Privacy Policy
Last updated: October 1, 2026 | This policy may be updated from time to time. We will notify you of significant changes.
Table of Contents
1. Scope
This Privacy Policy describes how Dashi Inc. and its subsidiaries and affiliates (collectively "Dashi," "we," "us," and/or "our") collects, uses, discloses, and protects personal information in connection with our Services.
This Policy covers the following groups of individuals:
Merchants: Restaurants, cafés, bars, and other food-service establishments that use Dashi's platform to manage reservations, waitlists, orders, payments, marketing, loyalty programmes, and analytics. Merchant use of the Services is also governed by our Merchant Terms of Service.
Merchant Employees: Individuals who access the Services on behalf of a Merchant.
Guests: Individuals who interact with the Services at a Merchant's establishment, through a partner, or directly through Dashi — including individuals who create a Dashi Diner Profile.
Website visitors and prospective merchants: Individuals who browse our website, request a demo, contact Dashi, or use our Restaurant Radar, including people who do not have a Dashi account.
2. Key Definitions
"Services" means all products and services developed or administered by Dashi, including our point-of-sale system, reservation and waitlist management, digital ordering, 3D interactive menus, gamified loyalty programmes, payment processing, marketing tools, analytics, mobile applications, and web platforms.
"Guest Data" means personal information relating to a Guest that is processed through or stored in Dashi's systems in connection with a Merchant's use of the Services — including name, phone number, email address, delivery or pickup details, reservation, waitlist and order details, party size, timestamps, visit history, dietary preferences, instructions, notes, and communication preferences.
"Dashi Diner Profile" means a consumer account created by Dashi when a Guest independently opts in to Dashi's consumer services (such as the loyalty network, consumer app, or account features).
3. Our Role: When Dashi Is a Processor and When Dashi Is a Controller
Understanding who controls your personal information matters. We use the terms "controller" and "processor" here to explain our respective roles. Under Canadian privacy law, each organization remains accountable for personal information under its control, including information transferred to a service provider for processing.
When a Merchant is the controller and Dashi is the processor:
When you make a reservation, join a waitlist, place an order, or provide your information to a Merchant through the Services, the Merchant generally determines why your information is collected and how it is used for its hospitality operations. Dashi processes that information on the Merchant's behalf — for example, to manage your reservation, transmit an order, send you a confirmation, or enable the Merchant's loyalty programme. Questions about the Merchant's use of your Guest Data should be directed to the Merchant.
When Dashi is an independent controller:
When you independently create a Dashi Diner Profile — for example, by signing up on a Dashi loyalty page, downloading the Dashi app, or creating a Dashi account — you enter a direct relationship with Dashi. Dashi also determines the purposes and means of processing needed to operate, secure, troubleshoot, bill for, and comply with law in relation to the platform. For those activities, Dashi is independently accountable for its processing and this Privacy Policy governs that use directly.
Both relationships can exist at the same time. Making a reservation at a restaurant (Merchant-controlled) and signing up for a Dashi account (Dashi-controlled) are separate.
Dashi is independently accountable for information collected through its marketing website, demo requests and Restaurant Radar. A restaurant report request does not create a Dashi Diner Profile or connect the restaurant's private operational systems.
4. Personal Information We Collect
A. Merchants
When you sign up for the Services, we collect:
- Name, business name, address, email, and phone number
- Business registration and tax information
- Banking and payment information for billing and payouts
- Government identification as required for verification
- Communications through our support channels
B. Merchant Employees
When a Merchant grants you access to the Services, we may collect:
- Name, email, and phone number
- Role and permission information
- Activity logs related to your use of the Services
C. Guests — Through Merchant Services
When you interact with a Merchant through the Services (reservations, waitlists, orders, payments), the following information may be collected by the Merchant through Dashi:
- Name, phone number, and email address
- Reservation, waitlist, and order details (date, time, party size, items, prices, preferences, and special instructions)
- Delivery or pickup details, including delivery address and fulfillment status where applicable
- Transaction information, such as amount, payment status, processor and transaction reference; card details are generally collected directly by the applicable payment processor
- Dietary preferences and restrictions (voluntary)
- Visit history at that Merchant
- Communication preferences (marketing opt-in/opt-out status)
- Feedback and ratings
- Staff notes related to your visit
This information is Guest Data controlled by the Merchant. Dashi processes it on the Merchant's behalf.
