Privacy Policy

The Dishlane platform (dishlane.com) is operated by Quantum AI WebApps Digital LLC ("Dishlane", "we", "us"). Registered address: [registered address — to be inserted].

You can reach us about anything in this policy at join@quantumaiwebapps.com.

Dishlane is software that restaurants use to run their own websites, online ordering, bookings, loyalty and messaging. That means two distinct things happen with personal data, and it is worth being precise about them.

When you browse dishlane.com itself — this marketing site — you are dealing with us directly, and we collect almost nothing (see the Cookies section: there are no trackers here).

When you order from, book at, or join the loyalty programme of a restaurant that runs on Dishlane, the restaurant is the business you are buying from: it sets the menu, takes the payment on its own payment account, and decides how to use its customer relationships. Dishlane stores and processes that data on the restaurant's behalf, under the restaurant's instructions, to make the software work. Our legal counsel is confirming the formal data-protection categorisation of these roles; this section describes what factually happens.

We collect only what each feature needs to function:

• Ordering (pickup, delivery, at-table): your name and phone number, an optional email for the receipt, the order contents, and — only for delivery orders — a delivery address.
• Table bookings: name, phone, email, party size, date and time.
• Catering enquiries: the same contact details plus your enquiry text.
• Loyalty: a profile (phone, name, email, points balance) is created only after a paid order and only if you actively ticked the marketing checkbox — it is unticked by default.
• Gift cards: the purchaser and recipient name, phone and email, so the card can be delivered and redeemed.
• Review requests: your phone number and a tokenised link inviting you to leave a review.
• The AI menu assistant: your chat messages are processed to answer you, but no conversation content is stored on our servers — only usage counters. Your chat history lives solely in your own browser tab.
• Staff and restaurant-owner accounts: name, email and a hashed password.

Card numbers never touch Dishlane. Payments are taken on the payment provider's own hosted checkout pages (Stripe, Square or PayPal, on the restaurant's own account); we store only amounts and payment references. This is the SAQ-A card-data posture: the card data goes provider-direct.

There are no analytics, advertising or tracking technologies of any kind on the platform — not on this site and not on restaurant sites. No Google Analytics, no Meta pixel, no fingerprinting, nothing.

In sketch form, pending counsel's final wording: order, booking, gift-card and catering data is processed because it is necessary to deliver the thing you asked for (performance of a contract). Marketing contact happens only with your consent — the checkbox is unticked by default, in line with UK opt-in rules (PECR), and you can withdraw consent at any time. Security measures such as rate limiting rely on our legitimate interest in keeping the platform safe.

The complete list of third parties that can receive personal data is below — what each one receives and why. There are no others, and none of them are advertising or analytics companies.

The application runs on Vercel (serverless), the database is PostgreSQL hosted on Railway, and media plus encrypted nightly database backups are stored in Cloudflare R2 (bucket region: Western Europe).

The specific Vercel and Railway compute regions are not something we currently publish, so we will not claim "UK-only" processing here: data is processed in those infrastructure providers' EU/UK-adjacent regions, and the definitive region list is available on request.

We use only strictly-necessary and functional cookies and browser storage — six items in total, none of them tracking. The full table, including lifetimes, is in the Cookie Policy at /legal/cookies.

Per-restaurant secrets (payment keys, Twilio tokens) are encrypted at rest with AES-256-GCM and are readable only by platform super-admins. Every restaurant's data is strictly isolated from every other's at the access-control layer. All payment, SMS and WhatsApp webhooks are signature-verified before we act on them. Passwords are hashed (PBKDF2-SHA256). Public endpoints are rate-limited. And, as above, card numbers are never stored — ever.

We do not currently hold any formal security certification (no ISO 27001, no SOC 2) and will not pretend otherwise; the measures above are what actually runs.

Retention, stated plainly:

To access, correct, export or erase your data, email join@quantumaiwebapps.com. We handle subject-access requests manually by email — there is currently no self-service data-export endpoint, and we would rather tell you that than imply a button that does not exist.

For erasure, our operators run a purpose-built tool that anonymises your orders (name, phone, email and notes are removed; the money records stay, per the 6-year bookkeeping retention), deletes your loyalty profile, unsubscribes you from all marketing, deletes review-request tokens, and anonymises bookings and catering enquiries.

Two honest gaps in that tool today: gift card purchaser and recipient details, and wallet passes, are not yet covered by the automated erasure tool — we handle those manually on request, and they are on the roadmap to automate. If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office (ico.org.uk).

You only receive marketing if you opted in — the consent is captured server-side from the payment confirmation, not from an unticked box. Every marketing email carries an unsubscribe link. Replying STOP to an SMS or WhatsApp message always works, even if the restaurant has switched its marketing off.

The platform is not directed at children under 16, and we do not knowingly collect their data. If you believe a child's data has been submitted, contact us and we will remove it.

This page is versioned by its "Last updated" date. Material changes will update that date; while the draft banner is present, expect wording (not practice) to be refined by counsel.

Quantum AI WebApps Digital LLC · [registered address — to be inserted] · join@quantumaiwebapps.com. We aim to reply promptly, but we do not promise a specific response time here that we have not operationally committed to.