In short: This policy explains what personal information Taste Trail collects, why we collect it, who we share it with and what rights you have. We are governed by South Africa's POPIA, and by the GDPR where it applies to you. We do not sell your personal information. You can access, correct, export or delete your information at any time.
This summary is for convenience only and is not part of the agreement. The clauses below govern.
1. Who We Are
1.1 Taste Trail (Pty) Ltd (registration number [COMPANY REGISTRATION NUMBER]), of [REGISTERED ADDRESS], South Africa, is the responsible party (under POPIA) and data controller (under the GDPR) for the personal information described in this policy.
1.2 Information Officer. Our Information Officer, registered with the Information Regulator (South Africa) as required by POPIA section 55, can be reached at privacy@taste-trail.com.
1.3 This policy covers the Taste Trail websites, mobile applications, restaurant dashboard, API and MCP server.
1.4 It forms part of our Terms of Service.
1.5 Restaurants are separate. When a restaurant receives your information to fulfil a booking, that restaurant becomes a separate responsible party for its own use of it. This policy does not cover what a restaurant does with your information — ask the restaurant for its own privacy notice.
2. What We Collect
2.1 Information you give us
• Account: name, email address, password (stored hashed, never in readable form), phone number, profile photo, account type
• Profile: cuisine preferences, dietary requirements, allergies, favourite venues
• Bookings and orders: date, time, party size, special requests, order contents
• Payment: billing details and payment method. We never receive or store your full card number — that goes directly to our payment providers
• Content: reviews, ratings, photos, posts, comments and messages
• Restaurant information (Restaurant Partners): business name, address, registration and licensing documents, menus, prices, photos, operating hours, payout details
• Communications: support requests, feedback and correspondence with us
2.2 Information we collect automatically
• Device and connection: IP address, browser and operating system, device identifiers, language
• Usage: pages and screens viewed, features used, searches run, time spent
• Visibility analytics: when a restaurant appeared in your search results and in what position, which listings you clicked, which parts of a restaurant page you viewed, and where you stopped in a booking. This is what lets us show restaurants how the platform is working for them (see section 4)
• Location: approximate location from your IP address; precise location only with your permission, for nearby search
• Cookies and similar technologies: see section 9
2.3 Information from others
• Social sign-in: if you sign in with Google or another provider, basic profile information from them
• Payment providers: confirmation of payment, and fraud-prevention signals
• Review aggregators: publicly available ratings, where a restaurant has connected them
• Restaurant Partners: notes about a visit, made by staff in the guest record
2.4 Special personal information. Dietary requirements and allergies can reveal information about your health or religious beliefs, which POPIA treats as special personal information. We collect it only where you choose to provide it, and use it only to keep you safe and to give you relevant recommendations. You can remove it from your profile at any time.
2.5 Children. The Platform is for adults. We do not knowingly collect information about anyone under 18. If you believe we have, tell us at privacy@taste-trail.com and we will delete it.
3. Why We Use It, and Our Lawful Basis
POPIA requires us to have a lawful justification for processing, and the GDPR requires a lawful basis. Ours are:
3.1 To provide the service *(performance of a contract)*
Creating and managing your account; taking and confirming bookings and orders; processing payments and refunds; enabling messaging; providing the restaurant dashboard.
3.2 To keep you safe *(legitimate interest; consent for special information)*
Applying declared allergies as hard constraints in recommendations; verifying restaurants; detecting fraud, fake reviews and abuse; moderating content.
3.3 To improve the Platform *(legitimate interest)*
Understanding which features are used; diagnosing faults; measuring and improving performance and search relevance.
3.4 To provide restaurants with analytics *(legitimate interest)*
Producing aggregated reporting so a restaurant can see how many people saw and engaged with its listing. Restaurants see counts and trends, never individual browsing histories — a restaurant cannot determine that a specific person viewed its page.
3.5 To communicate with you *(contract; consent for marketing)*
Booking confirmations, reminders and service messages are necessary for the service and are not marketing. Marketing emails are sent only with your consent and you can withdraw it at any time.
