Privacy Policy

1About this policy#

This policy explains how personal information is collected, used, stored, shared and protected when you use the ZUKA website and apps, order food or groceries, use delivery or pickup, and contact customer support.

For Cayman Islands customers the data controller is Zukaongo (Cayman Islands). Zukaongo (United States) is a separate company and is responsible only for the processing it actually carries out. The Cayman Islands Privacy Addendum and the U.S. Privacy Addendum add region-specific details.

2Information we collect#

• Account: name, email address, phone number, sign-in method (email and password, Google or Apple) and preferred language.
• Orders: items, vendors, totals, fees, tips, order notes, order history, refund requests and reviews.
• Delivery: delivery addresses, map pins, delivery instructions, delivery status and, where a driver takes one, a proof-of-delivery photo.
• Payments: payment status, the type and last digits of a saved card, processor references, Zuka Credit transactions and fraud signals. Full card numbers are processed by Stripe or PayPal and never stored on ZUKA servers.
• Device: IP address, device and browser type, operating system, app version, push-notification token and diagnostic logs.
• Communications: support messages, order-chat messages, emails and conversations with our support assistant.
• Preferences: saved addresses, favourites, language and your order-update, email, SMS and offer settings.
• Location: approximate device location, only if you allow it, to show nearby restaurants and help place your address pin.

If your order notes mention allergies, dietary needs or health information, we use that information only to pass it to the vendor preparing your order and to handle related support.

Drivers and staff: we collect additional information under the Driver Privacy Notice and the Employee Privacy Notice.

3How we use information#

• Create and secure your account and sign you in.
• Take, pay for, prepare, deliver and track your orders, including Meal Pass orders.
• Send receipts and order updates by push, email or SMS, according to your settings.
• Process payments, refunds and Zuka Credit.
• Answer support requests and resolve complaints.
• Detect and prevent fraud, abuse and security incidents.
• Keep the apps reliable and improve features and recommendations.
• Send offers, only where you have opted in, and stop when you opt out.
• Keep records we need for accounting, tax and legal purposes, and respond to valid legal requests.

4Legal basis#

Where the law requires a legal basis, we rely on performing our contract with you, complying with legal obligations, our legitimate interests (such as preventing fraud and improving the service), or your consent. Where we rely on consent, such as for marketing messages or device location, you can withdraw it at any time in the app or your device settings. Withdrawing consent does not affect processing that already took place.

5Location#

You can always type your delivery address instead of sharing your location. If you allow device location, we use it to sort nearby restaurants and place your address pin. You can turn location access off in your device settings at any time. Driver location is covered by the Driver Privacy Notice.

6Who we share information with#

• Vendors receive the order details they need to prepare your order, including your name and order notes.
• Your assigned driver receives your delivery address, instructions and the contact details needed to complete the delivery.
• Payment processors: Stripe and PayPal.
• Service providers who process data on our instructions, including hosting, email (Amazon SES or Resend), SMS (Twilio), sign-in (Google and Apple), push notifications and our support-chat provider.
• The other Zukaongo company, where needed to run the service and allowed by law.
• Professional advisers, auditors, regulators, and anyone we must disclose to by law.

We share only what each recipient needs for its role. Drivers and vendors may not use your information for any other purpose.

We do not sell your personal information and do not share it for cross-context behavioural advertising. If that ever changes, we will update this policy first and give you the choices the law requires.

7International transfers#

Your information may be processed in the Cayman Islands, the United States and other countries where our service providers operate. See the International Data Transfers Notice for how we protect it.

8How long we keep information#

We keep personal information only as long as we need it for the purposes above, for legal and tax obligations, or to resolve disputes. When you delete your account we delete your personal data within 30 days and de-identify the financial records we must keep. See the Data Retention Policy.

9Your rights#

Depending on where you live, you can ask to access your information, correct it, delete it, restrict or object to its use, stop direct marketing, and have certain automated decisions reviewed. See Privacy Rights & Requests for how to ask.

Email privacy@zukaongo.com or use Contact us in the app. We may need to verify your identity before acting on a request.

10Security#

We protect information with encrypted connections (HTTPS), tokenised payments, access controls and audit logs. No system is completely secure; see the Security & Trust page for more.

11Children#

You must be 18 or older to create a ZUKA account. ZUKA is not directed at children, and we do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact privacy@zukaongo.com and we will delete it.

12Changes#

We may update this policy. Each version shows its effective date, and we tell you about material changes where the law requires. The current version is at zukaongo.com/legal/privacy-policy.