§ LEGAL

Privacy Policy

Effective 2026-04-22 · Last updated 2026-04-22

Super Deal Pizza & Wings ("we") operates superdeal.pizza. This policy explains what personal information we collect, why, and how we protect it. It is written to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs private-sector data handling in Canada.

1. What we collect and why

Data	Why we collect it	Where it's stored
Name	So the driver knows who to call / hand food to	Supabase (Canadian region: ca-central-1)
Phone number	So we can text order updates + call on issues	Supabase · Twilio (SMS only)
Email	Receipt + cart-abandonment recovery email	Supabase · Resend (outbound email only)
Delivery address	So the driver can find you	Supabase · shared with Google Places (for autocomplete) and Google Maps (for driver routing)
Order history	Receipts + loyalty points tracking	Supabase
Payment card	Processed by Stripe; we never see or store your card number	Stripe only
Device / browser basics	Site reliability and analytics	Vercel / Netlify / Google Analytics (if enabled)

2. How we use it

Order fulfilment: Your name, phone, address and order details are shown on the kitchen ticket and driver manifest.
Order communication: SMS + email updates (order received, being prepared, out for delivery, delivered). You can reply STOP to any SMS to opt out.
Loyalty points: Phone number is used as your unique identifier across orders for the Super Deal Rewards program.
Cart abandonment recovery: If you start an order and don't pay within 2 hours, we may send ONE recovery email with a link to resume. You can opt out by clicking Unsubscribe in that email.
Fraud prevention: Stripe may use your card fingerprint + IP to flag fraudulent charges.

3. Who sees your data

Our kitchen + driver staff — name, phone, delivery address, order detail.
Stripe — card details only, for payment processing. Stripe's privacy policy: stripe.com/privacy
Google — address string you type is sent to Google Places for autocomplete. Directions use Google Maps. Google's privacy: policies.google.com/privacy
Twilio — phone number + SMS body, only for outbound messages. Twilio's privacy: twilio.com/legal/privacy
Resend — email address + email body, for order receipts and recovery emails. resend.com/legal/privacy-policy
Supabase — our primary database host. Data is stored in the ca-central-1 region (Canada). supabase.com/privacy

We do not sell your data. We do not share it with advertisers. We do not use it for marketing other than the one-per-order recovery email above.

4. How long we keep it

Order records — 7 years (Canadian tax law). You can request deletion after that.
Active account + points balance — until you ask us to delete it or 3 years of inactivity.
Cart-recovery emails — deleted from our servers within 90 days of sending.
Stripe payment data — retention governed by Stripe's policy, typically 7 years for compliance.

5. Your rights under PIPEDA

You have the right to:

Access the personal information we have about you — email us, we'll send a copy within 30 days.
Correct inaccurate information — just call or email us.
Delete your data — email us "delete my account" from the email on file. We'll remove your account and points; order records older than 7 years will be anonymized; records inside the 7-year window stay for tax compliance.
Opt out of marketing — reply STOP to any SMS, click Unsubscribe in any email, or tell us by phone.
File a complaint with the Office of the Privacy Commissioner of Canada.

6. Cookies and local storage

We use browser localStorage (not third-party cookies) to remember your address, cart, and points balance between visits. Clearing your browser's site data removes all of this.

If Google Analytics is enabled on the Site, it uses first-party cookies to count visits. You can block it by using a browser that blocks analytics (e.g. Safari with tracking prevention, Firefox with Enhanced Tracking Protection).

7. Children

The Site is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has given us their information, contact us to have it deleted.

8. Security

We use industry-standard security: TLS in transit, encrypted at rest in Supabase (Canadian region), row-level security policies, and no local storage of card data (Stripe handles it). No system is perfect; if we discover a breach affecting your data, we will notify you and the Office of the Privacy Commissioner within 72 hours, as required by PIPEDA.

9. Contact for privacy questions

Super Deal Pizza & Wings · 15 Martin St, Milton, ON L9T 2R1
Phone: 905-876-0222 · Email: privacy@superdeal.pizza

10. Changes to this policy

Material changes will be posted 14 days in advance on this page. Non-material edits (typos, link updates) may be made at any time with an updated "Last updated" date.

← Back to the menu