Privacy Policy

Effective date: October 4, 2026

This Privacy Policy explains how Zabiry LLC ("Zabiry", "we", "us") collects, uses, and shares information when you use the Zabiry customer ordering website or the Zabiry mobile apps for iOS and Android (together, the "Service") to place pickup or delivery orders. It applies to the apps and the website alike. We are committed to protecting your information and being transparent about how we use it.

1. Information We Collect

When you create an account we collect your name, email address, and phone number, and we keep your order history and saved pickup and contact details. If you sign in with Google or Apple, we receive basic profile information (such as your name and email) from that provider; if you use Apple's 'Hide My Email' option, you share a private relay address instead of your real email, and we use that relay to send you order messages. When you place an order we collect the items you order and any notes, and if you choose delivery, the delivery address and any access instructions you provide. If you choose to save a payment card, our payment processor stores the card securely; we keep only a reference to your account with that processor, and the card's brand, last four digits, and expiration are read from the processor when we show the card to you. For each order, we record the brand and last four digits of the card used. When you look for shops near you, we send the ZIP code or address you type to a third-party mapping provider to convert it into approximate coordinates so we can sort shops by distance, and — while you are typing an address — to suggest matching addresses. We remember the browsing location you chose, on your device and on your account if you are signed in, so you do not have to enter it again; you can change it at any time. If you tap 'Use my location,' we access your device's location one time, with your permission. We use it to sort shops by distance from you, and we send those coordinates to our mapping provider (Mapbox) to look up the street address you are at. We then remember that location — the coordinates and the address — as your browsing location, on your device and on your account if you are signed in, and use the address as your saved delivery address, so you do not have to enter it again; you can change either at any time. We never access your location in the background, and you can decline or revoke the location permission at any time in your device settings. If you save a shop to your favorites, we record that so we can show it back to you. If you enable push notifications, we collect a device notification token so we can deliver them. If you use a Zabiry mobile app on a device with Face ID, Touch ID, or fingerprint unlock enrolled, we ask the device to verify you before showing your saved cards or deleting your account (on by default; you can turn it off in your account's Device Lock setting); the device returns only a yes or no, and we never receive or store your biometric data. We also automatically collect limited technical information, such as device, browser, and usage data, to operate and secure the site. You can browse without an account and check out as a guest; we then collect the name, email address, and phone number you enter for the order and keep them with a guest record that holds the order, which you can turn into a full account after ordering. If you are signed in, the items in your cart are saved to your account so they follow you across devices and so we can remind you about them if you have turned on notifications. If you pay with Apple Pay or Google Pay, the wallet provider passes your payment details to our payment processor; we receive only the card brand and last four digits, as with any card.

2. How We Use Your Information

We use your information to process your order and send it to the shop you selected; to maintain your account, order history, and saved cards across your devices; to send order confirmations and updates and, where you've enabled them, push notifications, reminders about items left in your cart, and occasional announcements or offers; to sort shops by distance from the ZIP code, address, or location you give us; to arrange delivery when you choose it; to take payment; to provide support; to keep the site secure and prevent fraud; and to comply with legal obligations. We do not sell your personal information, and we do not use it for third-party advertising.

3. Information We Share

We share your order and contact details with the shop you order from so it can prepare and hand off your order. We also share information with the service providers that help us run the site, only as needed for them to perform their functions: payment processing (Stripe); hosting, database, and account sign-in (Supabase); content delivery, security, and cookieless traffic analytics (Cloudflare); error monitoring (Sentry); email delivery (Resend); push-notification delivery (Google Firebase Cloud Messaging); text-message (SMS) delivery (Telnyx); and address, ZIP-code, and location lookup (Mapbox). If you choose delivery and a third-party courier carries it out, we share your name, phone number, delivery address, and any delivery instructions with that provider (currently Uber Direct) so the courier can complete the drop-off; if the shop delivers the order itself, those details go to the shop rather than to a courier company. If you choose to sign in with Google or Apple, we exchange basic information with that provider; if you pay with Apple Pay or Google Pay, that provider processes the payment with our payment processor under its own terms. Some shops run their Zabiry dashboard on a tablet that we manage using a mobile-device-management service (ManageEngine, a Zoho service, United States). When we provide technical support, our staff can view or take control of that tablet's screen, which may show order details including your name, contact details, delivery address, the items you ordered, and the brand and last four digits of the card used. We use this only to keep the shop's dashboard working; we never have access to your full card number. We may disclose information when required by law or to protect our rights, our users, or the public. We do not sell your personal information.

4. Payment Information

Your card details are collected and processed directly by our third-party, PCI-compliant payment processor. We do not store your full card number on our systems. If you save a card for future orders, it is stored by the processor in tokenized form; we keep only a reference to your account with the processor, and we record the brand and last four digits of the card used for each order. The processor's handling of your payment information is governed by its own privacy policy.

5. Notifications

If you turn on push notifications, we use a device token to send you order updates, occasional reminders about items left in your cart, and occasional announcements or offers from Zabiry. You can turn off push notifications at any time in your device settings. Most of the emails we send are transactional messages about your orders and your account, such as an order confirmation or status update. We may also send promotional or marketing emails from time to time; when we do, each one includes an unsubscribe link (and supports your email app's one-click unsubscribe), and unsubscribing from those does not stop the essential order and account emails. If you provide a phone number when placing an order, we may send transactional text messages about that order; these are not marketing, message frequency varies with your order, message and data rates may apply, and you can reply STOP to opt out at any time. We do not share, sell, or rent your mobile phone number or SMS opt-in information with third parties or affiliates for their own marketing or promotional purposes; your phone number is used only to deliver the order-related messages you request, through our SMS provider (Telnyx). Turning off notifications won't stop the essential order emails, such as your confirmation, that are part of completing an order. Some of these messages — for example when your order is ready, when it is on its way, or when a refund is issued — include a link to a receipt for that order. The link contains a long, randomly generated code that is not guessable and is not published or indexed anywhere, but opening it does not require signing in, so anyone you forward the message or the link to can view that receipt. The receipt shows the name on the order, the items and quantities, the amounts charged, and any refund; it does not show your email address, your phone number, or your card details. It works only for as long as the order record exists, and shows no personal information once the order has been anonymized, as described in Data Retention below.

6. Data Retention

We keep different information for different lengths of time, based on why we need it, and we minimize the personal information we retain. The financial record of each order — the amounts, taxes, fees, and payment-processor references — is kept for approximately seven (7) years to meet tax, accounting, and other legal requirements, and the personal details attached to an order (your name, email, phone number, any delivery address, and order notes) are kept for up to seven (7) years and then anonymized, after which the order remains only as a financial record with no personal information; the list of items in an order is retained as part of that record, and a receipt link works only for as long as the order record exists and shows no personal information once the order has been anonymized. The full contents of the confirmation and update emails we send are deleted about ninety (90) days after they are sent, while a minimal record of the email (such as its subject, type, delivery status, and the shop) is kept with the order for up to seven (7) years for support and dispute purposes and is anonymized on the same schedule as the order. For text messages, the message content is deleted after about ninety (90) days and the remaining delivery record (such as the status and carrier reference, without the message body) is deleted after twelve (12) months; for push notifications, the message content is kept about ninety (90) days and the delivery record about twelve (12) months, and the device token used to deliver them is kept until it stops working (for example, when you uninstall the app) or you delete your account, except that a token linked to a single order (used when you are not signed in) is deleted about thirty (30) days after it is saved. We keep your account and profile, saved favorites, saved addresses, and saved cart until you delete your account (your saved cart also empties when you check out or clear it), at which point they are deleted; a guest record created at guest checkout is deleted about ninety (90) days after it is created unless you turn it into an account, while the order it held follows the order schedule above; if you save a payment card, it is held by our payment processor — deleting the card removes it there, and deleting your account deletes your saved cards and your account with the processor. When you delete your account it is removed immediately: your name, email address, and phone number are removed from your past orders and those orders are no longer linked to you, while the rest of each order's record (including any delivery address and notes) follows the seven-year schedule above and is then anonymized; we also keep a limited record that the deletion happened — the email address and name on the account, how many orders it had, and when it was deleted — for up to seven (7) years, so we can demonstrate we honored the request and recognize the same address if you sign up again, and this record is not used to contact you. If you ask us for a copy of your data or ask us to delete it, we keep a record of that request — your email address, what you asked for, and when we completed it — for about three (3) years after we complete it, so we can show we honored it. We keep a record of each password-reset request (the email address and when it was requested) for about one (1) year to help investigate account problems. If an email to you bounces or you report one as spam, we keep your email address on a do-not-email list for as long as needed to honor that, so we do not send to it again. Short-lived operational data is kept only briefly — the print jobs used to produce order labels are deleted after about seven (7) days and delivery quotes after about thirty (30) days — while aggregate, non-identifying usage counts (for example, how often address lookups are used) are kept without any personal information, addresses typed into the address search are cached together with their map coordinates — without any link to you or your account — so the same address does not have to be looked up again, and are deleted about one (1) year after they were last used, and internal operational alerts are kept for up to two (2) years. For security, audit logs — a record of sensitive account and administrative changes, such as a change to the email address on an account, an order cancellation, or a refund, which we also rely on to investigate fraud or abuse — are kept for about five (5) years; when you delete your account, the entries about your own profile are removed with it. To protect the service from automated abuse, we briefly count requests from each network connection using a one-way code derived from its IP address that changes every day — never the address itself — and delete those counts within one (1) day. Sign-in and other platform and infrastructure logs are retained by our hosting provider according to its own retention settings and are not controlled by us. Encrypted backups of our systems are retained for approximately one week and then expire, so information you delete also disappears from backups as they roll off. You may delete your account at any time from your account settings, and we will delete or anonymize your information on the schedules above, except where, and only to the extent, we are legally required to retain it.

7. Your Account, Choices, and Rights

You can review and update your profile, manage your saved payment methods, and delete your account at any time from your account settings. Depending on where you live, you may also have the right to access, correct, or delete the personal information we hold about you, or to object to certain uses. To make a request, contact us at [email protected]. We will respond as required by applicable law.

8. Cookies & Tracking

We use only the cookies and local storage needed to run the site and keep it secure — for example, keeping you signed in, remembering your cart and preferences on your device, fraud prevention during payment (Stripe), and bot protection (Cloudflare, including a Cloudflare Turnstile check when you sign in, create an account, reset your password, or check out as a guest). To understand overall site traffic we use privacy-first, cookieless analytics (Cloudflare Web Analytics) that does not set cookies, does not track you across other sites, and does not build an advertising profile; and error monitoring (Sentry) that collects diagnostic data to help us fix problems. We do NOT use third-party advertising or marketing cookies, and we do not sell or share your personal information for cross-context behavioral advertising.

9. Children's Privacy

The site is intended for adults placing food orders and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us so we can remove it.

10. Security

We use reasonable administrative, technical, and organizational measures designed to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated Policy with a new effective date. Your continued use of the site after changes take effect constitutes acceptance of the updated Policy.

12. Contact

Questions or requests about your privacy? Contact us at [email protected].