Privacy Policy
Last updated: 30 October 2026
1. Who we are
takein.online ("takein", "we", "us") gives independent restaurants their own online ordering website, an order dashboard and kitchen ticket printing.
- Legal name
- [TO CONFIRM: company or sole-trader legal name]
- Company number
- [TO CONFIRM: Companies House number, or "not a company"]
- Registered / business address
- [TO CONFIRM: registered office or geographic address]
- ICO registration number
- [TO CONFIRM: ICO data protection fee registration number]
- Privacy contact
- hello@takein.online
2. Two different roles: ours and the restaurant's
When you order food through a takein-powered site, the restaurant is the business selling you the food. Under UK data protection law:
- The restaurant is the controller of the order you place with it (your name, phone number, delivery address, order and notes). takein handles that data on the restaurant's behalf (as its processor) to run the ordering site, send the order to the kitchen and take payment.
- takein is the controller of: restaurant owner accounts and applications; diner accounts created at takein.online/account (which work across takein restaurants); the security and fraud checks on our site; and our own business records.
If your question is about a specific order, the restaurant is usually best placed to help, but you can always contact us and we will pass it on or help directly.
3. What we collect
If you order food (diners)
- Order details: your name, phone number, the items you ordered (including any notes you type, which can include dietary or allergy notes), collection or delivery choice, any coupon used, totals and order status.
- Delivery address, if you choose delivery.
- Email address, if you give one for a receipt or create an account.
- Account details, if you create a diner account: email, login credentials (handled by our authentication provider), saved name, phone and address, and your order history and any store credit.
- Payment: card payments are taken by Stripe on Stripe's own checkout page. We never see or store your full card number. We receive confirmation that payment succeeded, the payment reference and any refund status.
If you run a restaurant (restaurant owners and applicants)
- Application and contact details: your name, business name, email, phone, business address and postcode, description, opening hours, menu, photos and the website design you choose.
- Information we gather about your business from public sources, if you ask us to fill your application automatically from your existing website or listing (for example name, address, menu and photos).
- Your signed agreement: the name you typed, your drawn signature, the date and time you signed, and which terms and consents you ticked.
- Payout details: if you choose a Stripe payout account, Stripe collects your identity and bank details directly and we only keep your Stripe account reference. If you choose a bank-transfer payout during your application, we store the account holder name, sort code and account number you enter.
- Setup payment: confirmation and reference of your £499 setup payment (taken by Stripe).
- Account and device details: your login, and access keys for kitchen devices and cloud printers linked to your restaurant.
- Messages you send us, including support requests.
Everyone who uses our sites
- Technical and security data: your IP address and basic browser information are processed by our hosting provider and by our bot-protection check (Cloudflare Turnstile) when you submit an order, application or form. This is used to keep the service running and to stop fake orders and spam.
4. Why we use it, and our lawful basis
| What we do | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Take your order, send it to the kitchen and printer, process payment, send your receipt and order-status updates, and handle refunds (on the restaurant's behalf) | Performance of a contract with you (the restaurant relies on this; we act on its instructions) |
| Run your diner account and pre-fill your details at checkout | Performance of a contract with you |
| Review restaurant applications, set up and run the restaurant's ordering site, dashboard and payouts | Performance of a contract with the restaurant (or steps before entering one) |
| Keep a record of the signed restaurant agreement | Legitimate interests (proving what was agreed) and legal claims |
| Bot protection, fraud prevention, security logs and alerts (for example, alerting a restaurant to an unaccepted order and auto-refunding orders a kitchen never accepts) | Legitimate interests in keeping the service safe and reliable, and protecting diners from paying for food that is never made |
| Keep financial and transaction records | Legal obligation (tax and accounting law) |
| Product updates and tips to restaurant owners | Consent (the optional tick-box at sign-up). You can withdraw it at any time. |
If you include allergy or health information in an order note, it is used only to prepare your order. Please include only what the kitchen needs.
We do not sell personal data, we do not use it for advertising, and we do not make decisions about you using automated processing that have legal or similarly significant effects.
