Privacy policy

takeit is an independent, early-access project so that small businesses —the bakery, the bar or the greengrocer in a village or a neighbourhood— can have their own website and take orders from phones. Their customers can pick the order up, have it delivered or have it at the shop, depending on what each business offers, and the business keeps its orders organised in one place.

Businesses join by invitation, after a short application on the join page, and the project helps them get started: adding their products, setting their hours and choosing how they deliver and how they get paid.

takeit is still being built: some features may change and others are on the way. There is more about the project on the home page.

takeit provides the software those shops' websites run on.

Each of those websites is run by its owner —a person or a business—, who is responsible for it. Its legal texts (legal notice, terms, privacy and cookies) are on its own website, under /legal on its domain, and they are the ones that govern the purchases, payments and order data made there.

The takeit project is the controller of the data processed on this domain, and of the sign-in account used on every shop that runs on takeit. For any data protection question you can write to hi@hectortoral.com.

The data of the orders you place on a shop's website (your phone number, the address, what you order, the payment) is that shop's responsibility, and its own privacy policy, on its website, explains it.

• What data: your email address, to which a one-time sign-in link is sent, or, if you sign in with Google, the name and email Google provides; and whether the email is confirmed.
• What for: giving you access to your account, your orders and, if you have a shop, its dashboard.
• Legal basis: performance of the platform's terms of use (Art. 6(1)(b) GDPR).
• Session: a strictly necessary cookie keeps you signed in; it is described in the cookie policy.

On a shop's website you can order without signing in by entering an email address. The order is saved to the takeit account for that email and, if none exists, takeit creates it with the email and name you enter. It is the same account you can use to sign in on any shop that runs on takeit.

• What the account keeps: the email, the name and whether the email is confirmed. The order data (your phone number, the address, what you order) belongs to the shop, which is its controller.
• What for: so you can see your orders and get their updates. The basis is performance of the contract: the account is how the order you placed is shown to you.
• Until the email is confirmed nobody can sign in to the account or see its orders: the order confirmation reaches that email with a one-time link that signs you in and confirms the address. Entering an email when ordering never signs anyone in.
• The confirmation page: the browser you order from keeps a strictly necessary cookie with the orders it has just placed, so you can see them again (and pay for them) without signing in for 24 hours. It only opens those orders.

If you fill in the form to join takeit, we keep:

• Your contact details: name, email address, phone number and when it is best to talk (by phone or in person).
• Your answers about the business: sector, town and postcode, how you receive orders today and how many, how you deliver and take payment, team size, what you are looking for and when you want to start, and, if you provide them, the business name, its address, its website and the address you want for your shop.
• The language you filled in the form in, to write to you in it.

They are used only to assess your application and to contact you about it. The basis is your consent, which you give by ticking the form's mandatory box; you can withdraw it at any time, without affecting processing carried out before. When you send it you receive an acknowledgement at your email and the project receives a notice with your application in its inbox.

During the review, internal notes, who reviewed it and when are added to the application; you can also ask to see them.

How long it is kept is under how long data is kept.

To protect the service, the people who use it and those who receive its emails against abusive submissions and unauthorised access, technical request data is processed, such as the IP address and the email entered in a form. The basis is the legitimate interest in keeping the platform secure (Art. 6(1)(f) GDPR). This data is not used for anything else.

Data is not disclosed to third parties, except where required by law. These providers process it on the project's behalf, as processors:

• Vercel Inc.: platform hosting.
• Neon Inc.: database.
• Resend: sending emails (the sign-in link, order updates and application notices).
• Google (Google Maps Platform, Places API): address suggestions. What you type in an address field —the search box in the “Where” step of the form to join and the delivery address when ordering from a shop— is sent to Google through takeit (not from your browser), only to look up addresses in Spain, together with a random identifier for the search and the page language; never your name, email or phone number, nor your IP address. We don't keep what you type: only the address you choose, in the form field, and you can correct it. If you'd rather not use it, type the address without choosing a suggestion.

Google, only if you choose to sign in with Google: it identifies you and provides your name and email, under its own privacy policy.

The shops you order from receive your order data, for which they are the controllers.

Vercel, Neon, Resend and Google (for address suggestions) are companies based in the United States, so your data may be processed outside the European Economic Area. Those transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified under it and, otherwise, on the standard contractual clauses approved by the European Commission.

• Your account: for as long as you keep it. When you delete it its data is erased, except what the law requires to be kept.
• Applications to join: rejected applications, or ones that never get an answer, are deleted 3 months after they are sent. If we invite you to open your shop, it is kept for as long as you have the shop on takeit; if you never open it, it is deleted 3 months after the invitation.
• Invitations: the invitation keeps the email it was sent to and is deleted on the same basis.
• Security data: only for as long as needed to stop the abuse that justifies it.

You can access your data, rectify it, erase it, object to its processing or ask for it to be restricted, take it to another service (portability) and withdraw your consent at any time.

You can do much of this yourself from My account: view, download or delete your data, once your email is confirmed. For anything else, or to view, correct or delete your application early or withdraw your consent, write to hi@hectortoral.com.

If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

The fields marked as mandatory in each form are needed to give you access or assess your application; without them it isn't possible. No automated decisions are taken and no profiles are built with your data.

For any question about the project: hi@hectortoral.com.