Inhouse Orders — Privacy Policy

Effective Date: October 9, 2026 Last Updated: October 9, 2026

1. About This Policy

This Privacy Policy explains how Inhouse 2, LLC ("Inhouse Orders," "we," "us") collects, uses, shares, and protects information when you use the Inhouse Orders platform — including our marketing website (inhouse-orders.com), restaurant ordering websites, reservation and waitlist pages, restaurant operator dashboard and client portal, point-of-sale ("POS") application and devices, printing services, and related APIs (collectively, the "Service").

Roles. When you order from, reserve at, or join the waitlist of a restaurant ("Restaurant") that uses the Service, the Restaurant decides how your information is used and is responsible for it (the "controller" or "business"); Inhouse Orders processes that information on the Restaurant's behalf as its service provider. When you deal with us directly — for example, as a Restaurant owner or staff member using the Service, when you submit a request on our website, or when you contact our support — Inhouse Orders is responsible for that information.

This Policy is incorporated into and supplements our Terms of Service.

2. Information We Collect

2.1 Information You Provide

Diner order information:

• Name, phone number, and email you provide at checkout or that Restaurant Personnel enter for you
• Items ordered, modifiers, special instructions, tip amount, coupon codes
• Delivery address and delivery instructions (for delivery orders)
• Pickup time, party size, dine-in table number
• Feedback you submit about an order

Reservation and waitlist information:

• Name, phone number, and (optionally) email
• Party size, date, time, seating preferences
• Special requests, allergies, or other notes you provide
• Your consent to receive text messages, including when and how you gave it (see Section 4)

Payment information:

• Card data is collected and tokenized by our payment processor, Finix Payments, Inc. ("Finix"), through Finix-hosted payment fields or certified payment terminals. Inhouse Orders does not store full card numbers, CVV codes, or full bank-account numbers.
• We retain non-sensitive payment details to support receipts, refunds, tips, and disputes: card brand, card type, last four digits, the first digits of the card number that identify the issuer (BIN), expiration month and year, cardholder name, issuer country, billing address and ZIP, authorization code, entry method (tap, chip, swipe, or keyed), address and security-code check results, and Finix transaction and token references.
• Saved cards. If you choose to save a card on a Restaurant's ordering site, Finix stores the card and we keep the token and the non-sensitive details above linked to your account so you can reuse it.
• Signatures. Some payment terminals capture your signature on the screen. We store the signature image with the order record as proof of the transaction.

Restaurant owner and staff information:

• Name, email, phone number, and business details (restaurant name, address, phone numbers, hours, timezone)
• Staff name, role (for example owner, manager, server, cashier), POS sign-in PIN, clock-in and clock-out times, tip records, and a record of actions taken in the POS (for example voids, discounts, refunds, and order reassignments, with who performed or approved them)
• Recordings or transcripts of voice commands, if Restaurant Personnel use the POS voice assistant (see Section 2.4)
• Merchant onboarding. When a Restaurant signs up for card processing, the owner enters identity and business verification details (such as tax ID, date of birth, home address, ownership, and bank account) directly on a form hosted by Finix. Finix collects and verifies that information under its own privacy policy. We receive and store only the resulting account identifiers and approval status.

Business inquiries:

• If you request a quote or demo on our website, we collect your name, restaurant name, phone number and/or email, current POS, preferred contact method (including WeChat), your message, and your browser's user-agent string.

Communications:

• Email, text, and phone messages you exchange with a Restaurant or with Inhouse Orders support, including replies to our text messages (for example "C" to confirm a reservation or "OMW" to tell a Restaurant you're on your way)

2.2 Information Collected Automatically

Device and usage data:

• IP address, device type, operating system, browser type, and language
• Pages and features accessed, timestamps, and referring URLs
• Crash reports, performance traces, and diagnostic logs

Analytics and session recording. Our websites and apps use analytics tools to understand how they are used and to fix problems:

• Google Analytics / Firebase Analytics and Firebase Performance Monitoring on our marketing website, Restaurant ordering websites, and operator apps measure page views, events (such as adding an item to the cart), and performance.
• Microsoft Clarity on Restaurant ordering, reservation, and waitlist websites records how visitors interact with the page — mouse movements, clicks, taps, scrolling, and the content shown on screen — and may capture information you type into the page. Clarity sessions may be linked to your account identifier and the Restaurant you are visiting. Payment card fields are provided by Finix in a separate secure frame and are not visible to Clarity. You can learn more at privacy.microsoft.com and opt out of Clarity by blocking its cookies or using a browser-level privacy control.
• Firebase Crashlytics in the POS app records crash and error reports along with the device, app version, Restaurant, station, and the signed-in staff member's ID and role.

Cookies and similar technologies:

• Strictly necessary cookies and local storage (sign-in, session, security checks, cart state)
• Analytics and session-recording cookies (described above)
• Functional cookies (preferences, language)

You can control cookies through your browser settings. Blocking strictly necessary cookies may break sign-in or checkout.

Location:

• Approximate location derived from your IP address.
• If you allow it, a Restaurant's ordering site may use your device's location, within your browser, to check how far you are from the Restaurant and warn you if a pickup order may be far away. We do not store that precise location.
• Addresses you type are sent to Google Maps / Places to suggest and validate addresses.

POS and device data:

• For POS devices and payment terminals: device make and model, operating system version, app version, a randomly generated device identifier, payment terminal serial numbers, software update status, and memory and performance measurements.

2.3 Information from Third Parties

• Sign-in providers. If you sign in with Google, we receive your name, email, profile picture, and account identifier through Firebase Authentication. If you verify your phone number, Firebase Authentication sends you a code by text message and uses Google reCAPTCHA to prevent abuse.
• Finix: authorization and settlement status, transaction and token references, dispute notifications, and merchant onboarding status.
• Twilio: message delivery status, your replies to our text messages, and opt-out signals.
• Delivery and marketplace partners. When a Restaurant accepts orders through a third-party marketplace such as Uber Eats, the marketplace sends us the order, including the customer's name, phone number, and delivery details.
• Restaurants: order history, reservation and waitlist history, and notes Restaurant Personnel record about Diners (for example guest preferences, allergies, tags, no-show history, or a decision to decline future bookings).

We do not purchase personal information from data brokers.

2.4 AI-Powered Features

Some optional features use artificial-intelligence services:

• POS voice assistant. When Restaurant Personnel use voice commands, the audio and resulting text are sent to Google (Gemini) and, where enabled, OpenAI to interpret the command. Staff should not dictate guest payment card numbers or other sensitive information.
• Menu images. Restaurant menu photos and item descriptions may be sent to Google (Gemini) to generate or enhance images.

We use these services through business APIs under terms that restrict the providers' use of the data. We do not send Diner payment information to AI providers.

3. How We Use Information

We use information to:

• Operate the Service — take and fulfill orders, arrange delivery, manage reservations and waitlists, route prints to Restaurant printers, run the POS, sync data across devices, and provide customer support
• Process payments — authorize, settle, tip-adjust, refund, and reconcile transactions through Finix, and save cards when you ask us to
• Send communications — transactional messages (order confirmations and status, receipts, payment links, reservation and waitlist confirmations, reminders, table-ready alerts, cancellations, and verification codes) and, only with the consent required by law, marketing messages
• Respond to business inquiries — contact Restaurants that request a quote or demo, by the method they choose
• Maintain security — authenticate users, detect fraud, prevent abuse, enforce rate limits and block lists, and keep audit records of POS actions
• Improve the Service — analyze usage, review session recordings and crash reports to fix problems, and develop new features
• Comply with law — respond to legal process, enforce our Terms, keep records of consent, defend against claims, and meet tax and card-network obligations

Where a law requires a legal basis for processing, we rely on performance of a contract, legitimate interests (security, product improvement, fraud prevention), consent (marketing, precise location, optional features), and legal obligation.

4. Text Messages (SMS)

What we send. Text messages are sent by Inhouse Orders on behalf of the Restaurant you are dealing with. They include order confirmations and status updates (for example, ready time or delivery tracking), payment links that Restaurant Personnel send at your request, reservation confirmations, changes, cancellations, and reminders, waitlist confirmations, table-ready alerts and reminders, and phone verification codes.

Consent. When you provide your phone number to receive these messages — for example, by checking the consent box when you book a reservation or join a waitlist, by asking Restaurant Personnel to add you, or by providing your number with an order — you agree to receive transactional text messages about that order, reservation, or visit. For reservations and waitlists, we record the time, method, IP address and browser, and the exact wording of the disclosure you agreed to. Consent to text messages is not a condition of any purchase.

Marketing. We do not currently send marketing text messages. We or a Restaurant will send marketing text messages only with your separate, express written consent.

Frequency and cost. Message frequency varies with your activity. Message and data rates may apply.

Opting out. Reply STOP to any message to stop receiving text messages from that Inhouse Orders number. Reply HELP for help, or contact contact@inhouse-orders.com or (720) 952-7066. After you opt out, you may not receive reminders or table-ready alerts by text; the Restaurant may still contact you in other ways about an existing order or booking.

No sharing of mobile information. We do not sell, rent, or share mobile phone numbers or text-messaging consent with third parties or affiliates for their marketing or promotional purposes. Phone numbers are shared with Twilio only to deliver messages, and with delivery couriers only to complete your delivery.

Carriers. Wireless carriers are not liable for delayed or undelivered messages.

5. How We Share Information

We share information only as described below.

5.1 With Restaurants

When you order from, reserve at, or join the waitlist of a Restaurant, that Restaurant receives the information needed to serve you (order, booking, contact info, payment details, notes, and SMS replies). Each Restaurant handles that information under its own privacy practices and applicable law.

5.2 With Delivery Couriers

For delivery orders, we send your name, phone number, email, delivery address, and delivery instructions, along with the order value and tip, to the delivery provider (currently DoorDash Drive) so it can deliver your order and send you delivery updates. The delivery provider uses that information under its own privacy policy.

