Privacy policy

1. Who is responsible for the data

Data about restaurant owners and staff and about people who join the waiting list on the website: Foomy is the controller.

Data about customers who order through a restaurant's app: the restaurant is the controller, and Foomy processes that data on its behalf.

2. Which data

Restaurant account: name, email, WhatsApp number, password (stored only in encrypted form, never as plain text), the date the terms were accepted, and store details (name, address, logo, photos and menu).

Sign in with Google: the name, email and profile picture Google sends.

Orders: the customer's name, phone number, delivery address and order items.

Store riders: name and WhatsApp number, added by the restaurant to receive the route. The route message, with the customer's first name, address and amount to collect, is sent from the WhatsApp of whoever dispatches it.

Tax invoices, at stores in Brazil that issue them: the customer's CPF (Brazilian taxpayer number) and postal code, requested at checkout.

Paying in the app: the customer's CPF and, for cards, the cardholder's email, postal code and street number. Card details only pass through Foomy on their way to Asaas and are not stored.

Restaurant payouts: company and representative details, sent to Asaas to open the store's account. Documents go straight to Asaas.

Restaurant tax details: digital certificate, certificate password and the invoice security code (CSC), stored encrypted.

Website waiting list: name, WhatsApp number, email, business name and type, city, state or country, the language of the page and where the person came from (link or campaign).

Website measurement, only with your consent: pages viewed, clicks and what was done on the page, device, browser and approximate country.

Technical use: IP address and browser data, for security and attempt limits.

3. What we use it for

Creating and keeping the account, showing the menu, getting the order to the kitchen, notifying the restaurant, showing deliveries on the map and building the rider's route, issuing the order's tax invoice (at stores in Brazil that issue them), charging for the order, refunding payments, making withdrawals, sending account emails (confirmation and new password), protecting against fraud and bots, and complying with the law.

Contacting people who joined the waiting list, by email or WhatsApp, and measuring how Foomy's website and ads perform, when you accept measurement.

We do not sell data. We do not use restaurants' customer data for advertising.

4. Legal bases

Performance of the contract, legitimate interest (security and fraud prevention), compliance with legal obligations and your consent: for website and ad measurement and for contact from the waiting list. You can withdraw your consent at any time.

5. Who we share it with

Only with the services Foomy needs to work: Supabase (database and sign-in), Vercel (hosting), Cloudflare (bot check), Resend (sending emails), Google (sign in with Google and the waiting list spreadsheet), Google Maps (receives the delivery address to show the order on the store's map and build the rider's route), Secretaria da Fazenda (tax invoices in Brazil), ViaCEP (address lookup by postal code), Asaas (payments in Brazil), Stripe (payments outside Brazil) and the delivery providers the restaurant turns on.

With your consent in the website notice: Google (Google Analytics, Google Tag Manager and Google Ads) and Meta (Meta Pixel), to measure the website and the ads.

Also with authorities, when the law requires it.

6. Data outside your country

Some of these services store data outside Brazil and outside the user's country, for example in the United States. For these transfers we use the safeguards the law requires, such as the standard contractual clauses offered by these services.

7. Cookies and data on the device

Necessary cookies, always on: the signed-in session, the chosen language and the theme (light or dark).

On the foomy.app website, measurement and advertising cookies (Google Analytics, Google Ads and Meta Pixel) are only loaded after you tap Accept in the notice. If you tap Decline, they are not loaded. To change your choice, clear the site data in your browser and choose again.

The customer's name, WhatsApp number, address, CPF and chosen payment method are saved on the device itself, to fill in the next order at any Foomy store. Foomy never saves card details on the device.

The "Forget my details" button, on the checkout screen, deletes this data.

8. Security

Each restaurant's data is kept separate from the others, the connection is encrypted, passwords are checked against known leaks without being sent to anyone, and sign-in attempts are limited.

The CPF is stored separately from the order and appears masked in the dashboard. The printed tax invoice and the XML file show the full CPF, and only the owner and the manager can download the XML.

9. How long we keep it

While the account is active. After it is closed, we delete the data or make it anonymous, except what the law requires us to keep, such as tax invoices.

Waiting list data: until you ask to leave the list or until the list is no longer used.

10. Your rights

You can confirm whether we handle your data, see it, correct it, ask for a copy, ask for it to be deleted or made anonymous, know who we share it with, and withdraw a consent.

People in the European Union can also object to the processing, ask for it to be restricted and ask for their data in a format they can take to another service.

Customers of a restaurant can ask the restaurant itself or us, and we will pass the request on.

11. Contact

To exercise your rights or ask questions, contact our data protection officer: contato@foomy.com.br.

You can also file a complaint with Brazil's National Data Protection Authority (ANPD) or with the data protection authority in your country.

12. Changes to this policy

Before an important change, we let you know by email or in the dashboard.