Privacy Policy

Dish.ly is operated by [LEGAL NAME], [MAILING ADDRESS]. We are responsible for the personal information we collect through Dish.ly, and we follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Our privacy contact can be reached at info@dish.ly.

Sellers on Dish.ly are independent businesses. When you order from a seller, the seller also receives the information needed to fulfil your order and is responsible for how they use it. Sellers agree to rules about this in the Seller Terms.

• Contact details: your name, email address and, if you give it, your phone number.
• Delivery details: your address and delivery instructions, when you choose delivery.
• Order details: what you ordered, from which seller, for which day and window, notes you add (including any allergy note you choose to write), the amounts, and the status of the order.
• Payment details: for card payments, the card brand and last four digits, and the payment and refund records. Your full card number goes directly to Stripe; we never receive or store it. For e-Transfer orders we record that you said you sent the transfer and when the seller confirmed it; the transfer itself happens at your bank.
• Account details, if you create an account: your email, name, phone, saved address, whether you set a password (the password itself is held in protected form by our login provider), and a reference to a saved card if you choose to save one.
• Email choices: whether you agreed to receive a seller's menu emails, when and where you agreed, and whether you unsubscribed.
• Messages you send to a seller or to us.

• Your name, email address, mobile number, kitchen or business name, city and what you sell.
• Your kitchen address and its map location.
• Your payout details: an e-Transfer email address, or the name on your bank account and its transit, institution and account numbers. Bank numbers are stored encrypted, and only the last four digits are shown on screen.
• The email address customers send e-Transfers to, if you accept them.
• Your menu, photos, logo, cover photo and the text of your order page, which are public.
• Files and messages you send to our menu agent (photos, screenshots, PDFs and chat messages).
• Your acceptance of our terms and your food safety confirmation, with the date, time, wording version and IP address.
• Your orders, payouts, fees, adjustments and the announcements you send.

Like any website, our servers record basic technical information when you use Dish.ly: IP address, browser type, pages requested and the time. We use it to keep the service secure, to limit abuse (for example too many login codes requested) and to fix problems. We do not use advertising trackers and we do not sell or rent personal information.

• To take, confirm, fulfil, deliver, cancel and refund orders, and to show the seller what they need to prepare and hand over.
• To take payments, pay sellers, and keep the financial records the law requires.
• To log you in with an emailed code and keep your account secure.
• To send service emails about an order or account: confirmations, payment instructions, ready and reminder notices, cancellations, refunds and payout notices. These are not marketing and are sent whenever needed.
• To send a seller's menu emails, only if you opted in.
• To build a seller's menu from the files they provide.
• To prevent fraud and misuse, resolve disputes and chargebacks, answer questions, and meet legal obligations.
• To understand, in aggregate, how Dish.ly is used so we can improve it.

We collect only what we need for these purposes. By using Dish.ly you consent to this use. You can withdraw consent to optional uses (such as menu emails) at any time; if you withdraw consent to something an order needs, we may not be able to complete the order.

Many sellers cook at home, so we treat a seller's kitchen address with extra care:

• Before an order is paid, customers see only the general area, for example "Maple, Vaughan".
• The exact address is shown to a customer only after their order is paid, and only when they need it for pickup.
• A seller can choose to hide their address completely. Then pickup and courier delivery are switched off, the seller delivers every order, and customers never see the address.
• When a courier is booked, the kitchen address and the customer's delivery address are shared with the courier service for that delivery.

In the other direction, a customer's delivery address is shown only to the seller fulfilling the order and to the courier, if one is used.

The seller you order from receives your name, contact details, order, notes and delivery address. The customer receives the seller's kitchen name and, under the rule above, the address.

Companies that process information for us. They may use it only to provide their service to us:

• Amazon Web Services hosts Dish.ly: our database, file storage, login system, address search and outgoing email.
• Stripe processes card, Apple Pay and Google Pay payments and refunds, and stores saved cards.
• Uber (Uber Direct) arranges courier deliveries. For those orders only, it receives the pickup and drop-off addresses, both parties' names and phone numbers, delivery instructions and a description of the order.
• Google Analytics measures visits to the site, as described under Cookies.
• Google provides the AI model that reads the menu photos, PDFs and messages a seller sends to our menu agent. Only that material is sent; customer information is not.

