PrepOrderBack to PrepOrder

Privacy Policy

Version 6 · Effective 2026-10-12

PrepOrder Privacy Policy

Effective date: 12 October 2026

1. Who we are

PrepOrder is a food discovery and ordering service operated by PrepStak Technologies Limited, a company incorporated in Uganda under registration number 80042719963846. PrepStak's registered office and address for service are:

Dubai, Makindye II, Makindye Division, Kampala, Uganda

You can contact us about this Policy, your personal information or a privacy request by telephone on +256 709 802 259 or by email at customer@prepiq.net.

In this Policy, “PrepOrder”, “we”, “us” and “our” mean PrepStak Technologies Limited when it operates the PrepOrder app, website and related platform services. This Policy applies to customers, restaurant owners and staff who use PrepOrder, and people who browse or contact us through the service. PrepOrder currently operates in Uganda. If we expand into another country, we may provide additional information or market-specific terms.

PrepStak provides the digital platform. The restaurant you select sells the food directly to you and is responsible for preparing and fulfilling that food order. PrepOrder sends the restaurant the information needed to handle an order. A restaurant may also handle information it receives under its own privacy obligations. PrepIQ is another product in the PrepStak product family. This Policy explains the information PrepOrder sends to PrepIQ for the connected functions described below; a separate PrepIQ service may have its own privacy notice.

2. Information we collect and create

The information we handle depends on whether you browse, create an account, order food, manage a restaurant or use a particular feature. It may include:

Account, sign-in and contact information

We may collect your email address, name, telephone number, password or password-verification information, email verification status, preferred language and time zone, account status, and information needed to confirm your identity or protect your account. If you sign in through a supported identity service, we may receive an account identifier and the information needed to link that sign-in to your PrepOrder account. We do not ask you to share your sign-in password for another product.

We also create or receive session, device and security information, such as an internal account identifier, an app or browser identifier, platform type, sign-in and verification events, and information about suspected misuse or account-protection events. Depending on the feature and request, operational systems may process an IP address, browser or device information, and the date and time of an event.

You may browse some parts of PrepOrder before signing in. In that case, the app or website may use an anonymous device or session identifier to remember a cart, location or activity. If you later sign in, selected activity associated with that device may be joined to your account so the service can continue where you left off.

Customer profile, preferences and location

If you choose to provide them, we may handle your display name, phone number, food and cuisine preferences, favourite categories, saved restaurants and dishes, followed restaurants, usual budget, preferred fulfilment method, notification choices and food alerts.

Dietary requirements, allergies and other food-related notes can reveal sensitive information about you. We use information you choose to provide for the feature you requested, such as filtering or personalising food discovery, helping an AI feature understand your request, or telling a restaurant what it needs to consider when preparing your order. Please share only information you want used for those purposes. You can review or change saved preferences in the product where that option is available.

When you use location features, we may handle your current or selected location, a saved place such as Home or Work, its label or address, and a location point. Location may come from a device location permission, a place you select or enter, or an area resolved by the service. PrepOrder generally keeps one latest current location rather than a history of every location fix. A delivery order can separately preserve the delivery address and destination details that applied when you submitted it.

Orders, delivery and payment records

For an order, we may handle the restaurant and branch selected, items and quantities, prices, discounts, delivery fee, currency, order and fulfilment status, scheduled time, and related messages or support requests. For delivery, the order may include the delivery address or map point, contact name and phone number, area label and delivery instructions. For pickup, the restaurant receives the information it needs to identify and prepare the order.

We record information needed to process and reconcile payment, such as the payment method, amount, currency, status, payment-provider name and reference, refund details, and relevant responses or events from the payment provider. A payment provider may receive contact or transaction details needed to process a payment. The payment methods and providers available to you can vary. Any payment information you enter into a provider's own page or interface is also subject to that provider's privacy terms.

