1. WHO WE ARE AND WHAT THIS POLICY COVERS
Waffle Up Inc., operating as One Stop Waffle Shop ("we", "us", or "our"), operates the One Stop Waffle Shop mobile app. This policy explains how information is handled when you use the app, access our Square-powered online shop through it, or contact us about these services.
Privacy contact: Privacy Officer, Waffle Up Inc.
Email: info@waffleup.ca
Telephone: +1 647 272 1324
Address: 3140 Dundas St W, Toronto, ON M6P 2A1, Canada
2. FAVOURITES SAVED ON YOUR DEVICE
The app saves your selected favourites in local storage on your device so you can access them when you reopen the app. The app does not send this favourites list to us or store it in a separate customer database. You can remove items from your favourites in the app. Device backup and restore settings may affect whether locally stored information is backed up or restored by your device provider.
3.SQUARE SIGN-IN, ORDERS AND PAYMENTS
Our app provides access to our Square-powered online shop. Depending on the features you use, Square processes information such as your name, email address, phone number, sign-in verification information, delivery or billing address, order details and payment information.
We receive the customer and transaction information made available to us through Square to prepare and fulfil orders, arrange delivery when requested, provide receipts and customer support, handle refunds, and maintain business records. Payment details are handled through Square and its payment partners; the app's favourites feature does not store payment card details.
Square's web features may use cookies, local storage and device or network information to maintain sessions and carts, operate checkout, protect transactions, and support its services. These web features have data practices separate from the app's locally saved favourites.
Read Square's privacy notices for details about the features you use:
Square privacy policy: https://squareup.com/ca/en/legal/general/privacy
Square customer accounts, buyer features and Square Pay: https://squareup.com/ca/en/legal/general/buyer-features
4. PUSH NOTIFICATIONS AND TECHNICAL INFORMATION
Our app uses Expo’s push notification service, together with Apple Push Notification service on iOS and Firebase Cloud Messaging on Android. These services process push tokens and related technical identifiers to route notifications to the appropriate app installation. A push token identifies an app installation; it is not your name or phone number.
Notification permission and shop announcements
You can decline notification permission or disable notifications in your device settings. Permission to display notifications is separate from choosing to subscribe to our shop announcements.
In app versions that include “Offers & menu news”, you can choose to receive promotional announcements, special offers and menu updates. If you subscribe, the app sends your Expo push token, device platform and subscription preference to our announcement service. We store these details together with the consent wording version and registration and update timestamps.
The app also stores notification preferences and token information locally to maintain your subscription and synchronize changes. Earlier app versions may offer notification registration or testing without this announcement subscription feature.
How we use announcement information
We use subscription records to send announcements to opted-in installations, manage subscription changes and troubleshoot delivery. Our announcement service does not receive your Square sign-in details, payment information or order history, and we do not link its subscription records to your Square customer account.
We keep announcement content and sending records, including recipient tokens, timestamps, delivery service responses and errors. These records help us identify failed deliveries and stop using invalid tokens. Our announcement service does not record whether you open or read an announcement.
Our announcement service is hosted on Cloudflare Workers and Cloudflare D1. Expo, Apple Push Notification service (APNs), and Firebase Cloud Messaging (FCM) process notification delivery information on our behalf. Hosting and notification providers may process IP addresses, device and network information, and service logs to operate and secure their services. Our registration service also uses short-lived hashed network identifiers and request counts to help prevent abuse.
Your choices
Where available, use “Turn off shop announcements” in the app to unsubscribe. The change needs an internet connection to reach our service. Once processed, the installation is excluded from future announcement sends. Messages already submitted for delivery may still arrive.
You can also block notification display through your device settings. Turning off permission or uninstalling the app does not itself erase subscription records or information held by notification providers. See sections 6 and 7 for retention and deletion information.
The app may display its push token in notification diagnostics and allow you to share it for testing or support.
Our current app setup does not enable Firebase Analytics. This does not mean that Square, notification providers or hosting providers process no technical or usage information.
Provider information:
- Expo privacy policy
- Apple privacy policy
- Firebase privacy and security information
- Google privacy policy
- Cloudflare privacy policy
5. SUPPORT AND SHARING
If you contact us, we receive the contact details, messages and other information you choose to provide. We use this information to respond, investigate problems and resolve your request.
Information is handled by the providers described above as needed to deliver the features you use. If you request delivery, relevant order, contact and delivery details are also shared with the delivery provider fulfilling your order. We may disclose information where legally required or necessary to address fraud, security incidents or legal claims. We do not use the locally saved favourites list for advertising profiles.
Providers may process information outside Canada, including in the United States and other countries where they operate. Information processed abroad may be subject to the laws and lawful access requirements of those countries.
6. SECURITY AND RETENTION
We use account access controls and limit access to customer information to people who need it to fulfil orders, provide support or administer our services. Online ordering and notification services use encrypted network connections. No electronic storage or transmission method can be guaranteed completely secure.
Favourites remain in the app's local storage until removed, or the relevant app data is cleared, subject to device backups. We retain order, transaction and support information for as long as needed to fulfil the purposes described here, meet recordkeeping obligations, and resolve disputes or security issues. When information under our control is no longer needed, we delete it or de-identify it.
For shop announcements, unsubscribing marks the installation’s subscription inactive. It does not automatically delete the stored token, subscription information, or previous sending records. Our current announcement service does not automatically expire these records. We retain them to manage subscription preferences, investigate delivery issues and maintain consent records, and delete or de-identify information under our control when it is no longer needed for these purposes. You can request deletion as described in section 7.
Square, Expo, Apple, Google and our hosting providers apply their own retention practices to information they hold. Turning off notifications or uninstalling the app does not automatically erase order records, Square account information, or all provider-held identifiers.
7. ACCESS, CORRECTION AND DELETION REQUESTS
You can contact info@waffleup.ca to request access to, correction of, or deletion of personal information held by Waffle Up Inc., or to ask questions about our handling of your information.
To request deletion of your One Stop Waffle Shop customer account and associated information, email info@waffleup.ca with the subject "Account and data deletion — One Stop Waffle Shop". Provide the email address or phone number associated with your customer account and describe your request. Do not send passwords, sign-in codes or payment card details. We may request information reasonably necessary to verify that the request is yours.
You can also contact info@waffleup.ca to request deletion of your shop announcement subscription and associated information under our control. Because our announcement database does not associate your token with your name, email address or Square account, we may need information identifying your app installation to locate the record. For example, we may ask you to share the push token shown in the app’s notification diagnostics privately with our support team. Do not post it publicly or send passwords, sign-in codes or payment card details.
We will address information under our control and explain any information we need to retain, such as transaction records required for recordkeeping, fraud prevention or legal obligations. For information or accounts controlled independently by Square or another provider, we will explain when a separate request to that provider is needed. Removing our app does not close a Square account.
You may withdraw consent to optional uses by contacting us or adjusting the relevant settings. Some requests may affect features that need the information to function. You can also raise privacy concerns with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/.
8. CHILDREN
The app is designed for customers browsing and ordering food and drinks, rather than as a service specifically for children. If you believe a child has provided personal information that should be removed, please contact us so we can investigate and address it.
9. POLICY CHANGES
We will update this policy when our information practices change and revise the date above. Where required, we will provide additional notice or obtain consent before using personal information for a new purpose.