3.6 To meet legal obligations *(legal obligation)*
Tax and accounting records; responding to lawful requests; keeping records of your acceptance of our terms.
3.7 To operate AI features *(contract; legitimate interest)*
Powering the AI Concierge, Owner Copilot and Manager Agent. See section 6.
3.8 Where we rely on legitimate interest, we have considered whether it is outweighed by your rights, and you may object at any time (section 8).
4. Visibility & Engagement Analytics
We record how people interact with restaurant listings so we can show restaurants whether the Platform is working for them. Because this is the most detailed tracking we do, we describe it specifically.
4.1 What we record. When a restaurant listing is shown to you, clicked, or engaged with, we record the event, the position it appeared in, the search that produced it, and — for bookings — which step you reached.
4.2 How you are identified. These events carry a rotating, anonymous session identifier, not your name. It is generated in your browser, is not a fingerprint, and expires after 30 minutes of inactivity. It exists so we can connect "this listing was shown" to "this listing was clicked" within a single visit.
4.3 Search queries are scrubbed. Search text is truncated and stripped of anything resembling an email address or phone number before it is stored, because people sometimes type personal details into search boxes.
4.4 What restaurants see. Restaurants see aggregated counts and trends only — impressions, clicks, average position, funnel drop-off, top search terms. They do not see who you are, and they cannot isolate an individual's activity.
4.5 Retention. Raw event records are deleted after 90 days. Aggregated daily statistics contain no identifiers and are kept indefinitely.
4.6 Your choices. We honour the Do Not Track browser setting and any cookie-consent rejection — where either is set, these events are not collected at all, not merely hidden.
6. AI Features & Your Information
6.1 AI features — the AI Concierge, Owner Copilot, the Manager Agent — process information to answer your questions and to act within limits you set.
6.2 What is sent to AI providers. Where a feature uses a third-party model, we send only the information needed for that request. We do not send full card numbers, passwords, or bulk personal data.
6.3 No training on your content. We do not permit our AI providers to use your prompts or content to train their models. We do not use the content of your private messages to train any model.
6.4 Improving our own features. We may use aggregated and de-identified interaction data to improve our AI features.
6.5 Your dietary information. Where you have recorded allergies, they are passed to AI features as hard constraints so recommendations stay safe. This is a use of special personal information, based on the choice you made to record it.
6.6 Automated decisions. We do not make decisions producing legal or similarly significant effects about you by automated means alone. Recommendation and ranking are automated but do not have that effect, and you can always search and browse directly.
7. How Long We Keep It
We keep personal information only as long as necessary for the purpose it was collected, or as law requires.
Account information — for as long as your account is open, then deleted or anonymised within 90 days of closure
Bookings and orders — 5 years from the transaction, for tax and accounting
Payment records — 5 years, as required by tax law
Reviews and public content — remain published after account closure, disassociated from your name on request
Messages — 2 years from last activity
Raw analytics events — 90 days (section 4.5)
Aggregated statistics — indefinitely, as they contain no identifiers
Marketing consent records — for as long as you are subscribed, plus 3 years as proof of consent
Terms acceptance records — for the life of the account plus 5 years, as evidence of agreement
Support correspondence — 3 years
Where we no longer need information but cannot delete it immediately — because it is in a backup, for example — we isolate it and delete it on the backup cycle.
8. Your Rights
Under POPIA, and under the GDPR where it applies, you have the right to:
8.1 Be told what information we hold about you and why — this policy, and on request.
8.2 Access a copy of your personal information.
8.3 Correct information that is inaccurate, misleading or out of date — mostly self-service in your account settings.
8.4 Delete your information where we no longer have a lawful reason to keep it. Some information must be retained for the periods in section 7.
8.5 Object to processing based on legitimate interest, including profiling for recommendations.
8.6 Withdraw consent at any time, where processing is based on consent. This does not affect processing already carried out.
8.7 Opt out of marketing — use the unsubscribe link in any marketing message, or your notification settings. Service messages about your bookings will continue.
8.8 Data portability — receive your information in a structured, commonly used, machine-readable format, or have it transmitted to another provider where technically feasible.
8.9 Restrict processing in certain circumstances, for example while a dispute about accuracy is resolved.
8.10 Not be subject to a decision based solely on automated processing with legal or similarly significant effects. See 6.6.
8.11 Complain — to us at privacy@taste-trail.com first, or directly to the Information Regulator (South Africa):
https://inforegulator.org.za
complaints.IR@justice.gov.za
If you are in the EU or UK you may also complain to your local supervisory authority.
How to exercise these rights: email privacy@taste-trail.com or use the privacy tools in your account settings. We will verify your identity before acting, and will respond within 30 days. If we need longer we will tell you why. This is free, unless a request is manifestly unfounded or excessive.
10. Location Information
10.1 Approximate location is derived from your IP address to show relevant local results and the right currency. This does not require permission.
10.2 Precise location is used only with your explicit permission, to find restaurants near you and to give distances.
10.3 You can withdraw permission at any time in your browser or device settings. The Platform remains fully usable — you can enter a location manually.
10.4 We do not track your location in the background, and we do not build a movement history.
11. How We Protect It
11.1 We apply technical and organisational measures appropriate to the risk, including:
• encryption in transit (HTTPS/TLS) across the Platform
• passwords stored using strong one-way hashing — we cannot read your password
• access controls limiting staff access to what their role requires
• API credentials stored as hashes, with request signing
• monitoring, logging and regular review
11.2 No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping your password confidential and for using a strong, unique one.
11.3 If something goes wrong. If a security compromise affects your personal information, we will notify you and the Information Regulator (South Africa) as soon as reasonably possible, as POPIA section 22 requires, and tell you what happened and what to do.
11.4 Report a suspected vulnerability or compromise to security@taste-trail.com.
12. Where Your Information Goes
12.1 We operate in South Africa and Zimbabwe. Information is primarily processed in South Africa.
12.2 Some service providers — cloud hosting, email delivery, AI models — process information outside South Africa, including in the European Union and the United States.
12.3 Safeguards. POPIA section 72 permits transfer where the recipient is subject to comparable protection. Before transferring we ensure at least one of:
• the recipient country has adequate data-protection law;
• the contract binds the recipient to standards comparable to POPIA, using Standard Contractual Clauses where appropriate; or
• you have consented, or the transfer is necessary for a contract with you.
12.4 You may ask privacy@taste-trail.com for details of the safeguards for a specific transfer.
13. If You Are a Restaurant Partner
13.1 We process your business information — registration, licensing, contacts, menus, payouts — to operate your listing, verify you and pay you.
13.2 Your listing information is public by design.
13.3 Verification documents are used only to verify you, are visible only to authorised staff, and are deleted 2 years after verification completes or your account closes, whichever is later.
13.4 Your dashboard users. You control who has access. You are responsible for removing access when someone leaves. We log dashboard actions for security and audit.
13.5 Guest data you receive. You become a separate responsible party for it. Your obligations are in Annex B, section B6.
13.6 Your own privacy notice. You are responsible for giving your guests your own privacy notice covering what you do with their information.
14. Changes to This Policy
14.1 We may update this policy. The version and effective date are at the top.
14.2 Material changes — a new purpose, a new category of recipient, a materially longer retention period — will be notified by email or in-app notice at least 30 days before they take effect. Where the law requires consent, we will ask for it.
14.3 Minor changes take effect on publication.
14.4 Previous versions are available on request to privacy@taste-trail.com.
15. Contact Us
Questions, requests or complaints about privacy:
Information Officer
Taste Trail (Pty) Ltd
[REGISTERED ADDRESS], South Africa
privacy@taste-trail.com
Privacy requests: privacy@taste-trail.com
Security reports: security@taste-trail.com
General support: support@taste-trail.com
Regulator. If you are not satisfied with our response, you may complain to the Information Regulator (South Africa):
https://inforegulator.org.za
complaints.IR@justice.gov.za