Privacy policy

Draft pending legal review. The items in brackets are still to be completed.

Effective from: [DATE]
Last updated: November 2, 2026

This policy explains what data D4U ("we") handles when you use the DishDuck apps and this website, why, and what you can do about it. We wrote it to be understood.

Who we are

DishDuck is made by D4U Software and Cloud Services LLC (“D4U”).

D4U Software and Cloud Services LLC
1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA
dishduck@d4u.store

In short

• If you're a restaurant guest using DishDuck Customers, we don't ask you for an account, your name, email or phone number.
• If you work at a restaurant and use one of the staff apps, we handle the data needed to identify you and give you access.
• The apps don't measure or track anything. This website counts visits with Cloudflare Web Analytics, without cookies and without identifying you.
• We don't sell data and we don't show ads.

1. Who this applies to

• Guests: people who view a restaurant's menu with the DishDuck Customers app.
• Restaurant staff: people who use the staff apps: Manager (management), Service (waiters), Delivery (take-away and delivery orders), Register (register), Kitchen (kitchen) and Server (the venue's device).
• Owners and restaurants: businesses that sign up for the service on our website, and people who use Admin, the owner's dashboard.

2. The app

The DishDuck apps for iPhone and Android don't measure or track anything: they have no analytics, no advertising identifiers and no third-party tracking tools. This is the data they handle.

Guests (DishDuck Customers)

• What stays on your phone. The history of menus you've viewed (restaurant name, date and time) and your preferences are stored only on your phone. They don't reach us. You can delete the history in the app, and everything is removed when you uninstall it.
• What our server receives. When you scan a restaurant's QR code, the app asks for permission to open its menu. That request includes the scanned code and the technical data of any internet connection: IP address, date and time, device type and app version. We use them to authorize access and to prevent abuse.
• The restaurant's menu. Once access is authorized, the menu is downloaded to your phone as a package, from the restaurant's device or from our servers. It opens for a limited time, set by DishDuck. When that time ends, the menu closes and its content is deleted from your phone; only the record of the visit stays in your history. The menu contains no data about you.
• What we don't collect. We don't ask for your name, email, phone number or location. We don't know which dishes you look at.

Restaurant staff

• Identification data: name, role and the restaurant you belong to, entered by the person who manages the restaurant.
• Session data: when your phone was linked with the QR code, who authorized it and your assigned schedule.
• Technical connection data, as above.
• Courier location (Delivery only). While you have orders on the way, Delivery uses your phone's location to track the delivery. Only the guest of the next order sees it, on a map. We don't store your route: the location is short-lived and expires by itself. When there are no orders on the way, it isn't used.

Permissions the apps ask for

• Camera: only to read QR codes. The image is processed on the phone; we don't store photos, record or send images.
• Bluetooth and local network (Wi-Fi): to find the restaurant's device and receive the menu directly, even without internet. We don't use them to locate you or to identify other devices.
• Location in DishDuck Customers and Service: the system asks for it because the nearby link between phones requires it. These apps don't store or send your location.
• Location in Delivery: to track the delivery while orders are on the way, as explained above.

You can withdraw these permissions in your phone's settings; without the camera, scanning isn't possible.

3. This website

To know how many people visit, this site uses Cloudflare Web Analytics, which counts visits without cookies and without identifying you. It doesn't use cookies or any other tracking tool.

4. Restaurants and the web portal

• Account data: business name, the responsible person's name and email, and the password, which we store irreversibly encrypted.
• Content you publish: menus, products, prices, text and images. This is the restaurant's business information, not personal data, and any guest you show a QR code to can see it. If you include data about people (for example, a team member's name or photo), you are responsible for having their permission.
• Payments for the service: processed by Stripe [to be confirmed]. We don't see or store your card number; we receive the payment confirmation, the amount and the last digits.

5. What we use the data for

• To provide the service: authorize access, deliver menus and keep sessions running.
• To bill restaurants and keep their invoicing.
• To protect the service: detect abuse, fraud and failures.
• To meet legal obligations.

We don't use your data for advertising or profiling.

6. Who we share it with

Only with providers that help us operate, under contract and for that purpose:

• Hosting and network: [Hosting provider, to be defined].
• Payments: Stripe [to be confirmed].
• App distribution: Apple and Google, under their own policies.

We may also disclose data if a competent authority requires it under the law. We don't sell personal data.

7. How long we keep it

• Published menus: while the restaurant keeps them published. Earlier versions: [to be defined].
• Technical connection logs: [to be defined].
• Courier location: a short time, while the order is on the way; then it expires and the route isn't stored.
• Staff data: while their access is active and for [to be defined] after it is removed.
• Restaurant account and billing data: for the length of the contract and as long as tax laws require.

8. International transfers

Our servers and providers may be in the United States or other countries. By using the service, your data may be processed outside your country of residence.

9. Security

Communication between the apps and our servers is encrypted. We limit access to data to the people who need it. No system is infallible; if an incident affects you, we'll let you know as the law requires.

If you find a security flaw in the apps or the website, write to reports@d4u.store. Please give us time to fix it before making it public.

10. Your rights

You can ask us for access to your data, its correction or deletion, and object to certain uses, by writing to dishduck@d4u.store. If you're on a restaurant's staff, you can also ask the person who manages it. You have the right to file a complaint with the data protection authority in your country.

11. Children

The service isn't aimed at children under [MINIMUM AGE] and we don't knowingly collect their data.

12. Changes

If we change this policy, we'll publish the new version here with its date. If the change is significant, we'll announce it in the apps or by email to restaurants.

13. Contact

D4U Software and Cloud Services LLC ("D4U")
1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA
dishduck@d4u.store