1. Who we are
Munchease (“we”, “us”) is a Trinidad & Tobago-based operation trading under the Munchease name. This policy covers our diner-facing site and app, and the operator “cockpit” used by restaurants. If the underlying entity is formalised (e.g. registered as a limited company or sole trader), this policy will be updated to name it.
A note on roles. When you place an order or booking with a restaurant, both Munchease and that restaurant handle your information. Munchease runs the platform; the restaurant uses your details to fulfil your order. Each restaurant is responsible for its own use of the information it receives.
2. The information we collect
2.1 Information you give us
- Ordering as a guest. To place an order or booking without an account, we collect your name and phone number (both required so the restaurant can fulfil and reach you), an optional email (only to send you a tracking or confirmation link), and any order notes or special instructions you add.
- Account information. If you create an account, we collect your email address and, if you choose to add them, your name, phone number, profile photo, gender, and date of birth. Gender and date of birth are optional; date of birth is not used as an age gate. Your sign-in is handled by our authentication provider (see §6).
- Preferences. Your notification and marketing preferences (marketing is off by default — we only send marketing if you opt in), preferred search distance, and the restaurants you save.
- Reviews. If you review a restaurant after an order, we collect your rating, review text, and any photos you attach. Reviews are tied to a completed order and are shown publicly with your account name.
- If you run a restaurant. For operators we collect the account email of each team member, invitation emails, and the business's own published contact details (phone, email, WhatsApp, socials, addresses). If you contact us as a prospective business, we collect the details you submit (name, email, phone, restaurant name, location, and your message), along with your consent choices.
2.2 Information collected automatically
- Location (only with your permission). To show restaurants near you, we ask your browser for your location. If you allow it, your approximate coordinates are stored on your device and sent to our servers only to run that search — we do not save your location to your profile or order history. You can decline, and search by other means.
- Usage and device information. When you use the platform we and our providers may process standard technical data (e.g. IP address, device/browser type, pages viewed, and actions such as placing an order) to operate the service, keep it secure, and improve it. We keep anonymous counts of restaurant and promotion views (no identity attached to those counts).
- Cookies and local storage. See §7.
2.3 Payments
Munchease does not take payments in the app and does not collect or store card or bank details. You pay the restaurant directly — in person at pickup, or by arrangement over WhatsApp. Any payment you make is handled by you and the restaurant.
3. How we use your information
- To provide the service: show menus, take and route orders and bookings, generate pickup codes and order-tracking links, and let restaurants prepare and fulfil them.
- To show relevant restaurants, including nearby ones when you share your location.
- To communicate with you: order and booking confirmations and status updates (by email, and — if you order via WhatsApp — through the WhatsApp message you send).
- To improve and secure the platform: understand which features are used, diagnose errors, prevent abuse, and enforce our terms.
- For marketing, only where you have opted in; you can opt out at any time.
- To produce aggregated, anonymised insights about the food industry (for example, which kinds of menus or times perform well). See §5 — these never identify you.
Where the law requires a legal basis, we rely on: performing our contract with you (to provide the service), your consent (location, marketing, optional profile details), and our legitimate interests (security, preventing fraud, and improving the platform), balanced against your rights.
4. When we share information — and when we don't
With the restaurant you order or book with. They receive what they need to fulfil your order: your name, phone number, any email you gave, and your order or booking details.
A restaurant only ever sees its own customers. A restaurant can see the details and order history of people who ordered at its branches — never diners who only dealt with other restaurants. Your relationship is with the restaurant, not spread across the platform. This is a core commitment, and it is enforced in how the system is built.
We never sell your personal information, and we do not let one restaurant advertise to another restaurant's customers using their identity.
Aggregated, anonymised insights. We may combine data across the platform to produce industry insights that we share back with restaurants (see §5). These are always aggregated and cannot identify you.
Service providers (sub-processors). We use trusted providers to run the platform (see §6). They may process personal information on our behalf, only for us and under appropriate safeguards.
