Privacy Policy

Information you give us directly:

• Account information — name, email address, and password when you sign up
• Profile information — phone number, delivery address, and profile photo if you choose to add them
• Order information — name, phone, email, delivery address, and the items you order
• Restaurant information — if you're an owner, the details you provide about your restaurant including name, address, hours, menu, and photos
• Reviews and contributions — text, ratings, and photos you submit
• Payment information — if you purchase a subscription, payment is processed by Stripe. We do not store your full card number or banking details on our servers.

Information collected automatically:

• Location — approximate location (city/region) inferred from your IP address, or precise location if you grant browser permission to use it for nearby restaurant search. We do not track your location in the background.
• Usage data — pages visited, restaurant pages viewed, and features used, to help us understand how TakeOwl is being used and where to improve
• Device and browser data — browser type, operating system, and IP address, used for security and to ensure the site works correctly

• To operate the Service — creating accounts, processing orders, sending order notifications
• To communicate with you — order confirmations, status updates, and responses to your support requests
• To personalize your experience — defaulting your search to your saved address, pre-filling order forms
• To improve TakeOwl — understanding which features are used, diagnosing bugs, and making the product better
• To process payments — subscription billing through our payment processor, Stripe
• To enforce our Terms of Service and protect the security of the platform

We do not:

• Sell your personal information to third parties
• Use your data to serve you third-party advertisements
• Share your order history or personal details with restaurants beyond what is necessary to fulfill your order

We share your information only in the following circumstances:

With restaurants, to fulfill your orders:

When you place an order, we share your name, phone number, email, order details, and delivery address (if applicable) with the restaurant you ordered from. This is necessary for them to prepare and fulfill your order.

For legal reasons:

We may disclose your information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of TakeOwl, our users, or the public.

In connection with a business transfer:

If TakeOwl is acquired, merged, or its assets are transferred, your information may be transferred as part of that transaction. We will notify you before your data is subject to a materially different privacy policy.

TakeOwl relies on a small set of trusted service providers to operate. Each receives only the data it needs to perform its role, and each is bound by its own terms and privacy policy.

• Supabase — database, authentication, and file storage. All user account data, restaurant data, orders, and uploaded photos are stored on Supabase under row-level security.
• Stripe — payment processing for orders and subscriptions, including Stripe Connect (restaurant payouts) and Stripe Terminal (in-person card readers). Card data is tokenized by Stripe and never touches TakeOwl's servers.
• Intuit (QuickBooks Online) — when a restaurant owner connects QuickBooks Online, we send daily Z-out summary totals (dollar amounts, dates, and references to QBO Chart of Accounts entries — no diner or staff PII) and read their Chart of Accounts (account names and IDs). Required only for owners who choose to enable accounting sync. See Section 5 for details.
• Resend — transactional email delivery for order confirmations, Z-out reports, password resets, and other account notifications.
• Twilio — SMS delivery for reservation reminders and staff shift notifications. SMS is opt-in.
• Mapbox — maps, geocoding, and restaurant location services. Mapbox may receive addresses you search for.
• Google Places API — address autocomplete when you type an address. The text you type is sent to Google to return suggestions.
• Anthropic (Claude API) — used as an admin tool to scrape menus from a restaurant's own website during onboarding. Only the public URL of the restaurant's site is sent; no diner or staff PII is shared with Anthropic.
• Vercel — hosting infrastructure. Vercel serves TakeOwl's web traffic and may process HTTP request metadata (IP addresses, user agents) for routing and abuse prevention.

Restaurant owners may optionally connect their QuickBooks Online (QBO) account to sync daily Z-out totals into their accounting system. The integration is provided in partnership with Intuit, Inc. and is governed by Intuit's own terms and privacy policy in addition to this Privacy Policy.

Data we send to Intuit:

Daily Z-out summaries as Journal Entries — dollar amounts, transaction dates, and references to entries in the owner's QBO Chart of Accounts. No diner names, staff names, contact details, payment-card data, or other personally identifiable information is sent to Intuit.

Data we receive from Intuit:

Chart of Accounts metadata (account names and IDs) so the owner can map TakeOwl categories to their accounting structure. We do not read, store, or import any other QuickBooks data.

How OAuth tokens are stored:

OAuth access tokens and refresh tokens are encrypted at rest using AES-256-GCM with a per-deployment key. Each connection is scoped to a single restaurant via row-level security, so tokens for one restaurant are never accessible to users of another.

Token retention:

Tokens are retained for as long as the owner keeps the integration connected. When the owner disconnects, the connection is soft-deleted: encrypted tokens are nullified immediately, while the audit record (when the connection existed, when it was disconnected) is retained for financial record-keeping.

Right to disconnect:

Owners can disconnect QuickBooks Online at any time from the Subscription tab of the Manage Restaurant page. Disconnection takes effect immediately — TakeOwl will stop sending Journal Entries to Intuit and the stored tokens will be nullified within seconds.

We retain your account information for as long as your account is active. If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where we are required to retain it for legal or accounting purposes.

Order records may be retained for longer periods for financial record-keeping and dispute resolution purposes.

Cascade to third-party integrations. For restaurant owners with active integrations (such as QuickBooks Online), account deletion cascades to those connections: OAuth tokens are nullified immediately, and connection records are hard-deleted after a 30-day cooling-off window during which deletion can be reversed by contacting support.

TakeOwl uses browser cookies and local storage to keep you signed in, remember your preferences (such as your saved address), and understand how the site is used. We do not use advertising cookies or cross-site tracking cookies.

You can disable cookies in your browser settings, but some features of TakeOwl may not work correctly without them.

We take reasonable technical and organizational measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These include encrypted data transmission (HTTPS), secure authentication, access controls on our infrastructure, and encryption at rest (AES-256-GCM) for sensitive credentials such as third-party OAuth tokens.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

You have the following rights regarding your information:

• Access and update — you can view and edit your profile information at any time in Account Settings
• Delete your account — you can request account deletion by emailing us at hello@take-owl.com
• Disconnect integrations — if you are a restaurant owner, you can disconnect QuickBooks Online or any other connected integration at any time from the Manage Restaurant page
• Opt out of emails — you can unsubscribe from non-essential emails using the link in any email we send
• Location — you can deny or revoke location access through your browser settings at any time
• Data portability — you may request a copy of your personal data by emailing us

If you are located in the European Economic Area or California, you may have additional rights under applicable law, including the right to object to certain processing. Contact us to exercise any of these rights.

TakeOwl is not directed at children under the age of 13, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child under 13, we will take steps to delete it promptly. If you believe this has occurred, please contact us.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We will provide at least 30 days' notice before any material changes to this Privacy Policy take effect — for example, by posting a notice on TakeOwl or by sending an email to the address on your account.

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact us: