Privacy Policy — United States

Last updated and effective: October 28, 2026 · This policy applies to people in the United States who use Click2Bite: business owners and their teams, and customers who order from a U.S. business through Click2Bite.

1. Who we are

Click2Bite (“Click2Bite”, “we”) provides an online ordering platform for restaurants, bakeries, florists, shops and other businesses.

Privacy contact: [email protected] or our contact form (choose “Privacy and personal data”). Businesses can also write to us from their dashboard in Help & support.

2. Two different roles

• For business accounts (owners, managers, kitchen devices, subscription and support), Click2Bite decides how the information is used.
• For customers who order, the business you order from is responsible for your information and Click2Bite acts as its service provider (processor): we use your information to take, charge, track and deliver your order and to provide the features the business uses, following its instructions and the law. The business is responsible for what else it does with your information.

3. Information we collect

Sensitive information: other than precise geolocation, which is used only to deliver your order, we do not ask for sensitive information. If you write an allergy or other health detail in your notes, it is used only so the business can prepare your order; please include only what is necessary. We do not create profiles or inferences about you.

Google user data: when an owner connects Google, we request permission to manage their Google Business Profiles (business.manage) only to list their locations, publish, check and remove the “Order online” button with their Click2Bite link, and read or update their menu when they ask. We do not read or post reviews, messages or photos, we do not share this data, and we do not use it for advertising or to train AI models. Owners can disconnect at any time from the dashboard or at myaccount.google.com/permissions. Click2Bite's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Kitchen tablets and QR labels: a kitchen tablet is an account without a person's name, email or password. When you scan a business's QR label we only add one to a daily counter; we do not record who scanned it.

4. How we use information

To create and run accounts; take, charge, prepare, track and deliver orders; apply promotions and loyalty rewards and prevent their abuse; send the order updates you turn on; bill subscriptions; give support; keep the platform secure and prevent fraud; and comply with the law. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or profiling. We use sensitive information only to provide the service you request.

Automatic rules: a one-time gift or the free trial is not applied if the same phone or card already used it; repeated sign-in attempts are paused for a while; an order is refunded automatically if the business does not accept it in time; and an unpaid business account is paused and later deleted as described in the Terms. If you think a rule affected you by mistake, contact us and a person will review it.

Reminders and promotions from the business (your choice)

On the Pro and Chain plans, a business can see its customer list (name, phone, number of orders, amount spent and loyalty card) and send you, from its own WhatsApp, a reminder, a notice that your loyalty reward is ready, or a promotion. This happens only if you tick “I want [business] to send me reminders, loyalty card updates and promotions on WhatsApp” when you pay (the box is unticked); we keep a record of the text, version, date, channel and business. Click2Bite only prepares the message; we do not message you ourselves. You can withdraw at any time on your order page (“I don't want them anymore”), by telling the business or by writing to [email protected]; from then on the business no longer gets the button to message you. Message and data rates may apply.

5. How we disclose information

• The business you order from, which receives your order details to prepare and deliver it.
• Service providers that act on our behalf under contract: Stripe (payments and subscriptions), Google (Maps to locate addresses; Business Profile only with the owner's authorization), our cloud hosting provider, our network security and content delivery provider (Cloudflare), the email service that delivers our messages, and browser notification services (Google, Apple, Mozilla) if you turn on alerts.
• Authorities, when required by law, subpoena or court order, or to protect the rights and safety of people and the service.
• A successor, if Click2Bite is involved in a merger, acquisition or sale of assets; this policy will continue to protect your information.

In the last 12 months we have disclosed the categories in section 3 only to these recipients and for these business purposes. We do not sell or share personal information, including of consumers under 16. California residents: we do not disclose personal information to third parties for their own direct marketing.

6. Cookies, Do Not Track and Global Privacy Control

We use cookies and browser storage to make the site work (session, form security, language, country, recent order, cart) and for our own first-party measurement (where orders come from, label scans and invitations between businesses). No advertising cookies, no cross-site tracking and no third-party analytics. Because we do not track you across sites, Do Not Track signals do not change how we operate; we also treat a Global Privacy Control signal as a request to opt out of sale or sharing, which we do not do in any case. You can block or delete cookies in your browser; without them you cannot sign in to the dashboard and your cart is not kept, but you can still see menus. See every cookie in our Cookie Policy.

7. How long we keep information

• Accounts: while the account is active, and afterwards only as long as needed for legal, tax or dispute purposes.
• Orders: while the business's account exists, so it can see its history. The driver's location is kept only during the delivery and deleted the next day.
• Support tickets: while the business's account exists. Kitchen connection codes: one day. Technical logs: 14 days.
• If a business stops paying, its account and its customers' data are deleted after 90 days, as described in the Terms.

8. Security

We use administrative, technical and physical safeguards: encrypted connections (HTTPS), one-way password hashing, two-step verification (mandatory for Click2Bite administrators and available to every business account), encrypted Google permissions, a database that is not reachable from the internet and runs with minimum permissions, separation between businesses, limits on repeated attempts, and database backups. No system is perfectly secure; if a security breach affects your personal information, we will notify you and the authorities as required by applicable state law.

9. Children

Click2Bite is not directed to children under 13 and we do not knowingly collect their personal information. Business accounts are only for people 18 or older. If you believe a child under 13 gave us information, contact us and we will delete it.

10. Your privacy rights

Depending on your state (for example California, Colorado, Connecticut, Oregon, Texas or Virginia), you may have the right to: know and access the personal information we hold about you and get a portable copy; correct it; delete it; opt out of the sale or sharing of personal information, targeted advertising and profiling (we do none of these); limit the use of sensitive personal information (we use it only to provide the service); and not be discriminated against for exercising your rights. We offer these rights to everyone in the United States.

1. Send your request to [email protected] or through the contact form (“Privacy and personal data”), or from Help & support if you are a business.
2. Tell us your name, how to reach you, what you are asking for and the phone or email you used. We will verify your identity by matching those details and may ask for more information. An authorized agent can submit a request with your signed permission.
3. We respond within 45 days. If we need more time (up to 45 additional days), we will tell you why.
4. Appeals: if we decline your request, you can appeal by replying to our answer with the word “Appeal”. We will respond within 60 days. If you are not satisfied, you can contact your state Attorney General.

If your request is about an order, the business is responsible for your information: we will forward it and help the business respond.

Processing location: your information may be processed in the United States, Mexico and other countries where our service providers operate, with the safeguards described in this policy.

11. Changes to this policy

We post any change on this page with its effective date. If a change is material, we will also announce it on the site and in the businesses' dashboard, and ask for your consent where the law requires it. You can review and update your account information in your dashboard or by contacting us.