Privacy notice

This notice explains how your personal information is used when you visit Crumb & Co's ordering website, place an order, sign in or join its rewards. We have kept it as plain as we can. If anything is unclear, contact us using the details at the end.

Crumb & Co ("the restaurant") is responsible for the information you give when you order: your order, your contact details, your delivery address, your rewards and whether you want its marketing. In data protection terms the restaurant is the controller of this information. You can reach it at: 42 MM Alam Road, Gulberg III, Lahore, 042 3578 1100.

The restaurant uses DelishOS to run this website, take orders and payments, and send messages. For the restaurant's information, DelishOS acts only on the restaurant's instructions, as its processor (a "service provider" under US state laws). DelishOS is provided by VentureChefs LLC, a Wyoming limited liability company (filing 2026-002051789), 1021 E Lincolnway #10586, Cheyenne, WY 82001, United States.

DelishOS is a controller in its own right for a small number of things it does for every restaurant that uses it:

• Your DelishOS sign-in. When you sign in with a code, a passkey, Apple or Google, DelishOS keeps a guest account (your phone number or email, how you signed in, and which restaurants you have used it with) so that you can sign in quickly at any restaurant that uses DelishOS. Each restaurant only sees its own orders and customer record.
• Fraud prevention and security. DelishOS checks for fake orders, card testing, abuse of text messages and attacks on the service, across all restaurants. This uses coded (hashed) phone numbers, emails, device identifiers and IP addresses.
• Running and improving the service. DelishOS keeps technical logs and error reports, and counts how the service is used, without looking at the content of your orders for its own purposes.

• Your name, phone number and, if you give it, your email address.
• For delivery: your address, any delivery note and the delivery pin you place on the map. For collection at the kerb: your car details if you give them.
• What you ordered, notes for the kitchen, any allergy you tell the restaurant about, tips, offers and codes used, and the times of your order.
• Payment status and the last digits and type of card shown by the payment provider. Your full card details go straight to the payment provider (Stripe, or XPay in Pakistan) and are never seen or stored by the restaurant or DelishOS.
• Your rating and comment if you review your order.

• The phone number or email you sign in with, or your Apple or Google account identifier and email.
• A passkey, if you create one (your device keeps the private part; we keep only the public key).
• Your rewards points, and a wallet card if you add one to Apple Wallet or Google Wallet.
• Your saved addresses and, if you choose to tell the restaurant, your birthday (day and month only).

• Your IP address, your browser and device type, and a random identifier stored on your device, used for security, fraud checks and to keep you signed in.
• Your basket, language, chosen location and light or dark setting, kept on your device. See "Cookies and storage" below.
• If the restaurant has added analytics or advertising tools (Google Analytics, Meta or TikTok), information about your visit, but only if you say yes on the cookie banner.

We only use your device's location if you tap to find your address, and only for that lookup; it is not kept. The delivery pin you place is kept with your order.

• To take, prepare, deliver and settle your order and keep you updated about it: needed to perform the contract with you (the restaurant's legal basis).
• To sign you in and keep your account secure: needed to provide the service you asked for (DelishOS's legal basis).
• To prevent fraud, abuse and attacks: legitimate interests of the restaurant and DelishOS in protecting guests, restaurants and the service, and in some countries a legal requirement.
• To run the restaurant's rewards and offers you join: contract.
• To send you marketing (offers and news by text, WhatsApp or email): only with your consent, or, where the law allows, because you are an existing customer and did not opt out. You can stop at any time.
• To ask you to review an order: the restaurant's legitimate interests; you can ignore or stop these.
• To keep records the law requires, such as tax and accounting records: legal obligation (the restaurant's).
• Analytics and advertising cookies set by the restaurant's tools: only with your consent.

Messages about your order (confirmation, progress, delivery, receipts and sign-in codes) are part of the service and are sent by text, WhatsApp or email. Marketing is separate: the restaurant only sends it if you agreed, every marketing message tells you how to stop (for example reply STOP to a text), and stopping takes effect quickly. In the United States, marketing texts are only sent with your prior written consent, which is never a condition of buying.

