Privacy Policy

Digital Ivory Technologies — EasyDine
Effective date: 18 October 2026 · Last updated: 18 October 2026

This policy explains how Digital Ivory Technologies ("we", "us") collects and uses personal information through EasyDine. It complies with South Africa's Protection of Personal Information Act 4 of 2013 (POPIA). EasyDine has three parts:

• The EasyDine staff app. This is an Android and iOS app used by waiters, managers, admins and hotel room-service receiver devices.
• The guest web app at easydine.online. Diners and hotel guests reach it by scanning a table or room QR code.
• The Digital Ivory dashboard at digitalivorytechnologies.com. Restaurant and hotel owners and their admins use it.

1. Who is responsible

Each restaurant or hotel that uses EasyDine (the "venue") is the responsible party for the personal information of its guests and staff that is processed through EasyDine. Digital Ivory Technologies provides EasyDine to venues and acts as an operator: we process that information on the venue's behalf and on its instructions. Digital Ivory Technologies is responsible for the information we collect for our own purposes, such as the details of venue owners who sign up for EasyDine and of people who contact us.

Information Officer: Mpho Oliphant
Email: moliphant@digitalivorytechnologies.com · Alternative: oliphantmpho3@gmail.com · Phone: +27 60 338 3700

2. Information we collect

Guests using easydine.online (no account needed)

Guests do not create accounts. We do not ask for a guest's name, email or phone number, except as described below.

• Device identifier. A random ID is created and kept in your browser's local storage. We use it to link your phone to your table or room session and to your own cart and orders. It is not your phone's hardware ID.
• Table or room information. This is taken from the QR code you scan: the venue, branch, table or room number. It also includes the time you joined and whether you are sharing a table with other guests.
• Orders. Items, options, quantities, prices, any special instructions or delivery notes you type, and order status and timestamps.
• Requests. "Call waiter", condiment and "Request bill" requests.
• Tips. The tip percentage or amount you choose.
• Ratings. Optional 1–5 star ratings for the app, the food and the venue, plus any comments you write. Please don't put personal details in comments.
• Hotel charge-to-room. To charge an order to a room, you enter the surname on the booking and, if the hotel uses one, a room PIN. We check these against the stay the hotel recorded at check-in. We log failed attempts with your device ID to prevent misuse.
• Pay now (PayFast). You pay on PayFast's own secure pages. We never receive or store your card details. We receive a payment reference, the amount, the payment status and PayFast's fee information.
• Camera (optional). If you use the in-app QR scanner, the camera is used only on your device to read the QR code. No images are sent to us. You can also scan with your phone's own camera.

Hotel stays (entered by hotel front-desk staff)

• Guest surname, an optional display name, the room, check-in and expected check-out dates, an optional booking reference, and the PIN if one is set. The PIN is stored hashed.
• Charge-to-room limits and the room charges made during the stay.

Venue staff (EasyDine staff app and dashboard)

• Account details. Full name, email, an optional phone number, an optional employee ID, role, venue and branch, and whether the account is active.
• Sign-in details. Your password is managed by our authentication provider, and we never see it in plain text. One-time codes for invites and password resets are stored hashed, with the IP address of the request.
• Device and push notifications. The app registers your device with a device name and type. A push notification ID from OneSignal links your device to the tables or rooms it serves, so orders and requests reach you. Basic technical details about the device, such as the platform, may also be stored.
• Activity at work. Orders you take or update, requests you handle, room-service deliveries you claim or complete, payments you mark as collected, and breakage or stock records you enter.
• Camera. This is used to scan pairing QR codes. Images are not stored or uploaded.
• On-device storage. Your "keep me signed in" choice and your session are stored on your device.

Venue owners and admins (dashboard)

• Business and contact details, including the venue name, branches, address, phone and email, and branding such as your logo and colours.
• Menus. If you use menu photo scanning, the image you upload is sent to our AI provider (Anthropic) to extract menu text.
• Subscription and billing records. PayFast processes subscription payments, and we keep the PayFast references, the amounts, the status and the billing dates.
• Branch registration requests and approvals.

Prospective clients

If you contact us using the details on our site or in the app, we keep your message and contact details so we can reply.

What we do not collect

We do not use advertising trackers or third-party analytics, and we do not collect location (GPS). We do not sell personal information. The dashboard's analytics pages are built only from the venue's own order data.