Restaurant and staff information

For a restaurant account, we may handle the business or organisation name and identifiers, restaurant and branch details, locations and opening hours, menus, prices, availability, offers, photos and other materials the restaurant submits. We may also process the names, email addresses, phone numbers, account identifiers, roles, permissions, invitations and security events of restaurant owners, managers and staff who are authorised to use PrepOrder's restaurant tools.

Restaurants may provide information about their food, services and business so it can appear to customers. Information that a restaurant chooses to publish in a menu or listing may be visible to people using PrepOrder.

Search, communications and AI features

We may process search terms, viewed restaurants and menu items, cart activity, favourites, follows, ratings or food feedback, offer and campaign interactions, and other information about how you use discovery features. We also handle service communications, support enquiries, notification settings, device tokens used for notifications, and the content you provide when contacting us.

If you use Food Copilot or Restaurant Concierge, PrepOrder stores the messages in the conversation, the AI's replies and relevant conversation context so the feature can respond and show your chat history. Do not include information in a chat that you do not want processed by PrepOrder or the AI provider. If you use Restaurant Concierge for a particular restaurant, authorised staff for that restaurant may be able to review the full conversation in the restaurant's Concierge tools. The dashboard may mask your account identity, but anything you include in a message can identify you.

If you ask PrepOrder to analyse a food or menu image, the image is sent to the configured image-analysis provider. PrepOrder processes the image for that request and does not keep the original image as a saved profile or order attachment. The structured result, such as recognised dishes, menu text or prices, may be kept temporarily to support the feature; the current default expiry for such a result is 48 hours.

If you use voice transcription, the audio is sent to the configured speech-to-text provider to produce a transcript. PrepOrder does not store the audio recording or transcript as part of the transcription request. The transcript is returned to you to review; if you choose to send it as a Food Copilot message, it is then handled and stored like other chat messages.

Usage analytics and technical records

Optional client usage analytics are turned off by default in the web and mobile apps. If you turn them on, the app may send events such as searches, views, taps, and feature use, along with a device or session identifier, platform, time, and relevant restaurant, menu item or order reference. These events can be associated with your account or device; we do not describe them as anonymous.

Turning optional analytics off stops the app's optional client telemetry and clears client events still waiting to be sent from that device. It does not stop the processing needed to complete orders, protect accounts, investigate payment or security issues, operate requested AI features, or keep required operational records. Some service and business events are recorded by the server independently of the optional client analytics setting.

3. How we use information

We use information for the purposes below, and for other compatible purposes that we explain when we collect it:

  • to create and manage accounts, verify contact details, sign you in and protect accounts;
  • to show restaurants, menus, offers and food that are relevant to your selected area, searches or preferences;
  • to remember carts, saved places, favourites, dietary preferences and notification choices;
  • to transmit and manage orders, communicate order status, help restaurants prepare and fulfil orders, reconcile payments and handle refunds or payment questions;
  • to operate customer support, answer enquiries, investigate complaints and keep an appropriate record of our response;
  • to provide Food Copilot, Restaurant Concierge, image analysis, voice transcription, recommendations and other features you choose to use;
  • to understand demand, restaurant and marketplace performance, product usage and service reliability, including through selected PrepIQ signals;
  • to send service, security and order messages, and to send optional offers or marketing only as permitted by your notification choices and applicable law;
  • to detect, prevent and investigate fraud, abuse, security incidents, errors and violations of our terms;
  • to maintain, troubleshoot, secure and improve the PrepOrder platform and its features; and
  • to meet legal, accounting, regulatory, dispute-resolution and other obligations that apply to PrepStak.

We process personal information for specified and lawful purposes under Uganda's Data Protection and Privacy Act, 2019 and other applicable law. Depending on the feature, we may rely on your request to provide a service, your consent where it is required, a legal obligation, or another purpose permitted by law. Where we ask for consent, you can withdraw it using the relevant product setting or by contacting us. Withdrawal does not undo processing already carried out lawfully before withdrawal.