Sellers are paid by Interac e-Transfer, so a seller's payout email or bank details are used with our financial institution to send those payments.

Others. We may disclose information when the law requires it (for example to a public health unit investigating a food safety complaint, a court, or tax authorities), to protect someone's safety, to deal with fraud or a payment dispute, or as part of a sale or reorganisation of our business, under equivalent privacy protection.

Outside Canada. Some of these providers store or process information in the United States or other countries, where it is subject to those countries' laws and may be accessible to their courts and authorities.

We follow Canada's Anti-Spam Legislation (CASL). You receive a seller's menu emails only if you asked for them, for example by ticking the box at checkout or asking to be told when the next menu is up. The box is never ticked for you. Each seller's list is separate: opting in to one seller does not sign you up for others.

Every menu email names the seller and has an unsubscribe link that works immediately, with no login. You can also ask the seller or email info@dish.ly. Unsubscribing from menu emails does not stop service emails about orders you place.

• Order, payment, refund and payout records: seven years, because tax and financial laws require it.
• Account details: until you delete your account. Records of past orders are then kept as above, but are no longer linked to a login.
• A seller's customer list entry (your name, email, order totals and email choice): while the seller's store is open, or until you ask for it to be removed.
• Files a seller uploads to the menu agent and the chat with it: up to 12 months, or until the seller asks us to delete them.
• Consent and food safety confirmation records: for as long as the store is open and seven years after.
• Server logs and security records: up to 90 days, unless needed longer to investigate a problem.

When we no longer need information we delete it or make it anonymous.

You have the right to ask what personal information we hold about you, to get a copy, and to have mistakes corrected.

• Customers with an account can see and edit their details and past orders under My account, and can delete the account there.
• Sellers can see and edit their details in Settings and can close their store there.
• Anyone can make a request by emailing info@dish.ly from the address in question. We may ask for a login code to confirm it is you. We answer within 30 days.

When you delete your account we remove your login, saved address and saved card. We must keep order and payment records for the periods above, and we cannot delete information a seller needs for an order still in progress.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Dish.ly is served only over encrypted connections. Sellers' bank details are encrypted in our database. Uploaded menu files are private. Each seller can see only their own customers and orders, and access by our staff is limited to what is needed to run the service. Changing a seller's payout details requires a fresh code sent to their email.

No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify the people affected and the Privacy Commissioner, as PIPEDA requires.

Dish.ly sets two cookies it needs to work: one that keeps you logged in, and a short-lived one that holds your place while you enter a login code. They are set by Dish.ly itself, are not readable by scripts and are not used for advertising. Your cart and checkout details may be kept in your own browser's storage so they survive a page reload. On the payment step, Stripe may set its own cookies to prevent fraud.

We also use Google Analytics to count visits and see which pages are used, so we can improve the site. It sets its own cookies and receives your approximate location (from a shortened IP address), your device and browser type, and the pages you view. We remove the private part of order links before anything is sent, and we do not send your name, email, address or order contents. We do not use it for advertising. You can stop it with your browser's tracking protection or Google's opt-out add-on at tools.google.com/dlpage/gaoptout.

If you block cookies you can still browse and order as a guest, but you cannot log in.

Dish.ly is not meant for children. You must be 18 or older to sell on Dish.ly, and the age of majority in Ontario (18), or have a parent's or guardian's permission, to place an order. We do not knowingly collect information from children under 13; if you believe we have, tell us and we will delete it.

We will update this page when what we do changes; the date at the top shows the latest version. If a change significantly affects how we use your information, we will tell account holders and sellers by email before it takes effect.

Privacy questions and requests: info@dish.ly, or by mail to Privacy, [LEGAL NAME], [MAILING ADDRESS].