Legal and safety. We may disclose information where required by law, to enforce our terms, or to protect the rights, safety, or property of Munchease, our users, or the public.
5. Aggregated insights (how “helping the industry” stays private)
We believe the platform should make the local food industry stronger. To that end we analyse platform-wide patterns and share findings back with restaurants. We hold to these limits:
- Insights are aggregated across many businesses and reported only where no single business or person can be identified from them.
- Insights flow back to the restaurants that generate them — we do not sell one restaurant's advantage to another, or a diner's activity to anyone.
- We never re-identify or target a specific restaurant's named customers on behalf of another restaurant.
- Any diner-behaviour insight is a trend across many people, never an individual profile put on display or sold.
6. Service providers (sub-processors)
We rely on the following providers to run Munchease. Data regions reflect the current deployment.
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database, sign-in/authentication, and file storage. | United States (US East) |
| Resend | Transactional email (order + booking confirmations and updates). | United States |
| Google Maps / Places | Maps in the operator cockpit; one-time import of public business details. | Global (Google) |
| PostHog | Product analytics — associated with an internal ID only, not your name/email/phone. | United States |
| Sentry | Error monitoring to diagnose crashes. | United States |
| Vercel | Hosting our diner and operator websites. | United States (global edge) |
| Fly.io | Hosting our application servers. | United States (US East) |
| WhatsApp (Meta) | If you choose to send your order via WhatsApp, your message goes through WhatsApp. | Governed by WhatsApp's own policy |
7. Cookies and local storage
We use a small number of cookies and on-device storage items:
- Sign-in cookie — keeps you logged in (set by our authentication provider). Strictly necessary.
- Guest cookie (mc_cw_guest) — a random identifier so we can remember a browsing session and merge your recent activity into your account if you sign up. It holds no name, email, or phone, is not shared across our other sites, and expires after about 90 days.
- On-device storage — your cart, your last-used location (up to ~24 hours), and, for dine-in, your table session. These stay on your device.
- Analytics cookies — if analytics is enabled, our analytics provider sets its own identifiers.
You can clear cookies and local storage in your browser at any time; some features (like staying signed in or keeping your cart) may then not work.
8. How long we keep information
- Order, booking, and review records are kept for as long as needed to provide the service, support restaurants, and meet legal, accounting, and dispute-resolution needs.
- Account information is kept while your account is active; you can ask us to delete it (see §9).
- Guest browsing identifiers expire after about 90 days; on-device location is kept for about 24 hours on your device.
- Anonymous view counts are retained as aggregate statistics.
9. Your rights and choices
Subject to Trinidad & Tobago's data-protection law, you may:
- Access the personal information we hold about you.
- Correct information that is inaccurate or incomplete (account holders can edit much of this directly).
- Delete your account and associated personal information, subject to records we must keep by law.
- Opt out of marketing at any time (it is off unless you opt in).
- Withdraw consent you have given — for example, turn off location sharing in your browser.
To exercise any of these, contact us (§14). We may need to verify your identity first. If you ordered as a guest, contact us with the phone number used so we can locate your records.
10. Children
Munchease is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.
11. International transfers
Munchease operates in Trinidad & Tobago, but several of our providers (§6) store and process information on servers outside T&T, including in the United States. Where we transfer information across borders, we take steps intended to keep it protected consistent with this policy and applicable law.
12. Security
We use technical and organisational measures to protect personal information, including access controls, encryption in transit, and limiting who can see what (for example, restaurants see only their own customers). No system is perfectly secure, but we work to protect your information and to respond appropriately if something goes wrong.
13. Changes to this policy
We may update this policy as the platform changes. We will post the updated version with a new “Last updated” date and, where changes are significant, take reasonable steps to let you know.
14. Contact us
Questions, requests, or complaints about privacy: privacy@munchease.io. You also have the right to complain to the relevant data-protection authority in Trinidad & Tobago.