4. How PrepOrder shares information

With the restaurant handling your order

When you submit an order, we share the order and fulfilment details with the restaurant selected for that order. This can include your name or account display name, contact details needed for the order, the items and quantities, relevant dietary or preparation notes, the fulfilment method, and, for delivery, the delivery address, destination point, contact phone number and instructions. The restaurant needs this information to accept, prepare, hand over or deliver the food and to resolve an order issue.

Restaurant owners and staff may also see information that customers provide through Restaurant Concierge for their restaurant. Access is limited to authorised restaurant users and may depend on their role and branch permissions. Do not include sensitive personal details in a Concierge conversation unless they are genuinely needed to ask your question.

With PrepIQ

PrepOrder sends selected operational and marketplace signals to PrepIQ, a separate PrepStak product, to support connected business tools and marketplace intelligence. Depending on the event, a signal may include restaurant, branch or menu-item identifiers; counts and time periods for views, carts, availability, offers or campaigns; order and order-line identifiers; item quantities, revenue, currency, completion time or refund adjustments; and structured food demand such as a query, category, dietary request, price range, party size or approximate geographic area.

The sales and refund signals are designed to omit a customer's name, email address, phone number and delivery address. They can still contain order, item, restaurant or branch identifiers and may be linkable to other business records. AI-derived demand signals can include the query text you entered, dietary or price information, a coarse location and a conversation correlation identifier. A query may reveal personal or sensitive information if you choose to type it. These signals are selected and structured; they are not necessarily anonymous.

If you choose to link or sign in across PrepOrder and PrepIQ, the products exchange the identity information needed to verify the sign-in and associate the linked accounts. The integration uses account identifiers and sign-in assertions; it does not require you to give PrepOrder your PrepIQ password.

With service providers and others

We may make information available to service providers that support PrepOrder, such as payment processors, hosting and database providers, email and notification services, mapping or location-resolution services, AI and image-analysis providers, speech-to-text providers, and security, error-monitoring or technical support services. They may process information only as needed to provide or protect their service to us, subject to applicable terms and safeguards.

We may also disclose information to a regulator, law-enforcement authority, court, payment provider, professional adviser or other person where required or permitted by law, to protect a person or the platform, to investigate suspected fraud or security incidents, or to establish, exercise or defend legal claims. If PrepStak reorganises or transfers part of its business, information may be transferred as part of that transaction subject to appropriate protections and this Policy.

We do not sell personal information as a standalone product. A restaurant, payment provider or other service that receives information may process it under its own responsibilities and terms.

5. AI providers and international processing

AI, payment, hosting, messaging, map and other providers may process information in Uganda or in another country where they or their infrastructure operate. The provider and model used for an AI feature can depend on PrepOrder's service configuration and may change. An AI request may include the message you send and relevant conversation, restaurant, menu or preference context required to generate a response. The provider's handling of that request is also governed by the applicable provider arrangements.

Where personal information is transferred or accessed outside Uganda, PrepStak will apply the transfer conditions and safeguards required by Uganda's Data Protection and Privacy Act and other applicable law. You can contact us for information about the providers or transfer arrangements relevant to a particular feature.

6. How long we keep information

We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, for the service you requested, for legal or accounting requirements, to resolve disputes, to enforce agreements, or to protect users and the platform. Different records have different needs, and there is no single expiry date for every type of information.

Order, payment, refund, rating, security and audit records may be retained after an account is closed so that the parties can verify what happened, resolve complaints or disputes, meet financial or legal obligations, and investigate fraud or security issues. These records may continue to refer to an internal account identifier even after the account's login details have been anonymised.

AI conversations remain available in your chat history until you delete the individual conversation or it is otherwise removed under our retention practices. Closing your account does not currently cause every stored AI conversation or analytics event to be automatically erased. Optional client analytics that have not yet been sent are cleared from the device when you switch the setting off; that does not remove server records already received.

