Privacy Policy
Effective TBD
This policy explains how Trotly ("Trotly", "we") handles personal information, following Canada's PIPEDA and British Columbia's Personal Information Protection Act.
Who this covers
- Restaurants that use Trotly and their staff.
- Diners who place orders on a restaurant's ordering site. For diner orders, the restaurant decides how order information is used; we handle it on the restaurant's behalf to run the site.
- Visitors to trotly.ca.
What we collect
- Diners: name, email, phone number, delivery address (for delivery orders), order contents and order notes. Card details go directly to Stripe; we never see or store full card numbers.
- Restaurants: business and contact details, login email, menu and site content. Stripe collects identity and bank details directly for payouts.
- Everyone: basic technical data (IP address, browser type, pages visited) for security and to keep the service working.
Why we use it
To take and deliver orders, process payments, send order confirmations and alerts, provide support, prevent fraud and abuse, and meet legal and tax obligations. We do not sell personal information, and we do not use diners' information for our own marketing.
Who we share it with
Only service providers that help run Trotly, under contract and only for that purpose:
- Stripe (payments), Supabase (database), Cloudflare (hosting and security), Resend (order emails).
- The restaurant you ordered from receives your order details. Some providers store data outside Canada (for example in the United States), where it may be accessible to authorities under local law.
How long we keep it
Order records are kept as long as needed for the restaurant's accounting and tax records (generally up to 7 years under Canadian tax rules), then deleted or anonymised. Account data is deleted within 90 days after a restaurant leaves, except where the law requires us to keep it.
Cookies
We use only the cookies needed to run the site (for example, keeping your cart and logging restaurant staff in). We don't use advertising cookies.
Your rights
You can ask to see, correct or delete your personal information, or withdraw consent, by emailing hello@trotly.ca. We reply within 30 days. If you're not satisfied, you can contact the Office of the Information and Privacy Commissioner for British Columbia.
Security
Data is encrypted in transit, access is limited to people who need it, and card data is handled only by Stripe (PCI DSS Level 1).
Contact
Privacy questions: hello@trotly.ca, Trotly, Vancouver, British Columbia, Canada.