Privacy policy

takeit is an independent, early-access project so that small businesses —the bakery, the bar or the greengrocer in a village or a neighbourhood— can have their own website and take orders from phones. Their customers can pick the order up, have it delivered or have it at the shop, depending on what each business offers, and the business keeps its orders organised in one place.

Businesses join by invitation, after a short application on the join page, and the project helps them get started: adding their products, setting their hours and choosing how they deliver and how they get paid.

takeit is still being built: some features may change and others are on the way. There is more about the project on the home page.

takeit provides the software those shops' websites run on.

Each of those websites is run by its owner —a person or a business—, who is responsible for it. Its legal texts (legal notice, terms, privacy and cookies) are on its own website, under /legal on its domain, and they are the ones that govern the purchases, payments and order data made there.

The takeit project is the controller of the data processed on this domain, and of the sign-in account used on every shop that runs on takeit. For any data protection question you can write to hi@hectortoral.com.

The data of the orders you place on a shop's website (your phone number, the address, what you order, the payment) is that shop's responsibility, and its own privacy policy, on its website, explains it.

• What data: your email address, to which a one-time sign-in link is sent, or, if you sign in with Google, the name and email Google provides; and whether the email is confirmed.
• What you add yourself: your name, your phone number and an address, so you don't have to type them into every order, and, if you tick them, your diet preferences (vegetarian, vegan, lactose-free, pescatarian, halal, kosher), which are used only to filter the menu and which you can remove at any time. They are optional: the account works without any of them. Also kept is the mark that you confirmed the minimum age —the date, the language and the version of the terms you read, never your date of birth— and whether you turned on sharing with your friends.
• What for: giving you access to your account, your orders and, if you have a shop, its dashboard.
• Legal basis: to give you access and keep the account running, performance of the platform's terms of use (Art. 6(1)(b) GDPR). The optional items above —phone, address and diets— are processed because you are the one who chooses to add them, and only for what they say: saving you the typing and filtering the menu. You can remove them in My account without losing the account.
• Session: a strictly necessary cookie keeps you signed in; it is described in the cookie policy.

On a shop's website you can order without signing in by entering an email address. The order is saved to the takeit account for that email and, if none exists, takeit creates it with the email and name you enter. It is the same account you can use to sign in on any shop that runs on takeit.

• What the account keeps: the email, the name and whether the email is confirmed. The order data (your phone number, the address, what you order) belongs to the shop, which is its controller.
• What for: so you can see your orders and get their updates. The basis is performance of the contract: the account is how the order you placed is shown to you.
• Until the email is confirmed nobody can sign in to the account or see its orders: the order confirmation reaches that email with a one-time link that signs you in and confirms the address. Entering an email when ordering never signs anyone in.
• The confirmation page: when you order without signing in, that page's address carries a code which lets you see the orders from that purchase again, and pay for them, without signing in for 45 days. Nothing is stored in your browser, and only the code's fingerprint is kept. If the order is paid online, the email confirming the payment carries a code of its own, which opens only that order; otherwise the reminder of a scheduled order may carry it. Each order has at most one such code, and it expires at the same time as the confirmation page's.

Your account can have friends, and show them what you order. What is processed:

• Who you are friends with, and since when. A friendship is created with a link you generate yourself and pass to whoever you like (over WhatsApp, for example): it lasts 14 days, is spent by the first person who opens it and signs in, and only its fingerprint is stored, never the link itself. You can undo a friendship whenever you like, from My account and from either side.
• Requests by email. You can also add someone by typing their email, or by picking them from your phone's contacts if your browser allows it: from your contacts only the emails you pick are sent, once, to check whether any of them belongs to a takeit account, and they are not stored. If there is an account with that confirmed email, the request is kept (who sent it, to whom, when and whether it was accepted) and they are told by email; if there isn't, nothing is kept, not even the email you typed. Nobody is looked up by their phone number.
• Which products you have ordered in each shop. Every time an order is completed, which products it contained, how many times you have ordered them there and when the last time was are recorded. Not the price, not the address. This is recorded always, whether or not you show it.
• What your friends see. Only if you turn on “Let my friends see what I order”, which is off to begin with: then, on a shop's menu, your friends see your name on the products you have ordered in that shop. Never the price, the date, how many times, or anything from another shop. The basis is your consent; the switch is checked when reading, so turning it off removes you from all your friends' menus at once.
• Your name. In the friends list, anyone already a friend of yours sees your name —the one you set in My account; if you haven't set one, the one you typed when placing an order, and failing that, the part of your email before the at sign— and whether or not you share. That does not depend on the switch: the only thing that ends it is undoing the friendship.

If you have a shop, or are on the team of one with access to its Orders, you can ask your phone to alert you when an order comes in. It is voluntary and is turned on device by device.

• What is stored: the address your browser's push service issues for that device, the two keys the browser itself generates to encrypt the alert, which shop and which takeit account it belongs to, the identifier you sign in to that shop with, and when you turned it on. Not the device model, not its IP address, not where it is.
• What the alert carries: the shop's name, the amount and the fulfilment method. Never the name of whoever ordered nor their address: that is read on the dashboard screen, with the session. If the shop delivers through takeit, it may also receive an alert saying that the rider who accepted a shipment has not turned up to collect it, carrying that rider's name.
• Who delivers it: the browser push service your own device chose (depending on the maker: Google, Apple or Mozilla). It receives that device's address and the already encrypted alert, which only that device can open.
• Legal basis: your consent, given by turning the switch on and accepting the permission the browser asks for. You can turn it off at any time from Settings › Alerts: doing so deletes that device's subscription. It is also deleted if you leave that shop's team, if the shop is deleted, or if the push service says that device no longer exists.

Opening a shop is a different relationship from buying, and it processes different data. If you only order, none of this affects you.

• About the shop: its trade name, its legal name, its tax ID, its registered address, its contact phone and email, its opening hours, its menu with its photos, its own domain if it connects one, and the map point of its address (only if it picks the address from the suggestions). If the shop is a sole trader, all of that is their data as a person, not a company's. It is also the data the law requires it to publish in its own legal notice.
• About its team: to give someone access to the dashboard, the email or phone they sign in with —their identifier— and which sections they may open are stored. An invitation keeps the email it was sent to. Removing someone from the team also removes the alerts to their phones. Each sale also keeps who on the team served it, under the name the shop's owner gave them in the dashboard: that name may be printed on the customer's receipt, it stays on sales already made if that person leaves the team, and if it is changed later who changed it and when is kept. What each person's sales add up to, their goals and their commissions are seen by the shop's owner only.
• Its Stripe keys: the shop charges in its own Stripe account, so it pastes its keys here. They are stored encrypted, decrypted only to make a charge in its name, and never shown back in full nor written to any log.

What for and on what basis: providing the service the shop signed up for —performance of that contract— and meeting the tax and accounting obligations that come with it.

How long it is kept: for as long as the shop exists. A shop that has never had an order is deleted in full, with its products, its photos and its job applications. One that already has orders cannot be deleted: its orders and invoices are kept by law (see the period below), so what happens is that it stops selling, not that the history is erased.

A delivery company can register on takeit, and register its riders, to carry shops' orders. It only affects whoever registers; if you only order, none of this processes any data of yours.

• About the company: its name, its tax ID, the provinces it covers and its contact phone and email; and, once it provides them, the legal name and address it is invoiced with, the addresses it wants to be notified at, and the hours during which it accepts shipments. For a sole trader, that data is theirs as a person. And, if it sets one, its rate —what it charges shops per shipment—, which the shops in the provinces it covers can see; the amount of each shipment it accepts, worked out from that rate; and the “paid” mark of each month with each shop, with the date and the account that set it. takeit neither charges nor pays that money: it records it so the company and the shop see the same figure.
• About the rider: their name, their phone if they give it, the vehicle, the provinces they cover, whether they are on shift right now, and the takeit account they sign in with. A record is also kept of the shipments offered to them, when, and how each offer ended.
• Their base, which is where their working day starts and ends and, almost always, their home address. It serves two purposes: ranking by proximity who a shipment is offered to and, when they open their own route, drawing along the streets the leg from their base to the shop — for which its coordinates alone, with nothing saying whose they are, are sent, through takeit, to the service that works out the route: Google or, depending on how takeit is set up, a routing server that uses OpenStreetMap data. Typing it also goes through Google: that address is entered in the same address search box as any other, so what is typed travels to Google as explained further down. The written address is seen only by whoever manages their company's fleet and by themselves; it reaches neither the shop's dashboard nor the offer that appears on their phone.
• Where they are while carrying an order, and only if they turn it on. Once a bag has been collected, the rider's screen offers to share their location; it explains this before the browser asks for permission, and saying no changes nothing: they can still deliver. If they turn it on, their phone sends its location while that screen is open, at most once every 15 seconds. Only the last point is stored —never the path—, with the time it arrived and rounded to one metre, and it is seen by whoever placed that order, on the map of their order page, and by the shop of that order, by those in it allowed to see deliveries. Nobody else: not other customers, not the office of their delivery company. It is deleted the moment the shipment is delivered or reported as not delivered, and also as soon as they press «Stop sharing», withdraw the permission or sign out on that phone; in any case, after 30 minutes without being renewed. Before the bag is collected and after it is delivered no location is processed. It is not sent to Google or to any other third party.
• What people think of them. Whoever receives an order they carried can rate them in the survey, and those ratings produce an average of theirs which whoever manages their fleet sees. What is stored is how many ratings they have and the sum of the scores, never which customer each one came from. The written comment is for the shop, not for their record.
• Who sees them: the shop whose order they are carrying sees their full name, and their phone number while the shipment is still under way, so it can talk to whoever is coming to collect; once the shipment closes it stops seeing it. Whoever placed the order sees only their first name —not their phone, not their base— and, if the rider shares it, where they are while carrying that order. The shop's phone may also receive an alert, carrying their name, if they accepted a shipment and did not turn up to collect it.
• Alerts on their phone: if they turn them on, their browser's push service receives that device's address and the already encrypted alert, which carries the shop's name and what the trip pays —never any data about whoever is receiving the order—. The same is stored about their device as about a shop's: that address, its two keys and whose it is; never the model, the IP address or where it is. Shipments are only offered to them while they are on shift, and going off shift is what stops them.

Legal basis: performance of the platform's terms of use with whoever registers. Location while carrying an order is processed only with the rider's consent, given by turning it on on their phone and withdrawn at any time with «Stop sharing» or by removing the permission in their browser. For any question about this data, including a rider's base, write to hi@hectortoral.com.

If you fill in the form to join takeit, we keep:

• Your contact details: name, email address, phone number and when it is best to talk (by phone or in person).
• Your answers about the business: sector, town and postcode, how you receive orders today and how many, how you deliver and take payment, team size, what you are looking for and when you want to start, and, if you provide them, the business name, its address, its website and the address you want for your shop.
• The language you filled in the form in, to write to you in it.

They are used only to assess your application and to contact you about it. The basis is your consent, which you give by ticking the form's mandatory box; you can withdraw it at any time, without affecting processing carried out before. When you send it you receive an acknowledgement at your email and the project receives a notice with your application in its inbox.

During the review, internal notes, who reviewed it and when are added to the application; you can also ask to see them.

How long it is kept is under how long data is kept.

To protect the service, the people who use it and those who receive its emails against abusive submissions and unauthorised access, technical request data is processed, such as the IP address and the email entered in a form. The basis is the legitimate interest in keeping the platform secure (Art. 6(1)(f) GDPR). For the same reason, the date, IP address and browser of each sign-in to your account are stored, and you can review them in My account to close anything you don't recognise: the last 10 are kept, for at most 90 days. This data is not used for anything else.

Data is not disclosed to third parties, except where required by law. These providers process it on the project's behalf, as processors:

• Vercel Inc.: platform hosting.
• Convex Inc.: the database and the file storage takeit runs on. Besides the data, that is where every uploaded file lives: the photos of the shops and their products, the CVs from job applications, and the photos a rider uses to prove a delivery.
• Resend: sending emails (the sign-in link, order and appointment updates, and application notices).
• Google (Google Maps Platform), for two things. Suggesting an address as it is typed, in the six places where takeit asks for one: the “Where” step of the form to join, the shop's address when it is set up, the delivery address when ordering from a shop, the one someone types on a brand's website to sort its locations by distance, the shop's own address in its dashboard (Settings › Contact) and a rider's base in their company's dashboard. What is typed goes to Google from our server, not from your browser, only to look up addresses in Spain, with a random identifier for the search and the page language; never your name, email or phone number, nor your IP address. We don't keep what you type: only the address you choose, in the form field, and you can correct it. If you'd rather not use it, type the address without choosing a suggestion. And drawing a delivery run's route along the streets —the shop sees it on its dashboard, and whoever delivers it on theirs—: only coordinates travel there, the shop's, the stops' and, only on the rider's screen, their base's; no written addresses, no names, no phone numbers, not your IP address. Those coordinates stay 6 hours in our server's memory so the same thing isn't asked twice. Who works out that route depends on how takeit is set up: Google and, if Google gives no line or is not set up, a routing server that uses OpenStreetMap data. Whoever works it out receives those coordinates and no other data of yours.
• CARTO: the maps. Wherever takeit draws a map —a shop's delivery screen and a delivery order's sheet, a rider's, the order page of whoever is waiting for it, the platform's console and the public page for delivery companies— your browser downloads the map images straight from CARTO, so CARTO sees your IP address and your browser. Your browser fetches it on its own rather than through us —as it does Stripe's script, or the hop to Google when you sign in— and it happens without waiting for your cookie choice, because the map is that screen's content. Nothing else of yours is sent to it: not who you are, not which order it is. The map data comes from OpenStreetMap.
• Stripe: taking payment. Each shop charges in its own Stripe account, not in one of takeit's, and it is the shop that answers for the charge; Stripe's script is loaded by your browser only when there is something to pay, not on an order's other pages. What takeit keeps about a shop is its Stripe keys, encrypted, so the charge can be made in its name.
• Your browser's push service (the one your own device chooses: Google, Apple or Mozilla), only if you turn on alerts on a phone —a shop's order alerts, or shipment alerts if you deliver—: it receives that device's address and the already encrypted alert.
• The same goes for anyone who orders from a shop and taps “Notify me on my phone” on their order: their browser's notification service receives that device's address and the notification already encrypted, with the shop's name, the order's status and its reference; the subscription is deleted when the order is finished. And for anyone who taps the same on the page of an appointment: the notification carries the shop's name, the service, what happened (confirmed, changed, cancelled or the reminder) and the time; the subscription is deleted when the appointment is over or cancelled.

Google, only if you choose to sign in with Google: it identifies you and provides your name and email, under its own privacy policy.

The shops you order from receive your order data, for which they are the controllers.

Vercel, Convex, Resend and Google (for address suggestions and, when it is the one working it out, for drawing the delivery route) are companies based in the United States, and the browser push service is the one run by whoever made your device or browser (Google, Apple or Mozilla), so your data may be processed outside the European Economic Area. Those transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified under it and, otherwise, on the standard contractual clauses approved by the European Commission.

• Your account: for as long as you keep it. When you delete it its data is erased —its email, its name, its phone number, its address, its diets, its sessions, its friendships and the record of what you had ordered product by product— except what the law requires to be kept.
• Orders do not go with the account: the shop keeps them because the law requires it to, though they stop saying who placed them. They are destroyed six years after the order's last accounting entry, and the deletion happens at the end of the financial year, so it can be up to seven. Each shop's own privacy policy, on its own website, tells the whole story.
• Applications to join: an application is deleted 90 days after you send it (if you send it again, the clock starts over). That period is the same whether nobody ever touched it or we rejected it: reviewing or rejecting it does not restart the clock, so one rejected late is deleted shortly afterwards. If we invite you to open your shop and you open it, it is kept for as long as you have the shop on takeit; if you never open it, it is still deleted 90 days after you sent it, even though its invitation link may live on a few days longer.
• Invitations: the invitation keeps the email it was sent to and is deleted 90 days after it expires —also if it was revoked earlier, because the clock is its expiry date—. One that did open a shop is kept for as long as the shop exists.
• Sign-ins to your account: the last 10, and at most 90 days.
• Security data: only for as long as needed to stop the abuse that justifies it.

You can access your data, rectify it, erase it, object to its processing or ask for it to be restricted, take it to another service (portability) and withdraw your consent at any time.

You can do much of this yourself from My account: view, download or delete your data, once your email is confirmed. For anything else, or to view, correct or delete your application early or withdraw your consent, write to hi@hectortoral.com.

If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

The fields marked as mandatory in each form are needed to give you access or assess your application; without them it isn't possible.

No automated decisions are taken about you: nothing that affects you is decided by a program on its own. Nor are you classified or tracked for advertising. Counts are kept, though: each shop keeps figures about its own customers (their orders, what they spent), and your account records which products you have ordered at each shop, so they can be shown to your friends if you turn that on. It is set out above, in its own section, and it is deleted when you delete the account.

For any question about the project: hi@hectortoral.com.