What we collect
When you order, we store your name, phone number, optional email, delivery addresses you enter, your order history and your marketing consent. If you tell us your birthday for the birthday reward, we store that too.
Your phone number is your account. We use it to send order updates, look up your past orders for one-tap reorders and credit your points.
Payments
Card payments are processed by Clover. Your card number is entered in a Clover-hosted form (or through Apple Pay / Google Pay when we offer them) and never touches our servers. We keep only the last four digits and the payment reference needed for refunds.
SMS messages
Placing an order means we send transactional texts about that order: confirmation, ready for pickup, courier on the way, and one-time login codes. These do not require marketing consent.
Marketing texts (offers, points reminders) are sent only if you tick the consent box in checkout. We send at most four per month, between 11 AM and 8 PM Miami time. Reply STOP at any time to opt out and HELP for help. Message and data rates may apply.
We keep a record of each consent and opt-out (phone number, time, the wording you agreed to) for 4 years, as carrier rules require.
If you give an email, we send your receipt there and, with your consent, a monthly points summary. Every marketing email has an unsubscribe link.
Who else sees your data
Only the services that make your order happen: Clover (payments and kitchen orders), our delivery partners (DoorDash Drive, Uber Direct) who receive your name, address and phone for delivery orders, Twilio (SMS), Resend (email), Cloudflare (hosting; request logs are kept up to 30 days) and ClickUp (catering requests only).
We use Google Analytics, Google Ads, Meta and PostHog to understand how the site is used and to measure ads. These tools receive usage events and, for ad measurement, hashed identifiers (a one-way hash of your phone or email), never your card details.
How long we keep it
Order records are kept for as long as accounting rules require. SMS consent records are kept 4 years. Points expire after 12 months without an order. To delete your account and data, email us and we remove everything except records we are legally required to keep.
Contact
Questions about privacy: email info@mangalcorporate.com.