Privacy Policy

1. Who we are

ZOMI Technology Ltd. (“ZOMI”, “we”, “us”) operates the ZOMI website at www.zomi.menu and the ZOMI mobile apps. For any privacy question, or to exercise any of the rights described below, write to hello@zomi.menu or reach us at:

Restaurants listed on ZOMI are independent businesses. When you place an order, the restaurant also receives the information it needs to prepare and hand over that order, and it handles that information under its own practices.

2. Information we collect

Account information

Your phone number and the name you give us. We sign you in with a one-time code sent by SMS — ZOMI does not use or store passwords.

Order information

What you ordered, from which restaurant, any notes you add, the pickup or delivery time, order status, amounts, and your order history.

Payment information

Card payments are processed by Stripe. ZOMI never receives or stores your full card number. We keep a payment reference returned by Stripe (so a saved method can be reused), plus the amount, currency, and result of the transaction.

Delivery address

Collected only when you place a delivery order.

Location

Only if you choose “Use current location” and grant permission, or if you type an address. ZOMI itself never receives your position: distances and re-ordering are calculated in your browser, the coordinates are saved only in your browser’s local storage, and they are never sent to ZOMI’s servers and never placed in a cookie. The one thing we do derive from it is the coarse city we serve you in — for example “Vancouver” — which is stored in the city cookie described in section 5 and is visible to our servers. If you use current location, your coordinates are sent to Google so that it can name the place we show you — a street address such as “8211 Cook Rd” when the position is precise enough, otherwise a broader area such as “Yaletown”. If you type an address instead, the text you type is sent to Google to return suggestions and the coordinates come back from Google — they never leave your browser. Both are handled under Google’s own privacy policy.

Device and usage information

A randomly generated client identifier and session identifier, which pages and restaurants you view, your language preference, and standard server log data such as IP address, browser type, and timestamps.

Messages you send us

The content of emails you send to hello@zomi.menu, so we can answer them.

3. Why we use it

We use the information above to:

• create and secure your account, and confirm it is you signing in;
• send your order to the restaurant and get it prepared, picked up, or delivered;
• take payment, issue refunds where due, and keep financial records;
• answer your questions and provide support;
• detect, prevent, and investigate fraud, abuse, and technical problems;
• understand which parts of the service people use, so we can improve them;
• meet our legal, tax, and accounting obligations.

We rely on your consent, which you can withdraw at any time. Some of these uses are necessary to provide the service you asked for — if you withdraw consent for those, we may no longer be able to process your orders.

4. Who we share it with

The restaurant you order from

Your name, phone number, and order details, so it can prepare your order and reach you about it.

Stripe

To process card, Apple Pay, and Google Pay payments and to handle refunds.

DoorDash

For delivery orders only: your name, phone number, delivery address, and order details, so a courier can complete the delivery.

Google

Google Maps powers the map view, Google Places powers address autocomplete, and Google Geocoding turns the coordinates you share into a place name — a street address, or a broader area when the position is less precise. Those requests are handled under Google’s own privacy policy.

Our SMS provider

To deliver sign-in verification codes to your phone.

Service providers

Hosting, storage, error monitoring, and analytics providers that act on our instructions and may not use your information for their own purposes.

Legal and safety

Where required by law or legal process, or where necessary to protect the rights, safety, or property of ZOMI, our users, or the public.

Business transfers

If ZOMI is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction.

We do not sell your personal information, and we do not give it to advertisers for their own marketing.

5. Cookies and local storage

ZOMI uses a small number of cookies, all of them needed to run the service:

zomi-biz-token

Keeps you signed in.

zomi-hub-city

Remembers which city’s restaurant list to show you.

zomi-biz-subdomain

Remembers which restaurant you are currently browsing.

zomi-biz-lang

Remembers your language preference.

zomi-biz-client-id, zomi-biz-session-id

Random identifiers used to measure how the service is used. They are not linked to your name or phone number unless you are signed in.

Your browser’s local storage — which stays on your device and is never sent to us — holds your saved location coordinates, recently viewed restaurants, and interface preferences. You can clear cookies and local storage in your browser at any time; signing in again recreates the ones needed to use the service.

6. How long we keep it

We keep account and order records for as long as your account is active, and afterwards for as long as we are required to for tax, accounting, and legal purposes — for order and payment records this is at least six years. Device and usage records are kept for a shorter period. When information is no longer needed, we delete it or render it anonymous.

7. Your rights and choices

You can ask us for a copy of the personal information we hold about you, ask us to correct it, withdraw your consent, or ask us to close your account and delete your information. Write to hello@zomi.menu — we will respond within 30 days, as Canadian privacy law requires. We may need to verify your identity before acting on a request.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner for British Columbia or for Alberta, depending on where you live.

8. How we protect it

Traffic between your device and ZOMI is encrypted in transit. Access to personal information inside ZOMI is limited to people who need it to do their jobs. Card data is handled by Stripe, a PCI-DSS certified payment provider, and does not pass through our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Where your information is processed

ZOMI operates in Canada. Some of our service providers — including Stripe and Google — process information in the United States. While information is in another country, it may be accessible to the courts, law enforcement, and national security authorities of that country under its laws.

10. Children

ZOMI is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The date at the top always reflects the current version, and if a change materially affects how we handle your information we will give you more prominent notice.

12. Contact us

Questions, requests, or complaints about privacy: hello@zomi.menu, or by mail: