Privacy Policy
In force since 19 September 2026
This Privacy Policy explains how Ozhaca LLC, a limited liability company organised under the laws of the State of Wyoming, United States, with its registered address at 30 N Gould St Ste N, Sheridan, WY 82801, United States ("Company", "we", "us"), collects, uses and discloses personal data in connection with the Chitrail platform (the "Service").
This Policy distinguishes two categories of individual. The first is a business that holds an account and the personnel it authorises ("Customer"), in respect of whom the Company acts as controller. The second is a guest of that business who uses the ordering interface at its premises, in respect of whom the Company acts as processor on the Customer’s instructions. Guests seeking information about the handling of their data should contact the business whose premises they attended.
1. Personal data we collect from Customers
In connection with an account, the Company collects and processes:
- Account identifiers, being the email address or username used to authenticate and a cryptographic hash of the password;
- Business information, being the trading name, trading addresses, contact details, opening hours and currency;
- Personnel records, being the names of individuals the Customer authorises, the permission level assigned to each and the locations to which each is assigned;
- Service usage records, being actions taken within the Service and the time at which they were taken;
- Billing records, being a customer reference issued by our payment processor and the invoices raised. Payment card details are not collected by or disclosed to the Company; and
- Correspondence, being the content of enquiries and support requests submitted to us and our responses.
The legal bases for this processing are the performance of the contract between the Company and the Customer, compliance with legal obligations including taxation and accounting, and the Company’s legitimate interests in securing, supporting and improving the Service.
2. Personal data processed on behalf of Customers
Where a guest places an order or makes a reservation at a Customer’s premises, the Company processes order contents, the table identifier, a randomly generated device identifier used to associate successive orders from the same session, any dietary or allergen note entered, and where a reservation is made, the name, contact number and any request recorded.
This data is processed solely on the documented instructions of the Customer, who determines the purposes and means of the processing and the retention period applicable to it. The Company does not use it for any purpose of its own. Guests are not required to create an account, provide an email address or supply payment details in order to use the ordering interface.
3. Disclosure to service providers
The Company engages third-party service providers to perform functions on its behalf. These providers fall into the following categories: cloud infrastructure and database hosting; content delivery and network security; payment processing; product analytics and performance measurement; automated content processing where a Customer submits a document for extraction; and electronic mail delivery.
Each provider is engaged under a written agreement restricting the use of personal data to the provision of its services to the Company. A current list of providers is available to Customers on request to the address below.
The Company does not sell personal data and does not share personal data for cross-context behavioural advertising, as those terms are defined under applicable United States state privacy law.
The Company may disclose personal data where required by law, court order or governmental authority, or where necessary to establish, exercise or defend legal claims, and in connection with a merger, acquisition or sale of assets, subject to the recipient being bound by this Policy.
4. Analytics and storage on your device
The Company measures how its own marketing site and administrative interface are used, in order to identify faults and improve them. Fields containing guest reservation details are excluded from collection at source.
The Company also records aggregate delivery and performance data for every interface forming part of the Service, including the ordering interface, which places no information on the device and is not associated with any order, reservation or individual guest.
The Service stores information on the user’s device that is necessary for it to function, including an authentication token, interface preferences and, in the ordering interface, the contents of the current order and the table identifier. Additional identifiers may be set in connection with the measurement of the Company’s own marketing site and administrative interface described above. This information may be cleared at any time through the browser or device settings; clearing information that is necessary for the Service to function will require the user to authenticate again.
5. Retention
Account data and associated records are retained for the duration of the account. On termination the account, its content and all associated user records are deleted.
An account created with no content is removed after seven (7) days. An account holding published content that has never held a paid subscription is removed after ninety (90) days. Billing records are retained by the Company and its payment processor for the period required by applicable taxation and accounting law.
Personal data processed on behalf of a Customer is retained in accordance with that Customer’s instructions and is deleted on termination of their account.
6. Your rights
Subject to applicable law, individuals may request access to the personal data held about them, correction of inaccurate data, deletion of data, restriction of or objection to certain processing, and portability of data provided to the Company. Individuals may also lodge a complaint with their supervisory authority.
Requests should be submitted to the address below and will be responded to within the period required by applicable law. The Company may request information reasonably necessary to verify identity before acting on a request. Where the Company acts as processor, requests will be referred to the relevant Customer and the Company will provide reasonable assistance in responding to them.
7. International transfers
The Company and its service providers process personal data in the United States. Where personal data originating in the European Economic Area, the United Kingdom or Switzerland is transferred to the United States, that transfer is made on the basis of the Standard Contractual Clauses approved by the European Commission and, where applicable, the United Kingdom International Data Transfer Addendum, together with supplementary measures where required.
8. Security
The Company maintains administrative, technical and physical safeguards designed to protect personal data against unauthorised access, disclosure, alteration and destruction, including access control, encryption of data in transit and segregation of customer data. No method of transmission or storage is entirely secure, and the Company cannot guarantee absolute security. Where the Company becomes aware of a personal data breach it will notify affected parties and supervisory authorities as required by applicable law.
9. Children
The Service is intended for use by businesses and their personnel. It is not directed to children and the Company does not knowingly collect personal data from a child. Where the Company becomes aware that it has done so, the data will be deleted.
10. Changes to this Policy
The Company may amend this Policy. The date stated above will be updated and, where a change materially affects the rights of Customers, notice will be given through the Service before it takes effect.
Questions about this document, or requests under it, should be addressed to hello@chitrail.com.