Privacy Policy

1. Who we are

Dyne is operated by Cesar Ian Lesmoras, an individual based in Pagadian City, Philippines. For information about restaurant accounts and visitors to our website, we are the personal information controller under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, the “DPA”).

Our Data Protection Officer is Cesar Ian Lesmoras. Contact them at support@dyne.menu about anything in this policy.

2. Who this policy covers

• Restaurant users: managers and staff who sign in to a Dyne back office or kitchen screen.
• Guests:people who scan a table's QR code to see a menu, order, or call a waiter. See section 6, because the restaurant controls guest data.
• Website visitors: anyone browsing dyne.menu.

3. What we collect

From restaurant users

• Account details: name, email address, role (manager or staff) and the restaurant you belong to. If you sign up with a password, it is stored only as a secure hash. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Restaurant details: restaurant name, web address, logo, currency, theme, menu items, prices, photos, tables and settings.
• Billing details: your plan, subscription status, billing dates and a Paddle customer ID. Paddle collects your payment card and billing address. We never see or store full card numbers.
• Notification details:if you turn on order notifications on a device, we store that browser's push subscription (a delivery address and encryption keys) so we can send it alerts.
• Messages: anything you send us by email or WhatsApp.

From guests

• The order itself: items, options, quantities, any notes typed in, the table, and the time. We also record waiter and bill requests.
• We don't ask guests for a name, phone number, email or payment. Please don't put personal or sensitive information in order notes.

From everyone

• Technical data: our hosting and database providers automatically log IP addresses, browser type and request times. These logs are used for security and troubleshooting.
• Website visits:on our website pages (not restaurant menus or ordering), we count page views with Vercel Web Analytics: the page, the referring site, and the visitor's country, browser, operating system and device type. It uses no cookies and doesn't identify or track you across sites or days.
• Ad measurement, only if you allow it: on our website and sign-up pages (not restaurant menus or ordering), the Meta Pixel can record the pages you visit and whether you sign up, and set a Meta cookie. It loads only after you choose Allow on our cookie banner. See sections 5 and 9.

We don't knowingly collect sensitive personal information, as the DPA defines it.

4. How we use it, and our lawful basis

• To provide Dyne: run your account, show your menu to guests, deliver orders to your kitchen, and send sign-in and password emails. This is necessary for our contract with you.
• To handle billing: manage your trial and subscription, and email you before your trial ends. This is necessary for our contract, and to meet tax and accounting obligations.
• To improve our website: see which pages people visit and how they found us, from the anonymous visit counts above. This is our legitimate interest in running and promoting Dyne.
• To measure and improve our ads: see whether our Facebook and Instagram ads lead to visits and sign-ups, and show our ads to people who visited our website. This is based on your consent, which you can withdraw at any time (section 9).
• To keep Dyne secure: prevent fraud and abuse, and fix problems. This is our legitimate interest in running a safe service.
• To support you: reply to your messages and tell you about important changes to Dyne or these policies.
• To comply with the law: where a valid legal request or obligation requires it.

We don't sell or rent personal information, and we don't use it for advertising or send marketing emails without your consent.

5. Who we share it with

We use a small number of service providers, who process information only on our instructions and under their own security commitments:

• Supabase: database, sign-in and file storage. Our database is hosted in Singapore.
• Vercel: website and app hosting, served from data centres worldwide, including the United States, and anonymous visit counts for our website pages.
• Paddle: payments, invoicing and tax, as our Merchant of Record. Paddle handles payment details under its own privacy policy.
• Resend: sending account and billing emails.
• Google: only if you choose to sign in with Google.
• Meta Platforms: only if you allow the ad cookie on our website. Meta receives what the Meta Pixel records (section 3) and handles it under its own privacy policy, which may include using it for its own purposes.
• Push notification services run by browser makers (such as Apple, Google and Mozilla): to deliver order alerts to devices that turned them on.

Inside Dyne, staff of a restaurant can see that restaurant's orders and settings, and never another restaurant's. We may also disclose information if the law requires it, to protect someone's safety, or to someone who takes over Dyne, who must honour this policy.

6. Guest data and the restaurant's role

When a guest orders, the information goes to that restaurant. The restaurant is the personal information controller for it, and Dyne is its personal information processor. We store and process guest data only to run the restaurant's menu and ordering, never for our own purposes. If you are a guest and want to access or delete information about your order, please ask the restaurant. You can also contact us at support@dyne.menu, and we will help the restaurant respond.

7. International transfers

Dyne serves restaurants in the Philippines, Sierra Leone and elsewhere. Your information is stored in Singapore and may be processed in other countries where our providers operate, including the United States, the United Kingdom and the European Union. Whatever the location, we remain responsible for it under the DPA, and we only use providers that commit to appropriate security and confidentiality. By using Dyne from outside these countries, you understand your information will be transferred to them.

8. How long we keep it

• Restaurant accounts, including menus, orders and staff logins, are kept while the account exists. That includes after a trial ends or a subscription is cancelled, so you can come back without starting over.
• Deletion on request: email support@dyne.menufrom your account's email address, and we will delete your restaurant and its data within 30 days. Copies in backups are removed as those backups expire.
• Billing records are kept as long as tax and accounting law requires, by us and by Paddle.
• Push subscriptions are deleted when you turn notifications off or the browser revokes them.
• Server logs are kept for a short period set by our providers.

9. Cookies and browser storage

Dyne only uses storage that is needed for it to work, plus one advertising cookie on our website if you allow it. We don't use analytics cookies: our website's visit counts (section 3) work without cookies or browser storage.

• Sign-in cookies keep restaurant users signed in.
• Browser storage on guests' phones holds the cart and a list of recent orders, so a guest can return to them. Recent orders are dropped after 12 hours. This data stays on the phone until then.
• Paddle may set its own cookies when the checkout opens, to process payment and prevent fraud.
• Meta's ad cookie(_fbp), only on our website and sign-up pages and only if you choose Allow. We remember your answer in your browser's storage. Restaurant menus and ordering never load it.

Change your cookie choiceWithdrawing consent stops the pixel and removes Meta's cookie from our site.

10. Security

All traffic to Dyne is encrypted with HTTPS. Passwords are hashed. Each restaurant's data is separated by access rules in the database. Only the operator has administrative access. No system is perfectly secure. If a breach affects your personal information, we will notify you and the National Privacy Commission as the DPA requires, generally within 72 hours of learning of it.

11. Your rights

Under the DPA, you have the right to:

• be informed about how your personal information is processed;
• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• object to processing, or ask us to block or delete your information;
• receive your information in a commonly used electronic format (data portability);
• be compensated for damages caused by inaccurate, unlawfully obtained or misused information; and
• file a complaint with the National Privacy Commission.

To exercise any of these, email support@dyne.menu. We may ask you to confirm your identity, and we will reply within 30 days. Where the law of your own country gives you similar or additional rights, we will honour them in the same way.

12. Children

Restaurant accounts are for adults aged 18 and over. Guests of any age may order from a restaurant's menu, but we don't ask for or knowingly collect personal information about children.

13. Changes to this policy

If we make a material change, we will email restaurant account holders before it takes effect and update the date at the top of this page. See also our Terms of Service.

14. Contact

Cesar Ian Lesmoras (Data Protection Officer), Pagadian City, Philippines. Email: support@dyne.menu.