Information needed only for a temporary feature may have a shorter life. For example, image-analysis results currently have a default expiry of 48 hours. Backups and service-provider records may remain for a limited period under their respective retention processes, even after information is removed from an active account or service.

7. Account closure and deletion requests

You can request account deletion through the account controls available in PrepOrder. For security, we may ask you to sign in again or verify your identity. A deletion request blocks account access and revokes active sessions while it is pending. The account-deletion system has a default 14-day grace period before its deletion task runs; PrepStak may change that configuration over time. The account cannot be used while the request is pending.

When the deletion task runs, PrepOrder removes or anonymises selected profile information, saved places and preferences, device registrations, identity-provider links, carts and other non-transactional account data. It replaces the account email with a non-contact value and removes personal name and phone fields from retained staff-profile records where applicable.

Deletion does not mean that every historical record is immediately erased. Orders and their fulfilment snapshots, payment and refund records, ratings, security and audit events, analytics records and some AI conversation records may remain, linked to an internal account identifier, for the purposes described in this Policy. If you want an individual AI conversation removed, use the conversation's delete control where available before requesting account deletion, or contact us. We will consider a request to remove other information, subject to records that we are permitted or required to keep.

8. Your choices and rights

You can review or update profile details, saved places, food preferences, follows, favourites and notification choices in the app or website where those controls are available. You can turn optional client analytics on or off in the product's Privacy settings, delete individual AI conversations where that feature is available, and opt out of optional marketing using the notification settings or the instructions in the message.

Subject to the conditions and exceptions in applicable law, you may ask us to:

  • confirm whether we hold or process personal information about you and provide access to it;
  • correct information that is inaccurate, incomplete or out of date;
  • delete, destroy, block or stop using information where the law gives you that right;
  • explain how particular information is used or shared;
  • withdraw consent for processing that relies on your consent;
  • stop sending direct marketing or stop a use that the law permits you to object to; or
  • review a decision if a decision with a significant effect on you is made solely through automated processing, where that right applies.

Some information cannot be removed immediately where it is part of an order, payment, security, audit, dispute or legal record that PrepStak or a restaurant must or may retain. We will explain the reason if an applicable exception prevents us from fulfilling a request in full. You may also complain to Uganda's Personal Data Protection Office if you believe your information has been handled contrary to applicable law.

To make a request, contact customer@prepiq.net or call +256 709 802 259. Tell us that your request concerns privacy, describe what you want us to do and provide enough information for us to verify and locate the relevant account. Please do not send passwords, payment PINs or full card security details.

9. Cookies, local storage and similar technologies

The website and apps may use essential cookies, local storage or similar technologies to keep you signed in, remember your settings, maintain security, preserve a cart or location, and remember your analytics choice. The optional analytics setting controls client usage telemetry as described above. Blocking essential storage may prevent sign-in, checkout or other requested features from working properly.

10. Protecting information

PrepStak uses technical and organisational measures intended to protect personal information from unauthorised access, loss, alteration or disclosure. Access to customer, order, restaurant and staff information is restricted according to service roles and business need. We also use safeguards with service providers where appropriate. No online service or method of storing information can be guaranteed completely secure, so please protect your sign-in details and contact us promptly if you suspect unauthorised access to your account.

11. Information about children

PrepOrder is designed for food customers and authorised restaurant users and is not intended to encourage children to create accounts or provide personal information without appropriate adult involvement. If you believe a child has provided personal information without the permission required by law, contact us. We will review the circumstances and take the steps required by applicable law.

12. Changes to this Policy

We may update this Policy when PrepOrder's features, operations, providers or legal obligations change. The effective date at the top identifies the version currently in force. If a change materially affects how we handle personal information, we will provide notice through the app, website or another appropriate channel when required by law.

13. Contact

For privacy questions, requests or complaints, contact:

PrepStak Technologies Limited

Email: customer@prepiq.net

Telephone: +256 709 802 259

Address: Dubai, Makindye II, Makindye Division, Kampala, Uganda