Privacy Policy

1. Who processes data

Hefyt processes data to run and protect the platform. For orders and the consumer relationship, the establishment commonly chooses its purposes as controller and Hefyt may act as processor. For accounts, billing, security, and platform improvement, Hefyt may act as controller. Roles depend on the operation.

2. Establishment and user data

We may process name, email, phone, protected credentials, Google links, establishment details, address, menu, settings, subscription, payments, sessions, device and IP information, access records, feedback, and uploaded files.

3. Consumer data

Depending on the order and identification choice, we may process name, phone, email, delivery address, notes, items, values, payment, history, and protected browser identifiers. Guest checkout creates no administrative account and requires no acceptance of establishment Terms.

4. Purposes and legal bases

Data supports accounts, authentication, menus, orders, subscriptions, payments, support, imports, exports, fraud prevention, security, and improvement. Depending on context, bases may include contract, pre-contract steps, legal duties, legal claims, assessed legitimate interests, credit protection, or consent.

5. Authentication and abuse prevention

Authentication may use email, Google, WhatsApp codes, passwords, passkeys, and device approval. reCAPTCHA may assess technical signals to prevent abuse. Credentials, codes, and tokens are protected and purpose-limited.

6. Payments

Stripe processes card, Google Pay, and available online order payments; Mercado Pago processes subscription Pix in Brazil. Hefyt receives references, status, amounts, and reconciliation data, but no full card details.

7. Cookies and device storage

Necessary cookies support authentication, security, language, carts, tracking, and local order ownership. The browser may temporarily retain checkout progress and kitchen preferences. These functions do not depend on the Analytics choice.

8. Google Analytics

On the Home and owner registration or login pages, GA4 helps understand visits, pages, approximate source, device, and general interaction. This instrumentation is part of the current operation of those surfaces. We do not configure user IDs, personalized advertising, or intentional transmission of names, emails, phones, orders, or establishments.

9. Sharing and infrastructure

Data may be shared as needed with the order establishment and providers of cloud, storage, email, authentication, maps, Analytics, payments, WhatsApp, security, and support, or under valid legal duties. A full processor list and international-transfer mechanisms require review before launch.

10. Security

We use proportionate controls including establishment isolation, encryption in transit, protected cookies and tokens, access control, security records, server validation, and file restrictions. No system removes every risk.

11. Retention and deletion

Data is kept as needed for its purposes, service delivery, legal duties, legal claims, and fraud prevention. Some technical periods are limited, but the formal retention schedule and account deletion procedure require review before launch.

12. Data subject rights

Under the LGPD, data subjects may request confirmation, access, correction, applicable anonymization, blocking or deletion, portability, sharing information, review of applicable automated decisions, and consent information or withdrawal. Identity verification may be required.

13. Changes

Material changes to processing will produce a new Policy version and, where required, a new choice or notice.