Who operates Dishfolk
Dishfolk is operated by Jack Vu, an individual/sole proprietor based in Saskatoon, Saskatchewan, Canada.
Sellers decide what customer information they need to accept and fulfil their food orders. Dishfolk processes that information to provide the seller’s ordering workflow. Dishfolk also uses limited account, billing, and technical information to operate and secure the service.
Information we collect
Depending on how the service is used, we handle:
- seller account data, including name, email address, password credential hash, email-verification records, account language, sessions, IP address, and browser or device information;
- business data, including business name, contact details, logo and menu images, menus, products, prices, pickup instructions and addresses, availability, settings, members, and operational notes;
- customer and order data, including name, email address or phone number, order choices, item and price snapshots, pickup selection, status, customer or seller notes, and consent records;
- subscription data, including plan, usage totals, billing status, and Stripe customer, subscription, price, and event identifiers. Dishfolk does not receive or store complete payment-card or bank details;
- support communications and the information a person chooses to include in them; and
- technical and security data, including request timing, IP address, browser or device information, rate-limit events, error details, and audit records. Application logs are designed not to include customer contact details, free-text notes, private order links, passwords, payment details, or email bodies.
Cookies and local storage
Signed-in seller pages use necessary, secure session cookies for login, security, and request protection. The account area stores only the seller’s English or Vietnamese interface preference in browser local storage. Dishfolk does not currently use advertising cookies or third-party behavioural analytics.
Why we use information
We use information to create and secure accounts, publish seller pages, accept and organize orders, enforce inventory and pickup limits, show private order status, deliver requested transactional messages, manage seller subscriptions, provide support, prevent abuse, investigate incidents, maintain accurate operational history, and meet legal obligations. We do not sell personal information or use customer order contacts for Dishfolk marketing.
Consent and seller-entered data
Sellers accept the Terms and Privacy Policy when registering. Anonymous customers accept the applicable terms and privacy notice when submitting an order and provide the contact information shown as required at checkout. The storefront requires either a phone number or email so the seller can contact the customer. A seller entering an order received elsewhere must confirm that they are authorized to provide the customer information. Promotional consent is separate and is not enabled by default.
Who receives information
Authorized members of a seller business can access that business’s data. Customers can access an order only through its private, non-guessable status link. The following service providers process information only as needed for their role:
- Cloudflare hosts the application, databases, uploaded media, security controls, and email routing;
- Stripe handles seller subscription checkout, billing, and payment details under Stripe’s own privacy terms;
- Resend delivers account, order, and subscription email; and
- Google receives support email forwarded to the operator’s private support inbox.
We may also disclose information when required by law, to protect people or the service, or as part of a business transfer subject to appropriate safeguards. Dishfolk does not process customer food payments.
Retention and deletion
Information is retained while a seller account is active and as needed to provide menus, fulfilment, private status pages, exports, billing, security, and support. Order snapshots and audit records are retained to preserve operational integrity and resolve disputes.
A business owner can export business data and request deletion in account settings. A deletion request immediately stops publishing and new orders and then enters manual review so ownership can be verified and records can be removed or anonymized safely. We aim to complete that review within 30 days. We retain only information still reasonably required for security, billing records, dispute handling, fraud prevention, database integrity, or legal obligations. Provider backups and logs may retain protected copies for a limited period under provider retention cycles before they are overwritten.
Access, correction, export, and deletion
Sellers can correct most business and account information in the service and export business data from settings. A customer can ask the seller to correct order information. Sellers and customers may contact Dishfolk to request access, correction, or deletion; include the seller business and order number when relevant, but do not send a password, private order link, or payment information. We may need to verify identity and may retain information where law or a legitimate integrity need requires it.
Safeguards
Dishfolk uses encrypted network connections, secure session cookies, verified email, server-side business-access checks, non-guessable order links, input validation, rate limits, limited logs, restricted production secrets, and database and storage controls. No internet service can guarantee absolute security. Sellers must protect account credentials and avoid placing unnecessary sensitive information in menus or notes.
Processing outside Canada
Cloudflare, Stripe, Resend, and Google may process or store information outside Canada. Information in another country may be subject to that country’s lawful access requirements. We remain responsible for choosing and configuring service providers appropriate to the information they handle.
Policy changes
We may update this policy as the service or legal requirements change. The updated date will change, and material changes will receive additional notice where appropriate. We will seek consent if required before using personal information for a materially new purpose.
Contact
Privacy questions and requests can be sent to support@dishfolk.ca.