Privacy policy.

When you sign up + use Zayos:

• Business identity: legal name, DBA, EIN, contact email + phone
• User identity: name, work email, password (stored hashed), MFA tokens
• Stripe Connect onboarding: bank routing + ID verification. Stripe collects these directly; we never see them
• Operational data: menu, prices, hours, staff, orders, refunds, reviews, integrations
• Usage data: pages viewed, features used, error logs (IP + user agent) so we can debug and improve the product
• Communications: support tickets, broadcasts you send, messages exchanged with us

• Run the platform you signed up for (orders, payments, dispatch, etc.)
• Bill you accurately
• Reach you about your account, security, and material product changes
• Aggregate (anonymized) usage to publish industry benchmarks and improve the product. Never tied back to your business by name.
• Comply with tax + AML + KYC obligations (Stripe Connect, IRS reporting)

We don't sell your data. We don't use your data to train models that another operator gets to see. Your menu is your menu.

Strictly the providers we need to run the service:

• Stripe: payments, KYC, payouts
• Supabase: managed Postgres, auth
• Vercel: application hosting
• Supabase Storage: file storage (logos, menu photos)
• Resend: transactional email
• Twilio: SMS
• Otter: marketplace order ingestion (DoorDash, Uber Eats, Grubhub, Postmates)
• Shipday: delivery dispatch (diner name, delivery address, phone go to the courier network)
• Uber Direct: delivery dispatch (diner name, delivery address, phone go to the courier network)
• DoorDash Drive: delivery dispatch, disclosed ahead of go-live and not yet dispatching orders (when armed: diner name, delivery address, phone go to the courier network)
• Shippo: shipping rates and carrier labels for nationwide-shipping orders
• PrintNode: cloud printing relay to a location's own printer
• AgeChecker.net: age / identity verification for 21+ tenants (name, address, date of birth, email, IP; a government ID photo and a selfie when a records match fails). Wired for the smoke-shop tenants; no order has been verified through it yet
• NMI: card processing for tenants a mainstream processor will not underwrite (diner email, single-use card token, amount; never the card number). Wired; no tenant is configured on it yet
• U.S. Census Bureau geocoder: turns a delivery address into map coordinates so the courier is sent to the right building (the address line only, no name or phone)
• Upstash: rate limiting and send-once claims (keys derived from the caller's IP address)
• Slack: our own staff workspace, where tenant provisioning, approval and incident notices are posted (restaurant owner and Zay staff email addresses; no diner name, address or payment data)
• OpenStreetMap: map images when Google map tiles are not available. On a storefront's homepage map the visitor's own browser loads the tiles, so OpenStreetMap sees their IP address
• KnightsHQ: a restaurant's own booking calendar, shown in a frame on its Business Room page only when the restaurant has set its own booking link (the guest's browser contacts KnightsHQ, and the booking details the guest enters go to KnightsHQ directly)
• Cal.com: the same, for a restaurant that has set a Cal.com booking link. No restaurant has one configured today
• PagerDuty: on-call alerting for our own engineers (alert text, order numbers and restaurant ids; no diner name, contact or payment detail). Active only when our on-call key is configured
• Axiom: performance traces and metrics from our servers (request routes with tokens redacted, timings, status codes; no request bodies). Active only when our telemetry endpoint is configured
• Inngest: durable job queue
• Sentry: error monitoring
• Zay Revenue Group (ZayCRM): for restaurants onboarded by Zay Revenue Group, account-management and billing signals (the owner's contact details plus subscription, billing, and aggregate order health; no diner data), hosted on Fly.io

Each is bound by written data-protection terms with Zayos: the vendor's own data processing addendum where it publishes one, otherwise the data-protection terms of its standard agreement and privacy notice. /zayos/legal/subprocessors links whichever document applies to each vendor. We periodically audit which sub-processors access which data. Adding a sub-processor requires 30 days notice via email and a posted update at this URL.

Application + database in US-East (Vercel + Supabase Pro). Backups are encrypted and run in two layers: whole-database point-in-time recovery for 7 days, and a per-restaurant encrypted snapshot retained 90 days. We're not yet certified for EU data residency. If you're an EU operator with a residency requirement, talk to us before signup. We have a Canada-region path queued.

• Active account: as long as your account is active
• Order + payment records: 7 years (US tax retention)
• Audit logs: 13 months (SOC-2 alignment)
• Cancelled account: anonymized within 90 days of cancellation request, except records covered by tax retention

Access + export: /app/settings/data → Export data. JSON bundle within 30 days, sooner usually within an hour.

Correction: edit profile fields directly; for fields you can't edit (legal name, EIN), email us.

Deletion: /app/settings/data → Delete account, or email us. We anonymize PII in 30 days; tax-retained records persist with name/email stripped.

Opt out of marketing: we don't send marketing email to operators by default: only product, security, and billing communication. If we ever do, every email will include a one-click unsubscribe.

GDPR / CCPA / CPRA: if you're in the EU, UK, or California and want a formal request processed under those frameworks, email abdallah@zayrev.com with subject "DSR request" (30-day SLA).

Concrete security measures we ship today:

• Postgres Row-Level Security on every multi-tenant table
• TLS 1.2+ in transit, AES-256 at rest (Supabase Pro)
• Stripe Connect handles all card data; we never see a PAN
• Webhook payloads are HMAC-SHA256 signed with replay defense
• MFA available for every operator account; required for owner role once > 2 locations
• Audit logs on every operator-initiated mutation
• Rate limiting on auth, OTP, password-reset, and money-moving routes

For a fuller picture see /zayos/legal/security.

We use first-party cookies for session auth, language preference, and cart state. We don't use cross-site tracking cookies on our marketing site (no Google Analytics, no Facebook Pixel). On the operator dashboard we use an essential analytics cookie to count active sessions per tenant; you can disable it in /app/settings/privacy.

We don't have a designated DPO under GDPR Article 37 (we're below the threshold). Privacy questions go to abdallah@zayrev.com. If you're not satisfied with our response, you can lodge a complaint with your local supervisory authority.