We do not make decisions about you using only automated means that have legal or similarly significant effects. Fraud checks may hold an order, ask for payment by card, or ask for a sign-in code; a person at the restaurant can always review this. The restaurant's staff may use DelishOS's AI assistant to manage their business, but your name, contact details, address and messages are not sent to the AI provider, and if an AI ordering assistant is offered on this site, any question about allergies goes to a person at the restaurant.

• The restaurant and its staff, who need your order to make and deliver it.
• DelishOS's service providers that run parts of the service for us, under contracts that protect your information: Cloudflare (hosting and security), Neon, a Databricks company, on Amazon Web Services (database, in Germany), Stripe and XPay (payments, through the restaurant's own payment account), Twilio (text messages), Meta (WhatsApp messages), Google and Apple (sign-in and wallet cards, if you use them), OpenFreeMap (map tiles when you open a map), and Anthropic (AI features for restaurant staff; no guest contact details). The full list is in DelishOS's sub-processor list.
• Delivery couriers, if the restaurant uses one for your order: your name, phone number, address and delivery note.
• Analytics and advertising providers chosen by the restaurant (Google, Meta, TikTok), only if you say yes to cookies.
• Authorities, courts or others when the law requires it, or to protect someone's safety or rights, or to prevent fraud.
• A buyer of the restaurant's or DelishOS's business, if that happens, under the same protections.

Neither the restaurant nor DelishOS sells your personal information for money.

The database is in Frankfurt, Germany. Some providers process information in the United States and other countries, for example Twilio, Anthropic, Stripe, Google and Apple. When information leaves the UK, the European Economic Area, Saudi Arabia or the UAE, we protect it with the safeguards the law requires, such as the EU standard contractual clauses, the UK addendum to them, the EU-US and UK-US data frameworks where the provider is certified, and the standard contractual clauses issued by the Saudi Data and AI Authority. You can ask us for a copy of the relevant safeguards.

• Orders: kept by the restaurant for its accounts and tax records while it uses DelishOS. Contact details given only for a single order are cleared 30 days after the order is finished, and your name, contact details and address on an order are removed 7 years after it was placed.
• Your customer record and saved addresses at the restaurant: until you ask the restaurant to delete them, or the restaurant stops using DelishOS.
• Your DelishOS sign-in account: until you ask us to delete it, or 3 years after you last sign in.
• Security records: security events for 90 days; sign-in sessions end after 90 days at most; records of sign-in codes sent for up to 30 days.
• Backups: deleted information can remain in backups for up to 7 days before it is overwritten.

DelishOS's full retention schedule sets out every period.

Depending on where you live, you can ask to see the information held about you, correct it, delete it, receive a copy in a format you can reuse, object to or restrict how it is used, and withdraw consent at any time (this does not affect what was done before). You can also object to direct marketing at any time.

• For your orders, customer record, rewards and marketing, contact the restaurant: 42 MM Alam Road, Gulberg III, Lahore, 042 3578 1100. The restaurant can export or erase your record. DelishOS helps the restaurant answer you, and if you write to DelishOS about the restaurant's information, we pass your request to the restaurant within 5 working days.
• For your DelishOS sign-in account or DelishOS's fraud and security records, write to privacy@delishos.co.

We will confirm who you are before acting on a request, answer within one month (or the time your local law sets, whichever is shorter), and tell you if we need longer. Using your rights is free. You will not be treated differently for using them.

If you are unhappy with how your information is handled, please tell us first so we can put it right. We acknowledge complaints within 30 days. You also have the right to complain to the data protection authority where you live (listed below).

This website does not use cookies of its own. It stores some information on your device (in your browser's storage) to make the site work: your basket, your sign-in, your checkout details while you complete an order, your language and display settings, a random device identifier used for security, and your cookie choice. This is strictly necessary for the service you asked for.

• Payment and security checks: when you pay by card, the payment provider's form (Stripe or XPay) may set its own cookies to prevent fraud. When a sign-in code is sent, a Cloudflare check may run to stop automated abuse.
• Fonts and maps: the site's fonts come from the site itself, so no font service sees your visit. When you open a map, tiles load from OpenFreeMap, which receives your IP address.
• Analytics and advertising: only if the restaurant has added Google Analytics, a Meta pixel or a TikTok pixel, and only after you say yes. Nothing loads before then. You can change your mind with "Cookie choices" at the bottom of every page.

