Data we store

The short version: enough to place your orders and answer questions about them, and nothing whose only purpose would be to know more about you.

What we keep

• Who you are. Name, phone number, email. The name and phone go to the restaurant with an order, because somebody has to be called at the counter.
• Addresses you save. Used to work out which location you mean and to fill in a checkout that asks.
• A card token. Not a card number. See card data.
• Your orders. What you ordered, from where, what it cost, and what happened to it. This is what your receipts and your history are.
• Your preferences. Dietary rules, favorites, usual orders, and any notes you saved.
• Order traces. A time limited record of what happened during a build, so we can diagnose a failure without asking you to reproduce it. Payment details are excluded from these by construction.
• Product telemetry. Which features are used and where things break. It carries account and event data, never payment details.

What we do not keep

• Card numbers, security codes or expiry dates. They are in our payment provider's vault, not our database.
• Your assistant's conversation. We see the tool calls it makes, not the chat around them.
• Your location history. A location you share is held as a grant that expires within the hour and is read as absent after that, never as a field on your profile. A saved address is one you chose to save.
• Anything sold to anybody. We do not sell personal data.

Who it is shared with

• The restaurant, for an order you placed: your name, the order itself, and whatever their own checkout requires, which is usually a phone number or email for their confirmation.
• Your assistant, but only what a tool returned in answer to a call it made on your behalf. That is the same information you would see.
• Our subprocessors, each for one job, listed at layout.link/subprocessors and summarised in subprocessors.

How isolation is enforced

A user reads only their own rows, and that is enforced by the database rather than by every query remembering to filter. Access is scoped per request to the authenticated user, and a request that fails to establish who it is for reads nothing rather than everything.

That is the control that makes a missing filter a bug that returns no data instead of a bug that returns somebody else's.

Retention and deletion

Order records and receipts are kept while your account is open, because they are the record of money you spent. Debug traces are short lived by design. Telemetry is retained in aggregate.

You can delete a card, an address or a preference at any time in your account. Closing your account starts a deletion with a short grace window, so an accidental deletion can be undone and a real one completes. To close an account, ask us at contact@layout.link.

The formal version

This page is the plain reading. The binding version is the privacy policy, with the DPA for business customers. Where this page and the policy differ, the policy is the one that counts, and the difference is a bug in this page worth telling us about.