table number, the name you give, the payment method chosen
From: the diner
Why: the restaurant prepares and delivers the order
How long: kept as the restaurant's record while its account exists
Shared with: the restaurant; the payment provider the restaurant uses

Delivery addresses

What: address, map location, delivery instructions
From: the diner
Why: delivery
How long: until removed or the diner account is deleted
Shared with: the restaurant; map services (MapTiler, OpenStreetMap) when you pick the location on a map

Reservations

What: name, email, phone, party size, date and time, notes
From: the diner
Why: the restaurant manages the booking
How long: kept as the restaurant's record while its account exists, also after the diner deletes their account
Shared with: the restaurant

Chats

What: what you write to the restaurant assistant (and, if you are signed in, your email), to the support chat or to the owner assistant
From: whoever chats
Why: answer you; the owner assistant proposes changes the owner confirms
How long: restaurant assistant — only for the conversation, not saved in our database (your browser keeps a copy until you clear it or sign out); support chat — 30 minutes; owner assistant — the request is not saved, a record of each proposed and confirmed change is kept
Shared with: an outside AI service provider acting on our behalf

Referral links

What: the partner code, the time of the click and a random visitor identifier
From: visitors who arrive through a partner's link
Why: credit the partner who referred a restaurant
How long: cookies up to 365 days; the referral record is kept for partner commissions
Shared with: no one outside PedidoIQ

Security logs

What: IP address, email, the page requested and the action
From: everyone who uses the Platform
Why: security, fraud prevention and investigating incidents
How long: kept long term in a log that cannot be edited
Shared with: no one

Email records

What: recipient, subject, delivery status
From: the emails we send
Why: prove delivery and fix problems
How long: 90 days
Shared with: our email provider

Contact form

What: name, email, subject, message
From: whoever writes
Why: answer you
How long: not saved in our database; kept in our mailbox
Shared with: our email provider

Analytics

What: pages visited, device and browser information
From: visitors who accept analytics cookies
Why: understand how the Platform is used
How long: as set in Google Analytics
Shared with: Google

3. Why we use it

We use personal data to provide the service you asked for (accounts, orders, reservations, listings), for our legitimate interest in keeping the Platform secure and working, with your consent where the law requires it (analytics cookies), and to meet legal obligations. We do not sell personal data and do not use it for advertising.

4. Service providers

An outside AI service provider — the model behind the chat assistants, processing conversations only on our behalf
Stripe — subscription billing for restaurants. Restaurants may also use their own Stripe account to take payment for orders
Cloudflare — network, security and DNS; it sees IP addresses and an estimate of the visitor's country
Hostinger — email delivery
Google Analytics — only after you accept analytics cookies
MapTiler and OpenStreetMap — maps and address lookup
On our own servers: the database, sign-in (Keycloak), file storage and cache

5. AI features

The restaurant chat assistant, the support chat and the owner assistant send what you write, and what they need to answer (such as the menu), to an outside AI service provider acting on our behalf. Answers can be wrong: confirm prices, allergens and availability with the restaurant. Do not write sensitive personal data in a chat.

6. Cookies and storage in your browser

Essential: sign-in session cookies, your language (NEXT_LOCALE), the support chat (chat_sid, 30 minutes) and paired kitchen screens (kds_device, 365 days). Always on — the site cannot work without them.
Referral: pref, pclk and pvid, set only when you arrive through a partner's link, for up to 365 days.
Analytics: Google Analytics cookies, only if you accept them. If you decline, the site works the same. We never use advertising cookies.
Your browser also keeps your cart, your table session and your restaurant-assistant chat on your device.

7. Your rights

You can ask to access, correct or delete your personal data, object to how we use it, withdraw a consent you gave, and — where the law grants it, for example Ecuador's LOPDP or the EU's GDPR — receive your data in a portable format (CSV or JSON). We answer within 30 days.

Diners can delete their account from their account page. That removes the profile, saved addresses and favourites, and unlinks past orders and reservations from the account; the restaurant keeps those records, including the name and contact given for a reservation. You can ask us to remove those details too where the law allows. For data a restaurant controls, we may pass your request to that restaurant.

Send requests to [email protected]. You can also complain to the data protection authority where you live.

8. Where data is processed

Data may be processed in the United States and in other countries where we or our service providers operate.

9. Security

Each restaurant's data is kept in its own database schema, separate from other restaurants. Connections to the Platform use HTTPS, and security events are written to a log that cannot be edited. No system is perfectly secure.

10. Changes to this policy

We may update this policy at any time without notice. The version in force is the one on this page, with its date, and earlier versions stay available here.

11. Contact

Privacy questions: [email protected].