This website is for a general audience and is not aimed at children. We do not knowingly collect personal information from children under 13 (or the age set by your local law) without a parent's consent. If you think a child has given us information, contact us and we will delete it.

Information is encrypted in transit and at rest. Staff access is limited by role, protected by passkeys or two-step sign-in, and recorded. Only named DelishOS staff whose role needs it can view a restaurant's information, to support the restaurant and keep the service safe; viewing is read-only, any change needs a recorded reason and a security-key check, and every access is recorded. Sign-in codes, passwords and PINs are never stored in readable form. If a breach puts your information at risk, we will tell you and the authorities as the law requires.

The UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations apply in the UK; the GDPR and national cookie laws apply in the EEA. The legal bases are set out above. Where we rely on legitimate interests, you can ask us how we balanced them against your rights. You can complain to the Information Commissioner's Office (ico.org.uk) in the UK, or to the data protection authority in your EEA country (list).

This section applies to residents of California and other states with consumer privacy laws (including Colorado, Connecticut, Virginia, Texas, Oregon, Delaware, New Jersey, Minnesota, Maryland and others).

• Categories collected in the last 12 months: identifiers (name, phone, email, account identifiers, IP address, device identifier); customer records (address, order and payment status); commercial information (orders, rewards); internet activity (pages viewed, if you accept analytics); approximate and precise location (your delivery pin); and inferences only for fraud checks. Sources, purposes and recipients are described above; retention periods are under "How long we keep it".
• Sensitive information: we do not use it to infer characteristics about you. An allergy note you add is used only to prepare your order.
• Do not sell or share: we do not sell personal information. If the restaurant has added advertising tools (Meta or TikTok pixels, or Google Analytics with advertising features) and you accept them, the restaurant may be treated as "sharing" information for cross-context behavioural advertising. You can opt out at any time with "Cookie choices" at the bottom of every page, which works as our "Do Not Sell or Share My Personal Information" link. Saying no, or never saying yes, means these tools never load.
• Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as an opt-out of selling and sharing for that browser.
• Your rights: to know and access, to correct, to delete, to receive a portable copy, to opt out of sale, sharing and targeted advertising, and to limit the use of sensitive information. We confirm receipt within 10 business days and answer within 45 days (extendable once by 45 days). You can use an authorised agent; we will ask for proof of their authority. If we refuse your request, you can appeal by replying to our answer, and if you are not satisfied with the appeal you can contact your state's Attorney General.
• No discrimination: you will not be charged a different price or given a worse service for using your rights. Loyalty rewards are offered on the same terms to everyone who joins.
• Texts: reply STOP to any text to stop marketing texts, and HELP for help. Message and data rates may apply.

The Personal Data Protection Law and its implementing and transfer regulations apply. You have the right to be informed, to access your data, to receive a copy, to correct it, to ask for its deletion when it is no longer needed, and to withdraw consent. We answer within 30 days. Where we rely on consent, we ask for it clearly and separately. Transfers outside the Kingdom use the safeguards set by the Saudi Data and AI Authority (SDAIA), including its standard contractual clauses, after an assessment of the risks. We report breaches to SDAIA within 72 hours where required. You can complain to SDAIA (sdaia.gov.sa). An Arabic version of this notice will be published and will prevail in Saudi Arabia.

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies (except in the DIFC and ADGM, which have their own laws). You have the right to information, access, a copy, correction, deletion, restriction and objection, including to marketing, and to withdraw consent. We use your data for your order because it is needed for the contract with you, and for marketing only with your consent. Transfers outside the UAE are made to countries with adequate protection or under contractual safeguards. You can complain to the UAE Data Office.

Pakistan does not yet have a general data protection law in force; the Personal Data Protection Bill is still before Parliament. We apply the same protections and rights described in this notice to guests in Pakistan, and we comply with the Prevention of Electronic Crimes Act 2016. If your request is not resolved, you may also contact the National Cyber Crime Investigation Agency for matters under that Act.

We will update this notice when how we use information changes, and show the date at the top. If a change matters, we will tell you on the site or by message before it takes effect.

• The restaurant: Crumb & Co, 42 MM Alam Road, Gulberg III, Lahore, 042 3578 1100.
• DelishOS (VentureChefs LLC): privacy@delishos.co.