Privacy Policy

1. Information We Collect

We collect information from two primary groups of users: Restaurant Partners (business owners and staff) and Dine-In Customers (patrons ordering via QR codes).

A. Data Collected from Restaurant Partners

To provide our B2B restaurant management system, we collect and securely store the following data:

• Account Credentials: Login usernames, passwords, and assigned 4-digit unique numerical IDs.
• Restaurant Metadata: Restaurant names, business addresses, custom descriptions, and logo image uploads.
• Operational Data: Menu items, pricing, food categories, table counts, dynamic QR code routing data, and daily sales tracking totals.

B. Data Collected from Dine-In Customers

Because HotCake allows diners to order from their own phones without downloading an app, we collect minimal, session-based data to process live orders:

• Order Records: Items added to the cart, quantities, order total value, table numbers, and special requests or notes.
• Session Data: We temporarily use the customer's IP address to track their active session. This is strictly used to grant customers a 2-minute grace period to view or cancel their placed orders.

2. How We Use Your Information

We do not sell your personal data. The information we collect is strictly utilized to operate the HotCake ecosystem. We use this data to:

• Route orders: Route customer orders accurately to the specific restaurant's isolated server folder using table URLs.
• Trigger notifications: Trigger 3-second background auto-refresh polling workers and audio alerts on the Android admin app to notify kitchen staff of incoming orders and waiter calls.
• Sync menus: Synchronize menu updates bi-directionally between the server and the Android app.
• Calculate analytics: Calculate daily sales analytics for the restaurant manager.

3. Data Storage and Security

We take your data security seriously by engineering a highly secure infrastructure:

• Tenant Isolation: We utilize an isolated folder-per-tenant architecture (/user_data/[username]/) on our server. This ensures each restaurant's operational data, menus, and assets are strictly separated and completely secure from other accounts on the platform.
• Authentication: Central authentication is managed via a secure MySQL/MariaDB database.
• Encrypted Connections: All communications between the mobile app, the web interface, and the server route through secure HTTPS endpoints using automated SSL certificates.

4. Data Retention and Deletion

To keep the application fast and reduce server overhead, HotCake implements automated data cleanup rules:

• Daily Order Sweeps: Every day after 2:00 AM, the system automatically checks the local dashboard list, deletes all "Delivered" orders (syncing the deletion with the server), and clears old Waiter Calls.
• Account Deletion: If a restaurant account is deleted via the Master Admin Portal, the system soft-deletes the record and moves it to a recycle bin. The data and isolated folder remain intact on the server for 7 days to allow for restoration. Once 7 days pass, background cleanup logic permanently purges both the database entry and the physical folder from our servers.
• Auto-Pause Automation: Subscriptions can be configured to auto-pause after set intervals (e.g., 7, 30, or 365 days) restricting transactions and data syncs until unpaused.

5. Third-Party Access

We do not share your restaurant data, menus, or customer order logs with third-party marketing or food aggregation services. HotCake operates as a zero-commission ordering system where restaurant owners retain 100% control over their sales and data.

6. Contact Us

If you have any questions about this Privacy Policy, your data, or the HotCake platform, please contact us at: