Rink Fries Inc. ("Rink Fries", "we", "us", or "our") operates the Rink Fries platform, which allows you to order food and drinks from a vendor and allows the vendor to manage its orders. A vendor is a canteen at a rink or venue, a food truck, or another independent seller that takes orders through Rink Fries. Rink Fries is a Nova Scotia company. This Privacy Policy explains what information we collect, why we collect it, who sees it, and what you can ask us to do with it. It is written to be read in one sitting.
Summary
- We collect what we need to take your order and get it to you, and nothing we do not use.
- We do not sell your information and we do not track you across the web.
- We display a small number of local advertisements that we place ourselves. Advertisers never receive your information.
- The vendor filling your order sees your name and your order. Apart from anyone you share your order link with, the people at Rink Fries who support the system, and the service providers listed in section 3, nobody else does.
- If you choose delivery to an address, we keep that address and, until 30 days after the order is completed or cancelled, its map coordinates. Sections 1.3 and 4 explain how long.
- Your card details go to our payment processor. We never see or store your card number.
- Our database and the files we store are kept in Canada. Some of our service providers operate outside Canada, and section 3 names them.
- You may ask us at any time for a copy of the information we hold about you, to correct it, or to delete it. Email us at [email protected] and we will respond within 30 days.
1. What We Collect and Why
1.1 If You Order as a Guest
At checkout we ask for your name and your email address. We use the name so that the vendor can call your order, and we use the email address to send you your order confirmation, your ready notice, and your receipt. If you tick "Text me" at checkout, we also ask for a Canadian mobile number, and we use it only to send you two text messages about that order: one when we receive it and one when it is ready. The box is unticked unless you tick it, and you may reply STOP to any text to stop them. When you tick the box, we record when you did so and which wording you agreed to, so that we can show that you asked for the texts.
If you choose delivery to an address, we also ask for a phone number. It is required so that the driver can reach you at the door. For seat, table, or parking delivery you may provide one if you want the vendor to be able to reach you. We use it only for that order and never for marketing.
When you place an order, we also record which version of our Terms of Service and this policy you were shown, and when. We store an identifier for the browser session that placed the order, so that only that browser can cancel a guest order where cancellation is allowed, and so that we can clear your cart once you have paid.
1.2 If You Create an Account
An account holds your name, your email address, and a password. We store the password in hashed form and cannot read it. You may add a phone number to your profile, and it is optional. We keep it on your account only. It is not added to your orders. If you want the vendor to be able to reach you about an order, provide a number at checkout. We keep a record of when your email address was verified, and of which version of our Terms of Service and this policy you accepted and when.
If you mark a venue or a vendor as a favourite, we keep that list on your account. If you add items to your cart while signed in, the cart is saved to your account until you order or remove them.
If you sign in with Google, Google sends us your name, your email address, and a link to your profile picture. We use the name and the email address to create and sign in to your account, and we keep what Google sent in your account record. We do not post anything to your Google account.
1.3 Your Orders
For every order we keep the items, the options you chose, any special instructions you typed, the prices and totals, the time of the order, and its status as it moves from received to ready to complete.
If you choose seat delivery, we keep the section, row, and seat you enter. If you choose table or parking delivery, we keep the table or spot number. If you choose delivery to an address, we keep the street address, unit, city, and postal code you enter, and we send that address to Google's geocoding service to convert it into map coordinates. We keep those coordinates and the distance to the vendor with the order so that the vendor can find you and so that the delivery fee is correct. We do not ask for the coordinates: we work them out from the address you type. Section 4 explains when we delete them.
If you pre-order for a later pickup window, we keep the window you chose. We keep a record of each email and text message we send you about an order, with the address or number it went to and when. If staff refund an order, they may add a note explaining why, and we keep it with the order.
Your order confirmation link allows anyone who has it to see that order, including your name, email address, phone number, and delivery details. Share it only with people you want to see the order.
1.4 Your Location While You Browse
When you allow location access in your browser, we use your position to show venues near you. We keep it in your browsing session, which lasts until you close your browser or, if you are signed in as a customer, for 21 days as described in our Cookie Policy. We do not save it to your account or to your orders.
1.5 Payments
Our payment processors are Square and Moneris, and each vendor uses one of them. With Square, you pay on Square's own payment page. With Moneris, you enter your card in Moneris's secure payment form on our checkout page. In either case your card number goes to the processor, not to Rink Fries. We keep the payment reference, the amount, and the status so that we can match the payment to your order and process a refund if you need one. Each processor's handling of your card is covered by its own privacy policy.
1.6 If You Sell on Rink Fries
For a business account we keep the business name, a contact email address, a phone number, and the addresses of its locations. If you are registered for GST or HST, we keep the registration number so that the tax on each order is correct. When you connect your Square account, we keep your Square merchant and location identifiers and an access token, and we store that token encrypted. We do not see your Square login. When you connect Moneris, we keep your Moneris store and checkout identifiers and your API token, and we store that token encrypted.
When you invite a staff member, we keep the email address you invite and who sent the invitation. When staff use the order screens, we record which staff member marked an order or part of an order ready, handed it over, or cancelled an item as sold out, and who changed the kitchen station setup.
1.7 If You Send Us Feedback
The feedback form asks for your first name, last name, email address, and what you wish to tell us. It also records the page you were on and your browser, device, and operating system so that we can locate the problem you are describing.
1.8 How We Use Order Data in Aggregate
We count how many orders each venue and each vendor had in a month. We use those counts to operate Rink Fries, to report to venues and vendors, and to tell an advertiser how busy a venue is. A count is a number only, and it does not include who ordered.
We also keep the time at which each order moved from received to ready to complete, and we use those times to work out how long a vendor takes to fill an order so that we can display an approximate wait time. This is our own measurement within Rink Fries, and no outside analytics service is involved.
1.9 Local Advertisements
We display local advertisements on the site, such as a car dealership near a rink. We place these advertisements ourselves, and there is no advertising network behind them. We count how many times an advertisement was shown and how many times it was clicked, and those are totals for the advertisement, not records about you. When you click an advertisement, you leave Rink Fries for the advertiser's site, and what happens there is covered by the advertiser's privacy policy. Advertisers do not receive your name, your email address, your orders, or anything else about you.
1.10 Technical Records
Like every website, our servers keep an access log containing your IP address, your browser type, and the pages you requested. We strip order links out of that log so that it does not hold a way into your order. We use an error reporting service, Sentry, so that we learn about crashes. Before a report leaves our servers, we remove cookies, form contents, the query part of web addresses, and order links, and we have it configured not to collect your name, email address, or IP address. What it receives is a technical description of the error. Our site sits behind Cloudflare, which sees your IP address and may ask your browser to pass a security check.
2. What We Do Not Do
- We do not send marketing email or marketing text messages. We text you only about an order, and only when you ticked "Text me" for that order.
- We do not use analytics or advertising cookies, and we do not use an advertising network. The local advertisements on the site are placed by us.
- We do not share your information with advertisers.
- We do not sell your information to anyone.
- We do not store card numbers.
The only cookies we set are those the site needs in order to work: a session cookie so that your cart follows you and, if you sign in, you stay signed in; a security cookie that protects forms from forgery; the cookies Cloudflare sets to protect the site; and, for vendor staff only, two cookies that remember a kitchen screen's settings. Our Cookie Policy states how long each lasts. There is no cookie banner because there is nothing on the site to opt out of. If that ever changes, we will update this page and ask first.
3. Who Sees Your Information
- The vendor filling your order, and the person delivering it. They see your name, your email address, your order, your delivery details, and your phone number if you provided one. They do not see your password or your payment details.
- Anyone you give your order link to can see that order.
- Rink Fries staff. A small number of people at Rink Fries can see orders across all vendors so that we can support you and the vendors and resolve problems. Access is by role.
- Venues and advertisers receive order counts only, never orders or names.
- Square or Moneris, whichever the vendor uses, receives what it needs to take your payment. Square receives the items on your order, the order number, and your email address, so that it can show you what you are paying for and send you a receipt.
- Google receives delivery addresses to convert them into map coordinates, provides the address search on vendor dashboard forms, and handles Sign in with Google if you use it. The Sign in with Google button image loads from Google, so Google sees your IP address when you open the sign-in page.
- Amazon Web Services hosts the site and the database in Canada, and delivers our email and the order text messages you ask for. A text message then travels through your mobile carrier.
- Cloudflare sits in front of the site for security.
- Sentry receives the error reports described in section 1.10.
- The law. We will share information if a court or a law enforcement body requires us to, or if we need to in order to protect you, the vendors, or Rink Fries from harm.
Each of these providers receives only what it needs to do its job for us.
Where your information is stored. Our database, the files we store, and the systems that send our email and text messages are operated by Amazon Web Services in its Canada (Central) region. Some of the providers above are based in the United States and may handle what they receive outside Canada: Cloudflare (every visit passes through its network), Google (delivery addresses, the dashboard address search, and Google sign-in), Square (your payment, if the vendor uses Square), and Sentry (error reports, with the details listed in section 1.10 removed). If the vendor uses Moneris, your payment is handled by Moneris, a Canadian company, which may also handle some information outside Canada. Information handled outside Canada is subject to the laws of the country where it is handled, and the courts and authorities there may be able to obtain it.
4. How Long We Keep It
This section sets out what we delete, and when. An automated job runs every morning and carries this out.
Orders you placed. We keep the order record for receipts, refunds, disputes, and tax. Canadian tax rules expect a business to keep its sales records for six years counted from the end of the financial year in which the sale falls, so we keep every order at least that long. After that we may remove your name and contact details from an order and keep only the amounts, dates, and items. The records of your consent to text messages and to our terms stay with the order, because they are our proof that you agreed.
Checkouts you started but never paid for. Thirty days after we mark one abandoned, we remove your name, email address, phone number and, if it was a delivery, the address you typed. Nothing was sold, so we have no reason to keep any of it. What remains is a line recording that an order was started and never completed. If you were signed in when you started it, that line stays linked to your account.
The map coordinates behind a delivery address. When you give us an address, we work out its coordinates to measure the trip and price it. Thirty days after a delivery order is marked complete, or after it is cancelled, we delete those coordinates. The address itself and the distance we charged for stay on the order, because they are the record of what you paid for.
Invitations to join a vendor's staff. If an invitation is never accepted, we delete it, and the email address in it, thirty days after it expires or is withdrawn.
Your favourites and saved cart. These stay on your account until you remove them or your account is closed.
Browser sessions. Expired sessions are removed from our servers nightly. A signed-in customer session lasts 21 days; a guest or staff session ends with the browser.
We do not keep a record of where your device is. We use your location while you are looking for nearby shops, and it is gone when your session ends.
If you ask us to delete your data, we delete your account, your favourites, and your saved cart. The orders you placed stay, with the name and contact details on them, because the tax rules above require us to keep them for at least six years; after that we may remove your name and contact details from them. We do not use anything we keep for that reason for any other purpose.
5. Your Rights
Under Canada's privacy law (PIPEDA) you may ask us to:
- tell you what personal information we hold about you and provide a copy,
- correct anything that is wrong,
- delete your account and the information we are not required to keep,
- stop using your information for a purpose you did not agree to.
Email [email protected] and tell us what you want. We will respond within 30 days. We may ask you to confirm that the account is yours before we act. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.
6. Security
The site is served over HTTPS. Passwords are hashed, and Square and Moneris tokens are encrypted at rest. Staff access to the dashboard is by role, and each role sees only its own vendor. We remove order identifiers from our logs. No system is perfect, and if we ever have a breach that affects you, we will tell you.
7. Children
Rink Fries is not aimed at children under 13, and we do not knowingly collect information from them. Ordering and paying on Rink Fries is for the adult whose card is being used. We cannot see who is entering a card at checkout, so a parent or guardian should place the order. Our Terms of Service cover what happens when a card is used by someone other than the cardholder. If you believe a child has used your card on Rink Fries, contact the vendor or email [email protected] and we will help where we can.
8. Changes to This Page
When we change this page, we update the date at the top. If a change affects how we use what we already hold about you, we will notify account holders by email before it takes effect.
9. Contact
Rink Fries Inc. Nova Scotia, Canada [email protected]