D. Guests — Through Dashi Diner Profile
When you independently create a Dashi Diner Profile, Dashi collects:
- Name, email, and phone number
- Account credentials
- Your communication preferences with Dashi
- Loyalty programme participation and rewards data
- Visit history that you have opted in to share across venues (only with your explicit consent)
- App usage data and preferences
This information is controlled by Dashi directly.
E. Automatic Collection
When you use our websites or apps, we may automatically collect:
- Device information (type, operating system, browser)
- IP address and approximate location
- Usage data (pages visited, features used, timestamps)
- Cookies and similar tracking technologies (see Section 9)
F. Restaurant Radar and Website Enquiries
When you search by restaurant name, we send the text and a Toronto-area location preference to Google Places to show matching restaurants. Selecting a listing fills its website, city and address. We save the confirmed website and city as scan inputs and the selected place identifier to retrieve the correct branch. Suggestions and Google listing details are displayed temporarily. Hashed security identifiers and usage counters are retained for up to 65 days. Report-unlock contact fields are not sent to Google Places. Google’s Privacy Policy applies.
After you unlock a report, Google review and keyword checks load automatically when enabled. Our search-result service providers receive public food or service search terms and the restaurant’s city, nearby area or published coordinates to retrieve search snapshots. We do not send the contact details from your unlock form. Ranking results are displayed temporarily, separately from saved reports and downloads. Hashed request identifiers and usage counters are retained for up to 65 days.
For Google reviews, we use the selected place identifier or public business details to match the restaurant. We display its rating, total review count, a limited review sample and required attribution. Google review content is not stored in your saved report or PDF. Images and source links may connect your browser directly to Google or another image host. We do not send unlock-form contact details to Google Places. Google’s Privacy Policy applies.
Restaurant Radar inspects public restaurant and competitor pages, menus, images, metadata, page headings, image descriptions, structured business details, crawler rules and optional AI-guide files, along with web search results. Findings may include public business names, addresses, contact details, branding, source links, published coordinates and the time of the check. We do not query private restaurant accounts or send your contact details to an AI model.
We create and save a report containing the public information, automated findings, limitations and technical usage measurements before asking you to unlock it. We may reuse recently checked public restaurant information to resolve later searches and avoid duplicate work. These checks do not access private orders, reservations, guest records, sales or customer history. Illustrative guest profiles and activity are fictional.
Before asking for contact details, we show a website score, its evidence coverage and selected verified findings. The full-report form requires your email address, accepts an optional first name and phone number and carries forward the restaurant from your scan. It asks for affirmative permission to email you about the report and to call you if you provide a phone number. If you request help, we save your chosen contact method, optional note and permission with the same report and lead. You can leave the phone number blank to open the full report. A phone number is required only if you specifically request a callback. We save these details with the report, consent wording, version and time, and a record in our leads database. Completed Radar unlocks and submitted demo requests trigger an internal SMS alert to an authorised Dashi representative through our messaging provider. Alerts include the submitted contact details and restaurant, plus the report score and findings or demo interest and note. They are notifications to Dashi, not text messages to the visitor. This does not subscribe you to general marketing.
To resume an interrupted scan, your browser temporarily stores the report identifier, access token and expiry in session storage for up to 30 minutes. A session marker remembers whether its PDF was downloaded. These entries do not contain your contact fields or Google reviews. PDFs are generated on your device from the existing report without another paid analysis request; copies you download are under your control.
We also process request and security information needed to operate the tool, investigate misuse and limit excessive requests, such as request times, technical logs and network information. The hosted check uses a signed security cookie that expires after 24 hours. When you search for a restaurant or start a check, Google reCAPTCHA assesses browser, device and interaction signals to help prevent automated abuse; Google's Privacy Policy and Terms of Service apply. We do not send report-unlock contact fields to reCAPTCHA. Analytics and advertising technologies are subject to the choices described in our Cookie Policy.
