Privacy Policy

Last updated: October 21, 2026

The short version

MasOrder is a software platform restaurants use to take online orders. We collect the bare minimum information needed to run the service. We don’t sell your data, we don’t sell your customers’ data, and we don’t use it for advertising. Stripe handles all payment information — we never see card numbers.

Who this applies to

Restaurant owners (our customers): when you sign up to use MasOrder for your restaurant, this policy describes how we handle your account information.

Customers ordering food (your customers): when someone places an order through your storefront, MasOrder processes their information on your behalf as a service provider. That information belongs to you. Your customers should look at your privacy policy for how it’s ultimately used.

What we collect

From restaurant owners

• Email address (for sign-in via magic link)
• Restaurant name, address, phone, hours, and timezone
• Stripe Connect account ID (so payouts go to your bank — Stripe holds the bank details, not us)
• Menu items, photos, and prices you upload
• Optional: tablet device pairings, printer LAN IPs, and other setup configuration
• If you sign up for marketing texts: your business’s legal name, EIN, address and website, and a contact person’s name, title, email and phone, to register your restaurant with the phone carriers as a text sender
• If you set up your restaurant’s own app: your business’s legal details and D-U-N-S number, and a photo of your ID and a business document (such as your Articles of Organization) in case Apple asks for them. The ID and document are encrypted, only MasOrder admins can open them, and we delete them once Apple approves the enrollment or as soon as you ask.

From end customers (on your behalf)

• Name, phone number, and order details
• Pickup time and any notes they leave for the kitchen
• Payment is handled directly by Stripe — we receive a confirmation token, never the card number

Automatically

• Standard server logs (IP, user agent, referring page) — used for troubleshooting and abuse prevention only
• First-party analytics on the marketing site (page views, no third-party trackers)

How we use it

• To run the service you signed up for
• To send you transactional emails (order confirmations, account changes, magic-link sign-in)
• To process payments via Stripe
• To prevent fraud, abuse, and outages
• With your explicit opt-in: to send marketing emails to your customers from your restaurant. You can disable this from your dashboard at any time.
• Only for customers who tap “Yes, text me” when your checkout asks: to send them marketing texts from your restaurant, up to 4 a month, plus one welcome text when they sign up.

Who we share it with

We share information only with vendors that help us run the service:

• Stripe — payment processing and payouts
• Supabase — database hosting (US data center)
• Vercel — application hosting and CDN
• Resend — transactional email delivery
• Expo — delivering notifications to restaurants’ own apps, through Apple and Google
• Twilio — text messages and, for restaurants that use Phone Routing, phone calls (calls are never recorded)
• Uber Direct — only for delivery orders: the name, address, phone number and order details a courier needs
• Google — when you choose “Continue with Google” to sign in
• Point-of-sale providers (for example Clover) — only when a restaurant connects one, the order details it needs to show the order in that restaurant’s own system
• The phone carriers and their campaign registry — only for a restaurant that signs up for marketing texts, the business details above, to register it as a text sender
• Apple and Google — only for a restaurant that sets up its own app, the business details its developer accounts and store listings need, and the ID and business document if Apple asks for them

We do not sell personal information. We do not share it with advertisers or data brokers.

How long we keep it

For active accounts: as long as you keep your account open. For closed accounts: we delete account-identifying data within 90 days unless we’re required to retain it for tax or legal reasons (in which case the data is archived and inaccessible to anyone except for that purpose).

You can export your customer list and order history before closing the account.

Restaurants’ own apps

Some restaurants offer their own iPhone and Android ordering app, built and run by MasOrder. In a restaurant’s app:

• Your account: your phone number, email address and name. You sign in with a 6-digit code we text to your phone (or email you, if you prefer) — no password. It’s the same account and points as the restaurant’s website.
• Your orders: what you order, your pickup time and your order history, so the restaurant can make your order and you can order again.
• Notifications: if you allow them, your phone’s notification token, so we can tell you when your order is ready. Offers are sent only if you turn them on too.
• Payments: you pay in Stripe’s payment sheet. Stripe collects your card details and some information about your device to prevent fraud; we never see your card number. A card you choose to save is kept by Stripe.
• The app doesn’t use your location, contacts or photos, shows no ads, and doesn’t track you across other companies’ apps or websites.
• You can delete your account in the app (Account → Delete account) or at masorder.com/delete-account.

Text messages (SMS)

When you place an online order, you can choose to receive order-status text messages (an order confirmation and a notification when your order is ready): once you enter your mobile number at checkout, it asks whether to text you, and you tap Yes. Consent is not a condition of purchase.

• Message frequency: 1–3 messages per order. Message and data rates may apply.
• Sign-in codes: when you sign in to a restaurant's rewards account or app, we can text a one-time 6-digit code to the number you enter, one message each time you ask for a code. Message and data rates may apply.
• Marketing texts from restaurants: if you tap Yes, text me when a restaurant’s checkout asks whether you want its texts, MasOrder sends you that restaurant’s offers, new menu items and events by text on its behalf, up to 4 messages a month from each restaurant you sign up with, plus one welcome text when you sign up. Consent is not a condition of purchase. Message and data rates may apply. We keep a record of your consent: the wording you saw, the time, the order and your number.
• Your mobile phone number is used only to send these messages. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties.
• If you call a participating restaurant's phone line and press 1 to order online, we send one text with that restaurant's ordering link, at your request.
• Reply STOP at any time to opt out, or HELP for help. Tapping No thanks when a later checkout at a restaurant asks about texts also stops that restaurant's texts.

Your rights

You can:

• Access your data — visible in your dashboard
• Export it — CSV download from the dashboard, or by emailing us
• Correct it — edit fields directly in the dashboard
• Delete it — request deletion at masorder.com/delete-account (restaurant owners and their customers alike), or email us

If you’re in California (CCPA) or the EU/UK (GDPR), you have additional statutory rights. Email us and we’ll honor them.

Cookies

We use cookies (and similar local storage) only for things that need them: keeping you signed in, remembering your tablet pairing, and basic analytics. We don’t use third-party advertising cookies on the marketing site.

A restaurant can add Google Ads conversion tracking to its own ordering site. When it does, Google may set cookies on that site to measure its ads, under Google’s privacy policy.

Security

All traffic is over HTTPS with 256-bit SSL. Database access is restricted by row-level security policies. Payments are tokenized by Stripe — we never store card numbers. No system is perfectly secure, and we’ll notify you if a breach affects your data.

Changes to this policy

If we make material changes, we’ll email you and post the new version here with a new “Last updated” date. Continued use of the service after a change means you accept the updated policy.

Contact

Questions, requests, or data concerns: hello@masorder.com

MasOrder is operated by MAS Hub, LLC, 5970 E State St, Rockford, IL 61108.