Privacy notice

Who is responsible and how to contact us

The operator identified above is responsible for the restaurant’s personal-data practices. Contact the Data Protection Officer at ethanwan@gmail.com for privacy concerns, access or correction requests, or withdrawal of consent. We verify the requester’s identity, explain applicable exceptions and necessary retention, and the effect on services before acting. Withdrawal does not undo earlier lawful use or require deletion of records still needed by law.

Data and purposes

We use your pickup name, items and notes to manage, prepare, hand over and resolve your order. A valid Singapore mobile number is required and is used for matters concerning that order. Order notes remain optional. After full payment confirmation, a kitchen ticket may print your pickup name, items and special requests, and an itemised customer receipt may print the purchase and GST details. A pickup name need not be your full legal name. Leave out unrelated or sensitive information.

Payment references, amounts and authorised bank-match records support reconciliation, accounts, refunds and dispute investigation. Screenshots are optional matching aids, not proof of receipt. Crop them to the relevant transfer and hide balances, full account numbers and unrelated transactions. Bank credentials are never required.

Customer and staff sign-in uses email and a verified provider identifier. Staff identities, roles, cash/stock actions and audit records support access control, accounting and investigations. Network identifiers, including hashed IP values, support rate limits and security. Hashing does not necessarily make this data anonymous.

Service providers and disclosures

This site uses Cloudflare Workers, D1 and private R2 file storage through ChatGPT Sites. Sign-in uses the restaurant’s own Google OAuth client. Google verifies your account and shares your verified email, Google account identifier and display name with SatayBros. Your SatayBros profile, session and staff permissions are stored with this site. We request only identity, email and profile scopes. Authorised owners can use the hosting platform’s verified identity only to configure or recover Google sign-in; staff operations require Google. Google receives authentication information when you choose sign-in; read Google’s privacy notice too.

If enabled, Assenture Connect receives inventory information and aggregated daily sales/payment-category summaries. That accounting sync does not send customer pickup names, phones, notes or payment screenshots. Payment evidence is accessible only to the owner, explicitly authorised payment reviewers, or the signed-in operator for their own counter order. Counter records include the server’s name, the confirming account and time, and an optional payment photo. We limit disclosures to service providers, professional advisers, competent authorities and dispute-resolution parties to the applicable purpose and law. This app does not offer marketing opt-in or send customer data for AI training.

Providers may process data outside Singapore. The operator must confirm its provider arrangements and maintain safeguards for comparable protection required by the PDPA; a Singapore payment does not mean every server is in Singapore. No storage region or absolute security guarantee is promised here.

Essential device storage and security

Authentication uses protected cookies. When Google grants offline sign-in access, the site encrypts access and refresh tokens on the server and renews access tokens during active use. These sessions expire after 30 days; sessions without a refresh token expire after eight hours. Signing out revokes that local session and removes the saved Google tokens when no other live session uses them. Revoked or expired Google grants require sign-in again. Tokens are excluded from portable backups. Your stored account profile is retained separately. On the next visit, the app restores cart quantities only when the last update was within 24 hours, and removes a private order recovery code when it is older than 30 days. Automatic order recovery is limited to the signed-in account that saved it. A private recovery code still grants access when entered manually; keep it confidential. Approved staff devices automatically prepare an authorised offline workspace and can queue permitted counter actions for later sync. Offline staff access expires after seven days without refresh; bank verification, refunds and account changes need a connection. Device notification subscriptions are encrypted on the server, bound to staff permissions and the active session, and disabled when that session signs out. Staff choose online-order alerts and optional stock reminders; browser and operating-system notification providers process delivery endpoints and encrypted messages. Use “Forget this order on this device” and sign out on shared devices. Forgetting locally does not delete the bank or accounting record. We apply role restrictions, private evidence storage and server checks; these measures cannot guarantee that every attack will be prevented.

Retention and disputes

Unused or superseded payment screenshots are scheduled for deletion after 24 hours. Attached screenshots are scheduled for deletion 30 days after completion or cancellation. Pickup names, phones and notes are scheduled for removal 90 days after completion or cancellation. Cleanup is bounded and runs when the service is used, so inactivity or a temporary storage failure may delay deletion. A documented owner evidence hold pauses those removals during a dispute or investigation; holds must be reviewed and released when no longer needed.

Google account identifiers, email, display name and staff identity bindings remain while the account or operational access is needed. Signing out does not delete the profile. Contact the Data Protection Officer to request account closure or deletion, subject to the records we must retain. Printed kitchen tickets, receipts, downloaded reports and backups may contain private data and are outside automatic site cleanup; authorised recipients must store them securely and remove their copies when no longer needed.

Transaction, bank-match, refund and audit records have longer accounting and lawful business retention needs. Ordinary staff cannot rewrite those records. The operator must maintain a governed archive/disposal schedule for them and any provider backups, retaining personal information only as long as justified. This notice does not promise that all audit identities are automatically deleted or that screenshots must be retained as tax records.

Staff and complaints

Approved staff actions are recorded to operate the restaurant and investigate discrepancies. Stock or cash differences are investigation signals, not findings of theft. Review measurement, recipes, waste and timing before any conclusion. This app does not make payroll deductions. Contact the Data Protection Officer for a complaint or request about staff monitoring and records.