Privacy policy

Last updated: May 26, 2026

Who we are

This site is operated by Courtyard Cafe ("Courtyard Cafe", "we", "us", "our") with its diner in Wilton Manors, Florida. Online ordering, payments, account creation, and customer support are powered by the Zayos ordering platform, operated by Zay Revenue Group LLC ("ZRG"), a Florida LLC headquartered at 555 NE 8th St Apt 107, Fort Lauderdale, FL 33304.

When you place an order with Courtyard Cafe, both Courtyard Cafe (as the merchant of record for the food and your relationship with the kitchen) and ZRG (as the platform processor handling the order, payment routing, and communications) act as joint controllers of your personal data, with each party only using your data for the purpose it's responsible for.

If you have a question about your data or this policy, you can reach us at support@zayrev.com or support@zayrev.com.

What we collect

We collect only what we need to take and fulfill your order, keep your account secure, and let you come back without re-typing everything.

• Account info: name, email address, phone number, and a hashed password if you set one. If you sign in with Google, we receive your Google profile name and email — we never see your Google password.
• Order info: items you ordered, modifiers, special instructions, location chosen for pickup, or your delivery address. We retain order history so you can reorder and so we can resolve disputes.
• Payment info: processed by Stripe, our PCI-DSS-compliant payment processor. We store only the last four digits of your card, the card brand, and Stripe's tokenized identifier. We never see, store, or have access to your full card number, CVV, or expiration date.
• Device + usage info: pages visited, screen size, browser type, and the IP address you connected from. The IP address is hashed (one-way SHA-256) when we keep it for fraud detection, so we cannot recover the original.
• Communications: SMS opt-in records, marketing email opens and clicks (only if you've opted in to marketing), and support ticket content if you write to us.
• Loyalty + favorites: the rewards balance you've earned and the menu items you've hearted. Only visible to you when signed in.

How we use it

• To fulfill your order. Send the ticket to the kitchen, dispatch a delivery courier, confirm pickup, charge your card, refund if needed.
• To message you about the order. Receipts, status updates ("your order is ready"), and one-time sign-in codes go out via SMS or email. These are transactional messages and you receive them regardless of marketing preference.
• To prevent fraud and abuse. Rate-limited sign-in attempts, hashed-IP abuse detection, and dispute investigation rely on the device + usage info above.
• To send marketing emails or SMS — only if you opt in. Opt-in is explicit (a checkbox, not a pre-checked box) and you can opt out from any marketing email's unsubscribe link or by replying STOP to a marketing SMS.
• To improve the site. Aggregated, de-identified usage data informs decisions like menu layout and which dishes to feature. Individual behavior is not used to make decisions about you.

What we do NOT do

• We do not sell, rent, or share your phone number, email address, or any personal information with third parties for their marketing purposes.
• We do not use your data to build advertising profiles or target you on other websites.
• We do not retain your full payment card details — only the last four digits and Stripe's token, which is useless outside Stripe.
• We do not access or store your Google password, Apple ID password, or any third-party credentials.

Who we share with (and why)

We share only with vendors that help us run the service, and only the minimum needed for them to do their job. Each vendor is contractually bound to use your data only for the service they provide us, and to keep it confidential.

• Stripe — payment processing, refunds, dispute handling, recurring billing on subscription plans.
• Twilio — transactional SMS delivery (order confirmations, status updates, sign-in codes).
• Resend — transactional and opted-in marketing email delivery.
• Supabase — database hosting + authentication infrastructure.
• Vercel — web hosting for the storefront and API.
• Cloudflare — DNS, DDoS protection, edge caching.
• Otter — when an order arrives via a marketplace (DoorDash, Uber Eats, Grubhub), Otter forwards order data so the kitchen sees one consolidated ticket.
• Google — only if you sign in with Google (OAuth name + email). We do not share any other data with Google.
• Delivery couriers — when you place a delivery order, we share your name, phone number, delivery address, and order contents with the courier dispatched to bring it.
• Law enforcement — only when legally required (subpoena, court order, or imminent-harm exception). We will notify you unless prohibited by law.

We may also disclose information in connection with a business reorganization (merger, acquisition, sale of assets), in which case the receiving party must honor this policy.