3. Why we use it (and our lawful basis)

• To provide EasyDine. This means delivering orders and requests to staff, showing bills, handling room service and charge-to-room, and processing payments. Basis: performance of a contract with the venue and the guest's request.
• To secure accounts and prevent fraud. This covers sign-in, one-time codes, attempt limits and abuse logs. Basis: legitimate interest and legal obligation.
• To let venues run their business. This covers order history, analytics, room-charge reconciliation, tips owed to staff, and feedback from ratings. Basis: contract with the venue.
• To send service emails. Examples are invites, password resets, trial and billing reminders, and branch approvals. These come from noreply@digitalivorytechnologies.com. Basis: contract.
• To reply when you contact us. Basis: legitimate interest and consent.

4. Who we share it with

• The venue you order from or work for. Its staff see your orders, notes, requests, tips and ratings for that venue.
• Service providers (operators) who process data for us under contract:
• Supabase hosts the database, authentication and server functions.
• Vercel hosts the websites.
• OneSignal delivers push notifications to staff devices. It uses Google Firebase Cloud Messaging and Apple Push Notification service.
• Resend sends email.
• PayFast processes payments. It holds card data, not us.
• Anthropic reads menu text from uploaded photos, if the feature is used.
• Authorities, where the law requires it.

Some providers process data outside South Africa. Where they do, we rely on POPIA section 72: the recipient is bound by adequate protection or by contract, or the transfer is needed to perform the contract.

5. How long we keep it

We keep personal information only for as long as we need it for the purposes in this policy, or for as long as the venue or the law requires.

• Guest table and room sessions, orders, tips and ratings: kept for as long as the venue's account is active, so the venue has its records. When a venue closes its account, we delete or anonymise this data unless the law requires us to keep it.
• Hotel stay details (surname, PIN): kept for as long as the hotel needs them to manage the stay and settle its accounts, and then deleted or anonymised.
• Payment records: for as long as tax and accounting law requires.
• Staff accounts: while the account is active. Deleted or anonymised after the account is closed or a deletion request is made, except records the venue must keep, such as orders.
• One-time codes and security logs: short-lived. Codes expire within minutes, and security logs are kept only for as long as we need them to protect the service.
• Browser and device storage on your own device: you can clear it at any time in your browser or app settings.

6. Security

We protect data with encryption in transit (HTTPS), database row-level security, staff roles that limit what each person can see, hashed PINs and one-time codes, attempt limits, and payment handling by PayFast. No system is perfectly secure. If a breach affects you, we will notify you and the Information Regulator as POPIA requires.

7. Your rights

Under POPIA you may:

• ask whether we hold your information and request a copy;
• ask us to correct or delete it;
• object to processing;
• withdraw consent where we rely on it;
• lodge a complaint with the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@justice.gov.za.

For guest data held for a venue, you can also contact the venue directly.

8. Requesting deletion of your account and data

You can ask us to delete your EasyDine account and the personal information linked to it at any time. You do not need to be in the app to do this.

Staff app users (including Google Play users):

• Email moliphant@digitalivorytechnologies.com with the subject "EasyDine data deletion". Send it from the email address on your account, or include your name, venue and role.
• You can also ask your venue's admin or manager to deactivate your account.
• We confirm the request, verify your identity, and delete or anonymise your account and device registration without undue delay, and we let you know when it's done. Records the venue must keep, such as orders, sales and room charges, are anonymised rather than deleted.
• What is deleted: your staff profile (name, email, phone, employee ID), your sign-in account, and your device and push-notification registrations.
• What may be kept: records the venue or the law requires, such as orders, sales and room charges, with your name removed or anonymised.

Guests:

• Email us with the venue, the date and time, and the table or room number.
• We'll locate and delete your feedback and unlink your device ID.

Venue owners: contact us to close your account and have your venue's data exported and deleted.

9. Children

EasyDine is not directed at children. Staff accounts are for adult employees only. Children may use a guest's phone at a table under adult supervision, but we do not knowingly collect personal information from children. If you think we have, contact us and we will delete it.

10. Changes to this policy

We may update this policy. We'll change the "Last updated" date and, for significant changes, notify venue admins by email or in the dashboard.

11. Contact

Mpho Oliphant, Information Officer, Digital Ivory Technologies
moliphant@digitalivorytechnologies.com · oliphantmpho3@gmail.com · +27 60 338 3700