5. Who we share it with
We use the service providers below to run takein. They process data on our instructions, under contract, and only for the purpose stated.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, login/authentication, file storage and server functions | [TO CONFIRM: project region] |
| Vercel | Website hosting and delivery (processes IP addresses in server logs) | Global network, including the USA |
| Stripe | Card payments, refunds, restaurant payout accounts and the setup-fee payment. Stripe is also an independent controller for its own legal and fraud-prevention obligations. | UK/EU and USA |
| Microsoft 365 (Microsoft Graph) | Sending emails from hello@takein.online, such as receipts, login emails and order alerts | [TO CONFIRM: Microsoft 365 data location] |
| Expedy | Cloud receipt printers in restaurant kitchens (the printed ticket includes the items, your name, phone number, delivery address and order note) | France (EU) |
| Cloudflare (Turnstile) | Bot and spam protection on order and sign-up forms | Global network, including the USA |
| Google Fonts, jsDelivr | Loading fonts and website code libraries. Your browser connects to them directly, so they receive your IP address. | Global, including the USA |
| AI model providers. Depending on configuration, one of: GitHub Models, Groq, OpenAI, Anthropic, Google (Gemini), xAI, OpenRouter or Cloudflare Workers AI | Helping our team and restaurants draft support replies and marketing plans, and generating images. Support drafts can include the message you sent us and your name. A person reviews before any reply is sent. | Mainly the USA |
| Jina AI Reader and our own scraping service (hosted on Railway) | Reading a restaurant's public web pages when the restaurant asks us to fill in its application automatically | [TO CONFIRM] |
| Telegram | Sending one-time sign-in codes to takein administrators only | Global |
The restaurant you order from can see your order details in its dashboard. That is how it prepares and delivers your food. We may also share data where the law requires it, or to protect people's safety or our legal rights.
6. International transfers
Some of the providers above process data outside the UK, mainly in the USA. When that happens we rely on a UK adequacy decision (including the UK–US "data bridge" for certified US companies) or on the UK International Data Transfer Addendum / Agreement in the provider's terms. You can ask us for details. [TO CONFIRM: check each provider's transfer mechanism]
7. How long we keep it
- Orders and payment records: 6 years from the end of the financial year they relate to, because tax and accounting law requires it. After that they are deleted or anonymised. [TO CONFIRM: automated deletion not yet built; currently kept until deleted on request]
- Diner accounts: until you ask us to delete the account. The orders inside it are kept as financial records (see above) but are no longer linked to an account.
- Restaurant accounts and signed agreements: for the life of the agreement, then 6 years (the period in which legal claims can be brought).
- Applications that do not go ahead: up to 12 months, then deleted. [TO CONFIRM]
- Bank-transfer payout details entered in an application: only until your payout account is set up, then deleted. [TO CONFIRM: process not yet automated]
- Security logs kept by our hosting and security providers: kept for those providers' standard log periods.
8. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (diner account holders can edit their name, phone and address on the account page);
- have your data deleted, where we are not required to keep it;
- restrict or object to some uses, including any use based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email hello@takein.online. We will reply within one month. If your request is about an order a restaurant controls, we will help the restaurant answer it.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
9. Cookies and browser storage
We do not use advertising cookies, analytics or tracking pixels.
We use only storage in your browser that is needed for the service you ask for:
- Sign-in session (browser local storage, set by our Supabase login library). This keeps you logged in to your diner, restaurant or admin account.
- Restaurant dashboard and kitchen screen: remembers which restaurant the device is set up for.
- Sign-up and application forms: saves your progress so you do not lose what you have typed.
- Administrator security: remembers a verified second sign-in step.
- Cloudflare Turnstile may use its own storage to check that a real person is submitting a form.
Because these are strictly necessary for the service you request (sign-in, security and saving your progress), no consent banner is needed for them under the Privacy and Electronic Communications Regulations (PECR). If we ever add analytics or marketing cookies, we will ask for your consent first.
10. Security
Data is sent over encrypted connections (HTTPS). Access to the database is controlled by row-level security rules and server-side checks, and administrator accounts use two-step sign-in. No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.
11. Children
takein is not aimed at children. Restaurant accounts are for adults acting for a business.
12. Changes
We will update this page when the product or our providers change, and we will change the date at the top. If a change is significant, we will tell restaurant owners by email.