5.3 With Service Providers

We share information with vendors who help us operate the Service, under contracts or terms that restrict their use of the data:

5.4 For Legal Reasons

We may disclose information to comply with legal process, enforce our Terms, protect our or others' rights, safety, or property, or investigate suspected fraud or abuse.

5.5 In a Business Transfer

If Inhouse Orders is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to confidentiality protections.

5.6 With Your Consent

We may share information for other purposes with your consent.

We do not sell personal information and do not share it for cross-context behavioral (targeted) advertising, as those terms are defined under U.S. state privacy laws. If that changes, we will update this Policy and provide any opt-out required by law. We honor browser-based opt-out signals such as Global Privacy Control where required by law.

6. Data Retention

We keep information for as long as needed to provide the Service and to meet legal, tax, accounting, card-network, and dispute-resolution obligations, and then delete or de-identify it. In general:

• Account and Restaurant data — for as long as the account is active, and afterward as needed for legal records and backups
• Orders, payments, reservations, and waitlist records — for as long as the Restaurant uses the Service, and generally up to seven (7) years for tax, chargeback, and legal purposes
• Text-message consent records and opt-outs — for as long as needed to prove consent and honor opt-outs
• Device performance measurements — about 14 days
• Logs, crash reports, and session recordings — according to our providers' standard retention periods (typically 30 days to 14 months)
• Database backups (point-in-time recovery) — 7 days

You can ask us or the Restaurant to delete information sooner (see Section 8). Restaurants may have their own retention obligations.

7. Security

We use administrative, technical, and physical safeguards to protect information, including:

• TLS encryption in transit and encryption at rest in our cloud database and storage
• Tokenization of payment card data by Finix (we do not handle full card numbers)
• Role-based access for Restaurant Personnel and per-restaurant access rules in our database
• Rate limiting, request validation, and origin allowlisting on public APIs
• Signed, expiring links for guest-facing pages where supported
• Excluding names, phone numbers, emails, and notes from application logs where practical

No system is perfectly secure. If you believe your account has been compromised, contact contact@inhouse-orders.com immediately.

8. Your Choices and Rights

8.1 Account Controls

You can update your profile and contact details within the Service where supported, or by contacting us. To delete an account or your Diner information, email contact@inhouse-orders.com. Restaurant Personnel should request changes through their Restaurant administrator.

8.2 Communications

Unsubscribe from marketing email using the link in the message. Stop text messages by replying STOP. Transactional emails (such as receipts) are part of using the Service.

8.3 Cookies and Analytics

Use your browser controls to manage or block cookies, including analytics and session-recording cookies. The Service may not work correctly if strictly necessary cookies are blocked.

8.4 Region-Specific Rights

U.S. state privacy rights (including California, Colorado, Virginia, Connecticut, Utah, Texas, and others). Depending on where you live, you may have the right to know what personal information we collect and how we use and disclose it; to access, correct, delete, or receive a portable copy of it; to opt out of its sale, sharing for targeted advertising, or certain profiling; and to appeal our decision on your request. We do not use sensitive personal information for purposes that require an opt-out under California law. You may use an authorized agent. We will not discriminate against you for exercising your rights.

California notice at collection. In the past 12 months we have collected the categories of personal information described in Section 2: identifiers (name, phone, email, IP address, account and device identifiers); customer records and commercial information (orders, reservations, payment details); internet and network activity (usage, analytics, session recordings); approximate and, with permission, precise geolocation used only in your browser; audio information (POS voice commands); professional information (staff roles and time records); and inferences such as guest preferences recorded by Restaurants. We use and disclose them for the purposes in Sections 3 and 5 and keep them for the periods in Section 6.

EEA, UK, and Switzerland. The Service is offered in the United States. If GDPR or UK GDPR applies to our processing, you have rights of access, rectification, erasure, restriction, objection, and portability, and the right to complain to a supervisory authority.

How to make a request. Email contact@inhouse-orders.com or call (720) 952-7066. We will verify your request (for example, by confirming the phone number or email linked to your orders) and respond within the time the law requires, typically 45 days. To appeal a decision, reply to our response with "Appeal" in the subject line. For information a Restaurant controls, you can also contact that Restaurant; we will help Restaurants respond.

9. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or under 16 where that is the relevant age). If you believe a child has given us personal information, contact contact@inhouse-orders.com and we will delete it.

10. International Users

The Service is operated from the United States. If you access it from elsewhere, your information will be transferred to and processed in the U.S., where data-protection laws may differ from those in your country.

11. Third-Party Links and Integrations

The Service links to and integrates with third-party websites and services (for example Finix payment pages, DoorDash delivery tracking, and Google sign-in). Their privacy practices are governed by their own policies.

12. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new Effective Date, and for material changes we will give notice by email or in the Service where appropriate. Continued use after the change becomes effective means you accept the updated Policy.

13. Contact

Inhouse 2, LLC 12984 Elati St., Westminster, CO 80234, USA Email: contact@inhouse-orders.com Phone: (720) 952-7066