Privacy Policy

Who we are

TakeOut is operated by Loisirs Digne DOOH Inc., a company incorporated in Canada and based in Québec.

TakeOut is an ordering platform for pickup orders. You place an order with us, you pay through us, and you collect the food from the restaurant. The restaurant prepares your food and sells it to you; we are not the restaurant.

Mailing address: [MAILING ADDRESS — street, city, province, postal code]

Questions about this policy: [PRIVACY EMAIL]

Who is responsible for your personal information

Under Québec's Act respecting the protection of personal information in the private sector (Law 25), one person inside the company is answerable for how we handle your information.

• Title: Privacy Officer
• Contact: [PRIVACY EMAIL]
• By mail: Privacy Officer, Loisirs Digne DOOH Inc., [MAILING ADDRESS — street, city, province, postal code]

You can write to this person about anything in this policy, including to make a complaint. We answer within 30 days.

What we collect, and why

We collect only what an order actually needs. For each item below, we say what it is for — because under Law 25 your consent has to be given for a specific purpose, not for a general idea of "improving the service".

• Your name, email address and phone number — to create your account, to identify your order at the counter, and to send you order updates.
• Your postal code — to sort restaurants by distance if you have not turned on location, and to calculate the correct Québec sales taxes.
• Your preferred language — so that the app, our emails and our text messages reach you in English or French, as you choose.
• Your orders — what you ordered, from where, when, and what it cost. We need this to run the order, to show you your history, and to answer questions about a past order.
• Your saved payment method — only the card brand and the last four digits, plus a token held by Stripe. We never see or store your full card number.
• Reviews you write — published on the restaurant's page under the name you choose to display.
• Push notification and device tokens — to tell you when your order is confirmed and ready.
• Your location, only if you turn it on — see the next section.

We do not collect your date of birth, your government identifiers, your health information, or anything about your background. We do not buy personal information about you from anyone else.

Location — off unless you turn it on

The TakeOut app can use your device's location to sort restaurants by how far away they are and to estimate how long the walk or drive will take.

It is off by default. The app does not ask your phone for your location until you have read what it is for and tapped Use my location. If you decline, we remember that and do not ask again.

To turn it on: open the neighbourhood screen and tap the location banner, then tap Use my location. Your phone will then ask you as well, and both answers have to be yes.

To turn it off: revoke the permission in your device settings (iOS: Settings → TakeOut → Location; Android: Settings → Apps → TakeOut → Permissions). The app stops using it immediately.

You do not have to turn it on. Every restaurant is listed either way — you just will not see distances. We will never refuse you an order because you declined to share your location.

Your location is used to find nearby restaurants and is not stored alongside your order. It is never sold, and it is never used to track you when the app is closed. We only ever ask for foreground location — the app cannot see where you are when you are not using it.

How we ask for your consent

We ask separately for each thing, and you can say yes to one and no to another:

• Your order — the information needed to take, prepare and hand over a pickup order. This is what the contract between us requires; without it there is no order.
• Text and WhatsApp messages — a separate opt-in, and a separate one again for marketing messages versus order updates.
• Marketing emails — a separate opt-in. Never pre-ticked, never bundled into creating an account.
• Location — a separate opt-in, off by default, as described above.
• Saving a payment method for next time — a separate choice at checkout.

You can withdraw any of these at any time, in your profile settings or by writing to [PRIVACY EMAIL]. Withdrawing consent for marketing or messaging does not affect your ability to order.

Text messages and WhatsApp

We use SMS and WhatsApp for two different things, and they are governed separately.

• Order messages — your order was received, confirmed, is being prepared, is ready for pickup. These are part of the transaction.
• Marketing messages — offers and news. These require your express opt-in under Canada's anti-spam legislation (CASL), and you can withdraw it at any time.

How we collect that consent. We ask for it in these places, and nowhere else: at checkout on the web and in the app, in your profile settings, and — for restaurant staff accounts — during staff onboarding. The box is never pre-ticked, and consent is never a condition of placing an order or creating an account.

No mobile information is shared with third parties or affiliates for marketing or promotional purposes. All other categories of information described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

To stop messages: reply STOP (or ARRET in French) to any message. Reply HELP (or AIDE) for help. Message and data rates may apply. Message frequency varies with how often you order.

Who else sees your information

We use a small number of service providers, each for one clearly defined job. We do not sell your personal information to anyone, ever, and we do not share it for anyone else's marketing.

• The restaurant you ordered from — your first name and last initial, your order, and your phone number if they need to reach you about it. They need this to make and hand over your food.
• Stripe, Inc. — payment processing. Stripe receives your card details directly; we never hold them.
• Twilio Inc. — sending your text and WhatsApp messages.
• Supabase, Inc. — the database and sign-in system that holds your account.
• Expo / Google / Apple — delivering push notifications to your device.
• Vapi and Anthropic — if you order by phone, the voice assistant that takes your order processes the call and the transcript.

We may also disclose information where the law requires it, or to protect someone's safety.

Your information may be processed outside Québec and outside Canada

This is required to be said plainly, and it is true: your personal information may be transferred, processed and stored outside Québec and outside Canada.

