So SaltyBack to home

So Salty Privacy Policy

Last updated: October 19, 2026

1. Who we are and what this policy covers

Alidar (trading as So Salty), [legal address], operates the website at sosalty.dev, So Salty OS (the staff and owner app) and So Salty Ordering (one shared white-label customer ordering app).

We are responsible as controller for our website, support and platform account data. For customer orders, the restaurant you order from is also responsible for its own customer data, including its use for fulfilment, refunds and legal obligations. So Salty processes that restaurant's order and operational data on its behalf as a processor/service provider. Contact the restaurant about its use of your data; we can help route requests. Contact us at Sales@SoSalty.dev.

2. Personal data we collect

  • Customer accounts and orders: name, phone number, order details, order history, pickup information, saved preferences and SMS consent and opt-out records.
  • Staff and owners: name, phone number, email, restaurant, role and staff PINs stored as hashes, not readable PINs; business-entered hours, pay rates and audit activity.
  • Uploads: photos and receipts uploaded by staff. Avoid uploading unnecessary personal or sensitive information about others.
  • Devices: device identifiers, push notification tokens, device/OS/browser information, basic usage and diagnostic logs used to operate and secure the apps.
  • Location: approximate location only if you grant permission. If you do not grant permission, we do not collect approximate location. You can withdraw location permission in your device settings.
  • Support and website: enquiries and information or screenshots you choose to send us, plus basic technical/diagnostic information.
  • Payments: Sentoo handles Caribbean payments and Stripe handles US payments. We never store full card numbers or card security codes. We may receive payment status, amount, processor reference, card brand and last four digits.

3. Purposes and legal bases

We use data to create and manage accounts, fulfil orders, process payments, store business receipts, send requested push notifications and opted-in order texts, provide support, maintain security, diagnose faults and meet legal obligations.

Where applicable, our legal bases are performance of a contract (accounts, orders and support), legal obligations (tax, accounting and compliance), legitimate interests (security, fraud prevention and basic service diagnostics, balanced against your rights), and consent (optional SMS, location and device permissions where required). You may withdraw consent without affecting prior lawful processing. Restaurants determine the legal basis for their own use of customer data.

4. Permissions, cookies and tracking

App permissions, including location, photos/camera and notifications where used, are requested for the relevant optional function. You can manage them in device settings. Essential cookies or local storage support sign-in, cart and security. We do not use third-party advertising, cross-app or cross-site advertising tracking. We do not sell personal information or share it for cross-context behavioural advertising.

5. Who receives data

We share only what is needed with:

  • The restaurant you order from and its authorised staff, to fulfil orders and meet its obligations.
  • Payment processors Sentoo (Caribbean) and Stripe (US), under their own privacy policies.
  • A messaging provider, such as Twilio, to deliver requested sign-in codes and consented order SMS.
  • Hosting and database providers, including Supabase and Lovable hosting, to store data and operate the services.
  • Authorities or advisers where required by law, or necessary to protect legal rights and prevent abuse.

Service providers process information for service delivery under appropriate protections, not their own advertising. Numbers and SMS consent are not sold or shared for marketing.

6. Retention

Account data is kept until account deletion, subject to the limited exceptions below. Order and tax/financial records are retained as required by law, typically up to 7 years, and anonymised where possible. SMS consent logs are retained as proof of consent for the period needed to meet compliance obligations; minimal opt-out records remain so we keep honouring STOP. Diagnostic and support information is retained only as needed for its purpose and legal obligations.

Deleted data is removed from backups within 30 days after deletion is completed. During that interval, backups are restricted to recovery, not ordinary use. See Delete account for immediate in-app deletion and web requests handled within 30 days, followed by a further 30 days for backups.

7. Account and data deletion

See our account deletion page for both apps and a web request option. We delete profile data, name, phone, email, push tokens, saved preferences and uploaded photos. Legally required restaurant order/payment records may remain anonymised, and minimal SMS opt-out records remain to honour STOP. We may verify your identity before fulfilling a request. Account deletion does not itself cancel a restaurant order or issue a refund.

8. Your privacy rights

California (CCPA/CPRA): where applicable, you may know/access your personal information and its categories, sources, purposes and recipients; request deletion or correction; opt out of sale or sharing (we do neither); limit sensitive personal information use where applicable; and exercise rights without discrimination. An authorised agent may submit a request with proof of authority. We may verify identity through the account's phone or email. Categories include identifiers, commercial/order information, device/internet activity, approximate location with permission, and staff employment information or uploads.

GDPR-style rights: where applicable, you may request access, rectification, erasure, restriction, portability or object to processing, withdraw consent, and complain to your relevant data protection authority. Legal retention requirements may limit erasure.

Curaçao: under the Personal Data Protection Act (Landsverordening bescherming persoonsgegevens), applicable rights include access, correction, deletion/blocking and objection, and complaint to the relevant supervisory authority.

Contact Sales@SoSalty.dev to exercise rights. We respond within applicable legal deadlines and explain any lawful exception. For restaurant-controlled data, we coordinate with the restaurant. Reply STOP to opt out of order SMS at any time.

9. International transfers

Our providers may process data outside your country, including in the United States or European data centres. Where required, we use appropriate contractual safeguards, such as standard contractual clauses or other lawful transfer mechanisms, and protections required by applicable law. Contact us for information about applicable safeguards.

10. Security

We use encryption in transit, access controls, separation of business data, hashed staff PINs and restricted access to operational records. No system is completely secure. We investigate incidents and notify affected people or authorities where legally required.

11. Children

Our services are not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has provided data, contact us so we can investigate and delete it as appropriate.

12. Changes and contact

We publish changes here and update the date above. We notify users of material changes where required.

Alidar (trading as So Salty) — [legal address]. Support and privacy requests: Sales@SoSalty.dev. See Support, Terms and SMS Terms.