Your rights

California (CCPA / CPRA), EU/UK (GDPR), and Virginia (VCDPA) residents have specific rights regarding their personal data. We honor these rights for all our customers regardless of residency:

• Right to know. You can ask what data we hold on you. We respond within 30 days with a JSON export of your account, orders, communications, and any associated identifiers.
• Right to correct. Update your name, email, phone, and address directly from your account page. For fields you cannot edit yourself, email us.
• Right to delete. Submit a deletion request from your account page or by email. We anonymize your personally identifiable information immediately and finalize the deletion within 30 days. Order, payment, and tax records are retained in anonymized form for up to 7 years (Florida + IRS recordkeeping requirements) — your name, email, phone, and address are removed, but the transactional record remains.
• Right to opt out of marketing. Unsubscribe from any marketing email or reply STOP to any marketing SMS. Transactional messages (order receipts, sign-in codes) continue unless you delete your account.
• Right to data portability. The JSON export above is structured and machine-readable.
• Right to non-discrimination. Exercising any of these rights will not affect the price, quality, or availability of the service.

To exercise any of these rights, email support@zayrev.com or support@zayrev.com from the address on file, or sign in to your account and use the in-app request form.

Do Not Sell or Share My Personal Information

We do not sell your personal information for monetary or other valuable consideration. We do not share your personal information for cross-context behavioral advertising. The required "Do Not Sell or Share" link is present in our marketing email footers for California residents — clicking it confirms your opt-out preference is on file (even though there's nothing for us to opt you out of, your preference is recorded for transparency).

Cookies + similar technologies

We use a small number of cookies, all set by us (no third-party advertising cookies, no cross-site trackers):

• Session cookie — keeps you signed in. HTTP-only, signed with HMAC, expires after 30 days of inactivity.
• Cart cookie — remembers what's in your cart between visits. HTTP-only, signed with HMAC, expires after 24 hours.
• CSRF token — protects you from cross-site request forgery on form submits. Single-page lifetime.
• Marketing preference — remembers your unsubscribe choice. Expires after 1 year.

You can clear all cookies via your browser settings; the only effect on the service is that you'll need to sign in again and rebuild your cart.

Data retention

• Active accounts: kept until you delete them.
• Closed accounts: PII (name, email, phone, address) is anonymized within 30 days of deletion. Transactional records (orders, payments, refunds) are retained in anonymized form for 7 years per IRS + Florida commerce recordkeeping requirements.
• Hashed IP addresses + rate-limit records: 90 days, then automatically purged.
• Suppressed email addresses (bounces, unsubscribes): retained indefinitely so we don't accidentally re-add you to a list.
• Support tickets: retained for 3 years for dispute reference, then deleted.
• Marketing email open/click data: retained for 2 years, then aggregated and the per-customer link is severed.

Security

We use industry-standard safeguards: TLS 1.3 in transit, AES-256 at rest, scoped database access (every query runs against the customer's organization scope), and per-route rate limits. Passwords are hashed with bcrypt at cost factor 12+. We never log full payment card details. Our service-role database keys are rotated quarterly and stored only in encrypted environment variables.

If we discover a breach affecting your data, we will notify you within 72 hours of discovery (or sooner if required by your state's breach-notification law).

Children

The service is intended for adults 18 and older. We do not knowingly collect data from children under 13. If you believe we have collected data from a child under 13, email us and we will delete it.

International transfers

We are a U.S. company. If you place an order from outside the U.S., your data is transferred to and processed in the United States. We rely on Standard Contractual Clauses for EU/UK transfers as applicable.

Changes to this policy

We update this page when our practices change, and bump the "Last updated" date at the top. Material changes (anything affecting your rights or what we collect) are announced via email to opted-in customers at least 14 days before the change takes effect.

Contact

For privacy questions, data requests, or to exercise any of the rights above:

• Email: support@zayrev.com
• Mail:
  • Courtyard Cafe, 2468 Wilton Dr, Wilton Manors, FL 33305
  • or
  • Zay Revenue Group LLC, 555 NE 8th St Apt 107, Fort Lauderdale, FL 33304

We respond within 30 days. If you're not satisfied with our response, you have the right to lodge a complaint with the FTC, your state's attorney general, or (for EU/UK residents) your local data protection authority.