5. How We Use Personal Information
For Merchants and Merchant Employees
- Provide, maintain, and improve the Services
- Process payments and manage billing
- Provide customer support and training
- Communicate about your account and service updates
- Analyse usage to improve our platform
- Detect, investigate, and prevent fraud, abuse, security incidents, and technical problems
- Comply with legal obligations
For Guests — Merchant-Directed Processing
When Dashi processes Guest Data on a Merchant's behalf, we use it to:
- Manage reservations, waitlists, and orders
- Process payments
- Send Service Communications configured by the Merchant (confirmations, reminders, waitlist updates)
- Provide the Merchant with operational reporting and guest insights
- Facilitate the Merchant's marketing and loyalty programmes (only where the Merchant has configured these features and valid consent exists)
- Maintain the Suppression List to prevent messages to opted-out Guests
For Guests — Dashi's Own Services
When Dashi acts as controller for Dashi Diner Profile data, we use it to:
- Create and maintain your Dashi account
- Provide loyalty programme features and rewards
- Enable cross-venue visit history (only with your explicit opt-in)
- Send you communications about your Dashi account and features
- Personalise your experience
- Improve and develop Dashi's products and services
- Generate aggregated, de-identified insights (see Section 7)
Aggregated and De-identified Analytics
Dashi may create and use aggregated or de-identified data to improve our products, develop industry insights and trends, and create city-level or neighbourhood-level benchmarking. This data does not identify you. Dashi will not attempt to re-identify any individual from aggregated or de-identified data and will not disclose identifiable data to other merchants.
For Website Visitors and Prospective Merchants
We use enquiry and Restaurant Radar information to prepare and provide the requested report or demonstration, explain findings, respond to questions, follow up about the report where you have agreed, maintain report and consent records, improve the tool and protect it against misuse. Automated findings are based on limited public evidence and may be incomplete or incorrect; they do not establish ownership of a restaurant or a universal search ranking. We do not use the report to infer a restaurant's private customer history or actual retention rate.
6. How We Share Personal Information
Dashi may share personal information in the following circumstances:
With Merchants: We share Guest Data with the relevant Merchant to fulfil reservations, orders, and other services you have requested. We do not share your Guest Data from one Merchant with a different Merchant without your consent.
For an order, this may include your name, contact details, ordered items, special instructions, delivery or pickup details, and transaction status. The Merchant uses this information to accept, prepare, fulfil, support, cancel, or refund the order.
With fulfillment and integration providers: When you or a Merchant requests delivery or enables a third-party integration, we may share the information reasonably needed to provide that service, such as contact details, pickup and delivery addresses, order contents, instructions, and fulfillment status. Those providers may also process information under their own privacy notices.
With service providers (Sub-processors): We use third-party providers to help deliver the Services, including cloud hosting, communications, payment processing, fraud prevention, analytics, error monitoring, and customer support. They may process personal information only to provide services to Dashi under applicable contractual and legal requirements. A current list of Sub-processors and other key platform providers is available on our Sub-processors page or upon request.
For the Restaurant Radar: Our public-site analysis and search providers receive public business search terms, website addresses and retrieved public content, which can itself include business contact details. They do not receive contact fields from the report-unlock form. Our cloud infrastructure providers store reports and submitted details; our messaging provider and telecommunications carriers process internal lead alerts. Reports and contact details are not publicly listed by Dashi or shared with competing restaurants. Provider categories, their purposes and data involved are described on our provider page; more specific information is available from privacy@dashipos.com.
Maps and restaurant images: When an embedded OpenStreetMap map or an image hosted by a restaurant or its image provider loads, your browser contacts that provider. It may receive your IP address, browser and network details, the requested resource and a referring page address according to your browser settings. The map request includes the restaurant's geographic area. These providers operate under their own privacy notices. The Restaurant Radar does not ask for your device's precise location or send your unlock-form contact details to the map provider.
For legal compliance: We may disclose information when required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of Dashi, our users, or others.
Business transfers: In connection with a merger, acquisition, reorganisation, or sale of assets, personal information may be transferred as part of the transaction. We will provide notice of any such transfer.
With your consent: We may share information for other purposes when you have given us specific consent.
We never sell personal information to third parties for marketing purposes.
7. Marketing Communications and CASL
Merchant Marketing
When a Merchant sends you Marketing Communications (promotional offers, events, loyalty promotions) through the Services or using data exported from the Services, the Merchant is responsible for ensuring it has valid consent under Canada's Anti-Spam Legislation (CASL) and for the content of those messages. Questions about a Merchant's marketing practices should be directed to the Merchant.
Your Rights Under CASL
You have the right to:
- Opt out of Marketing Communications at any time by using the unsubscribe mechanism in the message, replying "STOP" to SMS messages, or contacting the Merchant directly
- Have your opt-out honoured within 10 business days (Dashi's platform processes opt-outs immediately at the system level)
- Not receive Marketing Communications without valid consent
Dashi Communications
If you have a Dashi Diner Profile, Dashi may send you communications about your account, loyalty rewards, and Dashi features. You can manage your communication preferences in your account settings or by contacting us.
Restaurant Radar Follow-up
The full-report form asks for permission to email you about your report and findings and to call you if you provide an optional phone number. A separate help request lets you choose email or a phone call and asks for permission to follow up using that method. This permission is not a subscription to newsletters, promotional SMS campaigns or unrelated general marketing. You may withdraw permission for further report follow-up by telling the Dashi representative or emailing privacy@dashipos.com. Withdrawing permission does not automatically delete the saved report or information; you may also request deletion under Section 10. Any separate marketing communications must have an appropriate consent basis and applicable opt-out mechanisms.
8. Retention of Personal Information
We retain personal information for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, and protect our legitimate interests.
Guest Data processed for Merchants is retained for the duration of the Merchant's use of the Services and for a reasonable period after discontinuation to allow for data export (typically 30 days), after which it is deleted or anonymised from active systems within 90 days, subject to legal retention requirements.
Dashi Diner Profile data is retained for as long as you maintain your Dashi account. You may request deletion at any time (see Section 10).
Website enquiries and Restaurant Radar records: We retain reports, related contact details and enquiry history while needed to provide the requested service, handle the related conversation and meet applicable legal or security requirements. Public restaurant information may be cached and reused for later checks. Ending a browser session, an access link expiring or a cached result becoming stale does not itself delete the stored report. You may request access, correction or deletion using Section 14. We delete or de-identify information when it is no longer needed, subject to legal requirements and records reasonably needed to document consent or honour a request not to be contacted.
Hosted Radar access expires after 30 minutes. Unlocked reports, contact details, report-contact consent and the corresponding Radar lead are scheduled for deletion after 180 days. Unopened reports and saved public restaurant identities are scheduled for deletion after 30 days. Job and analysis-cache records expire within two days, and quota counters within 65 days. Daily cleanup may take until the next day to remove expired records. Separate demo enquiries, legally required records and suppression records follow the periods described above. Deletion from the report database does not automatically erase delivered SMS copies, provider message logs or device backups; access and deletion requests also cover relevant copies we control, subject to applicable legal requirements.
Consent Records (records of marketing opt-ins and opt-outs) are retained for at least 24 months after the last Marketing Communication sent, to support CASL compliance.
Breach records are retained for at least two years as required under PIPEDA.
10. Your Rights and Choices
Depending on applicable law, you may have the right to:
- Access your personal information held by Dashi
- Correct inaccurate or incomplete information
- Delete your personal information or Dashi Diner Profile
- Withdraw consent for marketing or other optional processing at any time
- Export your data in a portable format
- Object to certain processing activities
For Guest Data controlled by a Merchant: Direct your request to the Merchant. Dashi will provide reasonable assistance to the Merchant in responding.
For Dashi Diner Profile data or information Dashi controls, including Restaurant Radar reports and enquiries: Contact us using the information in Section 14. Include enough information to locate the relevant report or enquiry. We may reasonably verify your identity before disclosing or changing personal information. We will respond to your request within the time required by applicable law.
11. Security
We maintain administrative, technical, and organisational safeguards designed to protect personal information, which may include:
- Encryption of data in transit and at rest
- Access controls and authentication requirements
- Regular security assessments and monitoring
- Employee training on data protection
- Incident response procedures
No system is completely secure, and we encourage you to take steps to protect your own information, including keeping your login credentials confidential.
Breach Notification
If we become aware of a security incident that creates a real risk of significant harm, we will comply with PIPEDA's mandatory breach reporting and notification requirements. Where Dashi is processing Guest Data on a Merchant's behalf, we will notify the Merchant without undue delay so that the Merchant can fulfil its own legal obligations. We maintain breach records as required by law.
12. Cross-Border Processing
Personal information may be processed and stored in Canada and in other jurisdictions depending on our hosting infrastructure and Sub-processors. Where personal information is transferred outside Canada, we use contractual and organisational measures to provide a comparable level of protection. Foreign authorities may have lawful access to personal information under the laws of those jurisdictions.
13. Children's Privacy
Our Services are not directed at individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us so we can delete it.
14. How to Contact Us
If you have questions about this Privacy Policy, our privacy practices, or wish to exercise your rights, contact us:
Email: privacy@dashipos.com
Mail:
Dashi Inc.
Attn: Privacy Office
8171 Yonge St
Toronto, ON L3T 2C6
Last updated: September 30, 2026 | This policy may be updated from time to time. We will notify you of significant changes.