Privacy Policy

1 Information We Collect

We collect information in several ways depending on how you interact with DineSwift:

Information you provide directly:

• Hotel staff accounts: name, email address, hashed password, and assigned role.
• Menu management: food item names, descriptions, prices, and uploaded images.
• Guest order data: table number, items ordered, and order timestamps.
• Payment information processed via Chapa (we do not store raw card details).

Information collected automatically:

• Server log files including IP addresses, browser user-agent, and request timestamps.
• Session tokens used to authenticate dashboard sessions.
• JWT tokens for API authentication (stored client-side).

2 How We Use Your Information

We use the information we collect to:

• Authenticate and authorise dashboard users (owners, kitchen staff, cashiers).
• Display the correct menu and process guest orders.
• Generate analytics reports visible only to the hotel owner.
• Process and record payments through Chapa.
• Prevent fraud and enforce login rate-limiting to protect accounts.
• Send transactional emails (e.g., staff invitation emails) where applicable.
• Improve the platform by analysing aggregated, anonymised usage patterns.

We do not use your data for advertising, and we do not sell personal data to third parties.

3 Data Sharing & Disclosure

We share data only in the following limited circumstances:

• Payment processing: Order totals and references are sent to Chapa to initiate payments. Chapa's own privacy policy governs how they handle that data.
• Legal obligations: We may disclose data if required to do so by law or in response to a valid legal request.
• Business transfers: In the event of a merger or acquisition, user data may be transferred to the successor entity, subject to the same privacy protections.

We do not share personal information with advertisers, data brokers, or other unrelated third parties.

4 Data Security

We implement industry-standard technical and organisational measures to protect your data:

• Password hashing: All passwords are hashed with bcrypt — they are never stored in plain text.
• JWT authentication: API routes are protected with signed JSON Web Tokens with a limited expiry.
• Login throttling: Repeated failed login attempts are automatically blocked for 15 minutes to prevent brute-force attacks.
• HTTPS: All data in transit is encrypted. We strongly recommend using HTTPS in production deployments.
• Input sanitisation: All user-supplied inputs are sanitised and validated server-side to prevent injection attacks.

Despite these measures, no system is 100% secure. We will promptly notify affected parties of any confirmed data breach in accordance with applicable regulations.

5 Cookies & Tracking

DineSwift uses the following types of cookies:

• Session cookies: Required for keeping dashboard users logged in. These expire when the browser is closed.
• Flash message cookies: Short-lived cookies used to display one-time confirmation messages after form submissions.

We do not use advertising cookies, analytics tracking scripts (e.g., Google Analytics), or any third-party tracking technologies.

6 Data Retention

We retain data for as long as is necessary to fulfil the purposes described in this policy:

• Staff account data is retained for as long as the account is active. Deleted accounts are removed from the system.
• Order records are retained for reporting and accounting purposes. Owners may request deletion.
• Server logs are retained for up to 90 days for security and debugging purposes.

7 Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion: Request that we delete your personal data ("right to be forgotten").
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to the processing of your data in certain circumstances.

To exercise any of these rights, contact us at privacy@DineSwift.com. We will respond within 30 days.

8 Third-Party Services

DineSwift uses the following third-party services:

• Chapa – Payment gateway for processing guest payments. Subject to Chapa's Privacy Policy.
• Google Fonts – Used to load the Inter typeface for the dashboard. A request is made to Google's CDN. Subject to Google's Privacy Policy.

We are not responsible for the privacy practices of external services. We encourage you to review their policies.

9 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify active users via email or a notice on the dashboard.

Your continued use of DineSwift after changes are made constitutes your acceptance of the updated policy.

10 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out: