Sub-processors

Postgres database, magic-link authentication, file storage (menu photos, brand logos, media library).

For restaurants onboarded by Zay Revenue Group, the platform sends account-management signals (tenant lifecycle, subscription/billing state, aggregate order health) and the owner's contact details to the ZayCRM so the agency can manage the account, support, and billing relationship. No diner/customer data crosses this bridge.

Runs the Next.js application across our four projects (marketing, storefront, admin, operator).

Domain resolution, edge CDN, layer-7 DDoS + WAF.

Card processing for customer orders; per-tenant Connect account flows funds to the restaurant.

Magic-link emails, password reset, order receipts, review-request emails, customer survey invites, owner invitations.

Order status SMS (received / ready / delivered), one-time passwords for customer auth.

AI shift briefing, menu-item description generation, menu photo critique, review-response drafting, support-ticket triage, invoice OCR, PDF menu import.

AI restaurant audit autocomplete, nearby competitor lookup, Google review polling for the operator inbox, eventual response posting. Map images for the store locator are fetched by our servers from Google's Map Tiles API and passed on to the visitor, so the visitor's browser does not contact Google for them. Separately, a diner who chooses "Sign in with Google" authenticates with Google, which returns their name and email address to us.

For tenants that must verify a buyer is 21+, checks the shopper's identity against records databases at checkout and, when that fails, collects a photo ID and a selfie to review manually. Wired for the smoke-shop tenants; no order has been verified through it yet.

Alternative card processor for tenants a mainstream processor will not underwrite. The card number itself never reaches our servers: the storefront's hosted fields exchange it for a single-use token, and we post that token plus the amount. Wired; no tenant is configured on it yet.

Serverless Redis that counts requests per caller so abuse is throttled across instances, and holds the short-lived claim that stops a duplicate email or SMS going out twice. Values expire in minutes to 24 hours.

Suggests and geocodes delivery addresses from the diner's browser when a tenant has no Google Places key configured, so a courier is sent to the right building. A free, key-free community endpoint built on OpenStreetMap; we hold no account with it.

Converts a street address into map coordinates so a courier is sent to the right building rather than a ZIP-code centroid. A public, key-free government service; we hold no account with it.

Our own staff workspace. Tenant provisioning, approval requests, bug and incident notices are posted there so the team can act on them.

Scheduled crons (Google review polling, expire stale announcements, post-delivery survey send, retention sweeps).

When a tenant connects Otter, we receive marketplace order events (DoorDash, Uber Eats, Grubhub) + 86-list state + payout reports.

Books the courier for a delivery order and brokers it to a driver network (DoorDash, Uber). Sends us courier status, courier name, and the live tracking link.

Quotes and books the courier for a delivery order directly with Uber's driver network, and returns courier status, courier name, and the live tracking link.

Second courier network in the delivery dispatch cascade, disclosed ahead of go-live. No order has been dispatched through it and no location is paired yet. Once armed it receives the same delivery details as the other couriers, so a courier can be assigned.

Attributes a paid Zayos signup back to the advertisement that produced it, so paid campaigns can be optimised toward signups rather than clicks. Runs on /start, and on a tenant storefront when that tenant has configured its own Meta pixel, in which case diner page views and purchases are reported to Meta under the tenant's pixel. Suppressed on a Global Privacy Control signal and on the route denylist in app/layout.tsx.

Reports storefront page views and completed orders to the tenant's own Google Analytics property, and, where the tenant has configured Google Ads, the purchase conversion. Enabled only when the tenant supplies its own measurement id. Suppressed on a Global Privacy Control signal and on the route denylist in app/layout.tsx, which withholds the order tracker, review and success pages so the merchant order number is never in a reported URL.

Rates a parcel with the carriers, validates the destination address, and buys the shipping label for a nationwide-shipping order.

Relays a print job from our servers to a location's own thermal printer, so a shipping label prints in the store without anyone opening a dashboard.

Draws the small map on a storefront's homepage and the store locator's map when Google map tiles are not available. On the homepage map the tiles are loaded by the visitor's own browser straight from OpenStreetMap's tile servers; on the store locator our servers fetch them and pass them on. A free community service; we hold no account with it.

Shows a restaurant's own booking calendar inside its Business Room page, only for a restaurant that has set its own KnightsHQ booking link. The calendar is KnightsHQ's page shown in a frame: the guest's browser loads it from KnightsHQ and the booking is made in the restaurant's own KnightsHQ account. Nothing the guest types passes through our servers.

Shows a restaurant's own booking calendar inside its Business Room page, only for a restaurant that has set its own Cal.com booking link. No restaurant has one configured today. The calendar is Cal.com's own script and frame: the guest's browser loads it from Cal.com and the booking is made in the restaurant's own Cal.com account. Nothing the guest types passes through our servers.

Wakes the person on call when something is broken: a refund that failed at the processor, an order stuck in a kitchen, storefronts not serving, a courier booking failing repeatedly. Active only when our on-call key is configured; until then nothing is sent.

When a Zayos sales rep asks, finds the owner or manager of a restaurant we are talking to and returns their business phone and email. Used for our own outreach; no diner data is ever sent.

Stores timing traces and service metrics from our servers so slow or failing requests can be found. Active only when our telemetry endpoint is configured; until then nothing is exported.

Captures unhandled exceptions + performance traces from our four Vercel projects.