Privacy Policy

Last updated: 16 September 2026

1. Who processes your data

The data controller is Earthprem, LLC, a limited liability company under the law of the State of Delaware (United States), incorporated on 12 November 2023, with its registered office at 651 N Broad St, Suite 201, Middletown, DE 19709, United States, operating the service under the Dineora brand. For any question about your data: info@dineora.io.

2. Two roles not to be confused

Our position changes depending on whose data is at stake, and that changes your rights as much as our obligations.

In other words: a restaurant's customer base belongs to the restaurant. We do not exploit it for ourselves, we do not sell it, and we do not use it to solicit one establishment's customers for the benefit of another.

3. Data we process

3.1 Restaurateurs

• identity and contact details: first name, last name, email address, phone number;
• information about the establishment: name, city, country, address, opening hours, menu, photographs, and the legal information required to take payment (legal name, registration number, VAT, address);
• banking details required for payouts, collected and held by our payment provider — we never have access to a full card number or to your banking credentials;
• technical logs: IP address, browser, operating system, pages viewed, sign-in timestamps;
• abuse prevention signals described in section 5.

3.2 Signing in with Google or Microsoft

If you choose "Sign up with Google" or "with Microsoft", the provider passes on to us, with your consent and at that moment only:

• your name (first and last name as they appear on your profile);
• your email address;
• your profile picture, if you have one;
• a technical identifier specific to the provider, which lets us recognise your account on your next sign-in.

We use this information solely to create your Dineora account or link it to your existing account, and to display your name and your picture in your workspace. We do not read your emails, your contacts, your files or your calendar: we request no other access. You may withdraw that access at any time from the security settings of your Google or Microsoft account; your Dineora account then remains reachable by password.

Dineora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

3.3 Facebook and Instagram lead forms

Our ads sometimes offer a form that opens inside Facebook or Instagram, without leaving the app. If you submit it, Meta passes on to us what you confirmed there: your name, your email address, your phone number, your business name and your city — along with the ad you came from, so that we know what works.

We receive nothing else from your profile: not your posts, not your contacts, not your interests. This information is used to create your Dineora account and to send you, within the minute, a sign-in link to the address you gave. No password is ever asked of you; you may choose one later if you wish. If you never click that link, the account stays empty and is deleted like any other (section 8).

3.4 End customers

• identity and contact details required for the order: name, phone, email address, delivery address;
• contents of the order, amount, pickup or delivery method;
• history of orders placed with that restaurant;
• communication preferences, where consent has been obtained.

4. Why, on what basis, and for how long

5. Abuse prevention

The free offer includes the generation of a website. To prevent it from being misused by bots or by multiple accounts, we process, at sign-up and when a generation is started:

• an anti-bot check (Cloudflare Turnstile), which only shows a challenge when necessary;
• the reputation of your IP address (network, country, use of a VPN, a proxy or a hosting provider), obtained from a specialised service;
• a technical fingerprint of your browser — an irreversible digest of characteristics such as screen size, time zone or installed fonts — which contains no personal data and serves only to recognise that the same device is opening several accounts;

These signals produce a score. No single signal is enough on its own to refuse an account: a VPN or a shared address is never a ground for refusal. A high score leads to an additional check or a review by a person, and you can always write to us to contest a decision. We do not use this data for advertising or cross-site tracking purposes.

6. Who the data is passed to

We use providers who act only on our instructions and have no right to exploit the data for themselves:

Some of these providers operate outside the European Union. Those transfers are governed by the European Commission's standard contractual clauses or by an adequacy decision.

We sell no personal data.

Your mobile number and your SMS consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Your number is used only to send you the messages you agreed to, and is passed only to the providers that deliver them, for that delivery alone.

What we send, how often, what it costs and how to stop it (reply STOP) are set out on our SMS Terms page. For each consent we keep the exact wording that was displayed, the page it was displayed on, the date, the time and the network address: that is what lets us show, months later, what you agreed to — and correct ourselves if you dispute it.

7. Security

• All exchanges are encrypted in transit (TLS).
• Passwords are never stored in clear text: they are derived by a memory-hard algorithm (scrypt) that makes reconstructing them impractical.
• Sessions rely on random tokens stored hashed, carried by a cookie inaccessible to the page's JavaScript and invalidated on sign-out or on a password change.
• Banking data never passes through our servers: it is entered and held by our payment provider, licensed for that purpose.
• Access to production data is limited to what is strictly necessary and is logged.

In the event of a data breach likely to result in a high risk to your rights, we inform you without undue delay.

8. Deleting your data

From your workspace, "My account" → "Delete my account" immediately erases your account, your establishments and the configuration of your websites. The technical log is anonymised. What remains are only the records the law requires us to keep (section 4) and, at the payment provider, what financial regulation imposes on it.

You can also write to us at info@dineora.io from your account's address: deletion is carried out within 30 days, and confirmed by email.

9. Your rights

You have a right of access, rectification, erasure, restriction, objection and portability, as well as the right to set directions on the fate of your data after your death. Write to info@dineora.io: we reply within one month.

If you ordered on a restaurant's website, contact that restaurant first: it is the one that decides on your data. We pass on your request if you write to us directly.

You may also lodge a complaint with the competent data protection authority in your country (in France, the CNIL; in Morocco, the CNDP).

10. Trackers

The dineora.io showcase site sets no advertising tracker. The application uses a single, strictly necessary cookie: that of your session. The restaurant websites we produce set the trackers strictly necessary for the basket and the order, as well as audience measurement ones if the restaurant enables them — in which case a consent banner appears.

11. Changes

Any substantial change is announced on this page and, if it concerns you directly, by message. The date at the top of the page prevails.