Privacy policy

The data controller for Eaty is BEAU ROMANIA SRL, registered office at Str. Doftanet nr. 201, Bușteni, Prahova County, postal code 107602, Romania, tax ID (CUI) 50630070, Trade Registry no. J2024027087006. For any request regarding your personal data, write to us at suport@eatyapp.com.

The data we collect depends on the type of account you have on Eaty.

All users: name, email, phone number, preferred language, profile picture (optional); your password is never visible to us — it is managed in encrypted form by our authentication provider (Supabase Auth).

Customers: saved delivery addresses (street, number, building/apartment details, notes) together with their GPS coordinates; order history; chosen payment method; a saved-card reference through Stripe (we never see or store your full card number — see section 4); your preference on receiving phone calls from couriers; likes you give (only the total count is public, never who liked what); favourite items.

Couriers: GPS location, collected onlybetween picking up an order from the restaurant and delivering it to the customer, so that customer can see the courier’s live position on the map. Location is not collected outside this window. If you are an independent authorised sole trader (PFA), we also collect your registered trade name, tax ID (CUI/CIF), and fiscal address, required for invoicing and payouts.

Partner restaurants: business data (legal name, tax ID, trade registry number, fiscal address, VAT payer status), required for the partnership contract and for invoicing the commission.

Public forms (e.g. “Become a courier”, “List your restaurant” on eaty.ro): the name and phone number you provide. To prevent abuse of these forms, we temporarily retain a cryptographic fingerprint of your IP address (not the IP address itself), used only to limit the number of submissions.

Demo access (the “See the demo” section on eaty.ro, for restaurants and couriers): your email address, the date you accepted the terms and the date of your last sign-in. We use the email to send you the access details for the simulation and to contact you about a partnership with Eaty. The access password is stored only in encrypted form.

• Creating and managing your account — performance of the contract between you and Eaty.
• Placing, processing, and delivering orders (including validating your address within our delivery zone and communicating with the restaurant/courier) — performance of the contract.
• Processing payments and, where applicable, refunds — performance of the contract.
• Issuing invoices to partner restaurants for the Eaty commission — legal obligation (accounting/tax).
• Sending order status notifications (push, optionally email) — performance of the contract.
• Preventing fraud and abuse (e.g. limiting form submissions) — legitimate interest.
• Improving the service based on likes and feedback — legitimate interest / consent, as applicable.

Card payments are processed entirely by Stripe, a PCI-DSS certified payment processor. Eaty never receives or stores your full card number — only the last 4 digits and card brand, to display it in the app if you choose to save it. For restaurants and couriers, payouts are made through Stripe Connect; bank details (bank name, last digits of the account) remain stored with Stripe — Eaty can look them up on request but does not keep them in our own database.

To validate your delivery address and show you available restaurants, we use Google Maps and the Google Geocoding API (converting a text address to coordinates and back). These requests go through our servers, not directly from the app to Google, and results are temporarily kept in an internal cache to reduce the number of requests. Your GPS location (if you allow it) is used only to suggest your current address when adding a new one — it is not stored beyond the address you choose to save.

We do not sell your personal data. We only share it with the providers strictly necessary for Eaty to work:

• Supabase — hosting for our database, authentication, and files (photos), in the European Union (Ireland).
• Stripe — payment processing and payouts to restaurants/couriers.
• Google — mapping and address geocoding services.
• Expo — delivering push notifications to the mobile apps.
• Vercel — hosting the eaty.ro website.
• Sentry — reporting technical errors in the apps (error type, screen, device and the internal account identifier — no name, email or phone number), so we can fix them quickly.
• The restaurant you order from — receives the name, phone number, and delivery address needed to prepare and hand over your order.
• The courier assigned to your order — receives the delivery address and, if you enabled the option, your phone number so they can contact you about the delivery.

Partner restaurants may receive invoices issued through an e-invoicing provider for the Eaty commission; this flow is technically in place but not yet active as of this version of the policy.

We may disclose data to public authorities when required by law (e.g. tax audits, lawful requests from law enforcement).

We keep your account data for as long as your account is active. Order data (including the delivery address used at the time of the order) is retained for the period required by Romanian accounting and tax law, even after you delete your account — see section 9. The IP fingerprint from public forms is kept temporarily (24 hours), solely to limit abuse.

Under Regulation (EU) 2016/679 (GDPR), you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your account and identifying data (see section 9);
• object to processing based on legitimate interest, or withdraw consent where applicable;
• request restriction of processing, in certain situations;
• receive your data in a portable format;
• lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

To exercise any of these rights, write to us at suport@eatyapp.com.

You can delete your account at any time from the app (Profile → My account → Delete account) or from your web account (My account), except while you have an active order (being prepared or delivered) — in that case, deletion becomes available once the order is complete.

Deletion is permanent and real, not a simple deactivation: your login, profile, saved addresses, saved cards, favourites, and notification tokens are removed from our systems. Previously placed orders remain on record, as required by accounting law, but are disconnected from your identity — they can no longer be linked back to your account after deletion.

The eaty.ro website uses essential cookies, required to keep your login session active (managed by Supabase Auth), which do not require consent. In addition, if you agree through the cookie banner, we use Google Analytics (provider: Google Ireland Limited) for anonymous statistics about site usage: pages visited, device type and completed orders. Without your consent, Google Analytics sets no cookies and collects no data. You can change your choice at any time via the “Cookie settings” link in the page footer. We do not use advertising cookies.

Data is protected through row-level access control (RLS) in our database — each user can only access their own data, except for the minimal information required by partners directly involved in an active order (section 6). Communication between the apps and our servers is encrypted (HTTPS/TLS).

We may update this policy periodically. We will display the last-updated date at the top of the page. If changes are significant, we will notify you through the app or by email.

For any question about how we process your data, write to us at suport@eatyapp.com.