Privacy Policy

CitizenDish is operated by [Company legal name] (“CitizenDish”, “we”, “us”). We help independent restaurants and bars run their websites, menus and marketing. This policy explains what we collect, why, and the choices you have. It covers restaurant owners and their staff who use CitizenDish, and visitors to the restaurant websites we host.

What we collect

From restaurant owners and staff

• Your mobile number, which is how you sign in. We check that it’s a mobile number with a carrier lookup.
• Your name and email address, if you give them to us.
• Your restaurant’s details: name, address, hours, menus, photos, logo, events and links. Some of this we bring in, with your permission, from your existing website and your public Google listing.
• What you ask our site assistant to change, and the changes made.

From visitors to restaurant websites

• If you ask to host an event: your name, email, mobile number, the date, the number of guests and your message.
• If you sign up for updates: your email address and, if you give it, your name.
• Page visits, counted without cookies. We combine your IP address and browser type with a code that changes every day, and keep only the result, so we can count a visitor once a day without being able to follow anyone over time.

How we use it

• To sign you in, by sending a one-time code to your mobile.
• To build, host and update the restaurant’s website.
• To pass on what visitors send. An event request or email sign-up on a restaurant’s website goes to that restaurant, appears in its inbox, and may be sent as an alert to the staff it chooses.
• To send account messages, such as reminders before a preview expires or notice that a site is live.
• To keep the service secure, fix problems and improve it.

We do not sell personal information, and we do not use visitors’ details to market our own services to them.

Text messages

We text one-time sign-in codes to the mobile number you enter. Restaurants may also choose to receive alerts by text, such as a new event request, at mobile numbers they add for their staff. Message frequency varies. Message and data rates may apply. Reply STOP to stop receiving texts, or HELP for help.

We do not share or sell mobile numbers or text-messaging consent with anyone for their own marketing. Mobile numbers are shared only with the service that delivers our texts, and only to deliver them.

Who we share it with

We use these services to run CitizenDish. Each receives only what it needs for its job:

• Amazon Web Services: hosting, storage, databases and sending email.
• Telnyx: sending text messages and checking that a number is a mobile number.
• Anthropic: its Claude AI reads a restaurant’s existing website to set up its new one, and carries out changes the owner asks the site assistant for.
• Google: looking up a restaurant’s public business listing, and (if a restaurant switches it on) website analytics.
• Sentry: error reports, so we can fix problems.
• The restaurant: anything a visitor sends through a restaurant’s website goes to that restaurant.

We may also share information if the law requires it, or to protect the safety of our users or the public.

How long we keep it

We keep account and restaurant information while the account is active. Visitor submissions stay in the restaurant’s inbox until the restaurant deletes them or closes its account. Sign-in codes expire within minutes. Page-visit counts are kept as daily totals.

Your choices

• Unsubscribe from any email using the link in it.
• Reply STOP to any text.
• Ask us for a copy of your information, or to correct or delete it, at [privacy contact email]. For something you sent to a restaurant, you can also ask the restaurant directly.

Children

CitizenDish isn’t meant for children under 13, and we don’t knowingly collect their information.

Security

We encrypt information in transit, keep sign-in tokens out of reach of the browser, and limit who can access data. No system is perfectly secure, but we work to protect yours.

Changes

If we change this policy in a meaningful way, we’ll update the date above and, for big changes, tell account holders.

Contact

[Company legal name]
[Mailing address]
[privacy contact email]

See also our Terms of Service.