Our service providers operate in the United States and elsewhere. Their staff and the authorities of those countries may, in defined circumstances, be able to access information they hold. Before using a provider we assess whether the information will receive adequate protection, as Law 25 requires, and we contract for it.

If you would rather your information were not handled this way, we cannot offer you the service — there is no version of online payment or text messaging that stays inside Québec, and we would rather say so than imply otherwise.

How long we keep it

We keep personal information only as long as the purpose it was collected for requires, and then we destroy it. Concretely:

• Your account — while it is open, and for 12 months after you close it, in case you come back.
• Orders and receipts — 7 years, because Québec and federal tax law require us to be able to produce them.
• Payment records — 7 years, same reason. Card numbers are never held by us at any point.
• Text and WhatsApp messages — 24 months, so we can show consent was given if CASL requires us to prove it.
• Consent records — for as long as the consent stands, and 3 years after it is withdrawn.
• Location — not retained. It is used for the request and discarded.
• Reviews — until you delete them, or until the restaurant closes.

When a retention period ends, the information is deleted or irreversibly anonymised. Deletion is a scheduled process, not something we do only when asked.

Who inside the company can see it

Access is by role, not by seniority, and each role gets the minimum it needs:

• Restaurant staff — orders for their own restaurant only. They cannot see any other restaurant's orders or customers.
• Restaurant managers — the above, plus their own restaurant's takings, their own refunds and disputes, and their own staff list.
• Our support team — a customer's account and orders, when that customer has asked us for help.
• Our engineers — production data only when investigating a specific fault, and access is logged.
• The Privacy Officer — everything, in order to answer your requests and investigate complaints.

These boundaries are enforced by the software, not by policy alone. Every request to our servers is checked against who is asking and which restaurant they belong to.

Your rights

Under Law 25 and PIPEDA you can ask us to:

• Show you the personal information we hold about you, and tell you where we got it.
• Correct anything inaccurate, incomplete or ambiguous.
• Delete your account and the information we are not legally required to keep.
• Give it to you in a portable form — a structured, commonly used technological format you can take elsewhere.
• Stop using it, by withdrawing a consent you gave.
• De-index a link to information about you where its dissemination causes you serious injury and stopping it is not outweighed by the public's interest.
• Explain an automated decision, if a decision about you was made solely by automated processing — including what personal information it used and the main factors that led to it. You can ask for it to be reviewed by a person.

Write to [PRIVACY EMAIL]. We answer within 30 days. We do not charge for this. If we refuse a request we will tell you why and how to contest it.

Complaints

If something we did with your information concerns you, tell us first: [PRIVACY EMAIL], or by mail to the Privacy Officer at [MAILING ADDRESS — street, city, province, postal code].

We acknowledge every complaint within 5 business days, investigate it, and give you a written answer with reasons within 30 days. If we got something wrong we will say so and tell you what we changed.

You do not have to go through us first, and you can go to the regulator at any time:

• Commission d'accès à l'information du Québec — cai.gouv.qc.ca
• Office of the Privacy Commissioner of Canada — priv.gc.ca

If something goes wrong

If personal information we hold is lost, accessed or disclosed in a way it should not have been, we record it in a confidentiality incident register, we assess whether it creates a risk of serious injury to you, and — where it does — we notify both you and the Commission d'accès à l'information promptly.

We will tell you what happened, what information was involved, what we have done, and what you can do. We will not wait until we have a complete picture to warn you about something that could hurt you.

How we protect it

• Everything travels over encrypted connections (TLS), and is encrypted at rest.
• We never hold your card number. Stripe does, and Stripe is PCI DSS Level 1 certified. Our servers see a token and the last four digits.
• Every request to our servers is authenticated and scoped: the software checks who is asking and which restaurant's data they are entitled to, on every route, and refuses by default.
• Actions on an order are recorded with the identity of whoever took them, taken from their verified sign-in rather than from what the request claimed.
• Staff accounts use individual credentials. Passwords are never stored in a readable form.

No system is perfectly secure, and anyone who tells you otherwise is selling something. What we can tell you is what we actually do.

Automated decisions

We do not make decisions about you by automated processing alone that produce legal effects or significantly affect you. No algorithm decides whether you may order, what you pay, or whether you are refunded.

Some things are automated but are not decisions of that kind: sorting restaurants by distance, suggesting items that go with what is in your cart, and estimating when your food will be ready. If this ever changes, we will say so here before it does, and you will be able to ask a person to review the outcome.

Children

TakeOut is not directed at children under 14, and we do not knowingly collect their personal information. If you believe a child has given us information, write to [PRIVACY EMAIL] and we will delete it.

Cookies and similar technologies

The website uses cookies that are strictly necessary to sign you in and keep your cart. Anything beyond that — analytics, measurement — is asked for separately in the banner, is off until you accept, and can be changed at any time.

We do not use advertising cookies and we do not allow third parties to track you across other sites from ours.

Changes to this policy

If we change how we handle your information in a way that matters, we will post the new version here with a new effective date, and we will tell you in the app or by email before it takes effect. For a change that requires your consent, we will ask you again rather than assume.

Previous versions are available on request.