Privacy Policy

1. Who is responsible for your information

Nayya Pizza and Grill (also referred to as “Nayya”, “we”, “us”, or “our”) operates the Nayya Pizza websites, ordering services, and the Nayya Pizza mobile app in Canada. Questions or privacy requests can be sent to nayyapizzaapp@gmail.com.

2. Information we collect

• Account and contact information: name, email address, phone number, login identifiers, verification status, profile settings, and authentication/session records.
• Orders and fulfilment: ordered items, pickup or delivery choice, delivery address, address coordinates derived from the address you enter, delivery instructions, order history, receipts, and support messages.
• Payments and value: payment status and processor references, refunds, wallet credit, loyalty points, and purchase history. Card details are entered into the payment processor’s secure interface; Nayya does not intentionally receive or store a full card number or card security code.
• App and device information: Expo/FCM push token, device platform, app version, notification preferences, IP address, security logs, and basic operational diagnostics.
• Content you choose to provide: saved addresses, item notes, delivery notes, support text, an optional account-deletion reason, and named saved pizza builds.
• Website storage: essential cookies, local storage, and a short-lived session identifier used to keep the site working and understand page performance. We honour supported Do Not Track and Global Privacy Control signals for site analytics.

3. How we use information

• create and secure your account, verify identity, and prevent unauthorized access;
• quote, prepare, charge for, fulfil, deliver, track, support, and refund orders;
• save addresses, orders, preferences, rewards, wallet credit, and custom pizza builds;
• send transactional receipts, verification messages, security alerts, and order-status notifications;
• send offers only when you choose promotional email, SMS, or push notifications;
• detect fraud, investigate errors, protect the service, and meet tax, accounting, legal, and regulatory duties; and
• measure reliability and improve the ordering experience using limited operational information.

4. When information is shared

We share only what is reasonably needed with service providers acting for us, including:

• restaurant staff and delivery operations that prepare or fulfil the order;
• Stripe and any payment processor enabled for the selected restaurant;
• Google Firebase Cloud Messaging and Expo for push delivery;
• address and map providers used to validate a delivery address and estimate serviceability;
• email, SMS, hosting, database, storage, monitoring, and security providers; and
• government, courts, regulators, or another party where disclosure is legally required or necessary to protect people, the service, or a valid legal claim.

5. Notifications and marketing choices

Order and security messages support services you request. Promotional messages are optional. You can change push topics inside Account settings, revoke notification permission in your device settings, and use the unsubscribe method included with marketing email or SMS. Turning off marketing does not stop necessary order, receipt, account, or security communications.

6. Retention and account deletion

We keep account data while the account is active and for only as long as needed for the purposes described above. When you request account deletion, a 30-day grace period lets you cancel the request. When that period expires, access credentials, active sessions, linked identities, saved addresses, notification subscriptions, preferences, and other account-only data are deleted or irreversibly anonymized.

Transaction, tax, refund, chargeback, fraud-prevention, and security records may be retained after account deletion where reasonably required. Canadian business and tax records are generally retained for six years from the end of the tax year to which they relate, or longer only when legally required. Retained records are restricted from ordinary account use and deleted or anonymized when the retention duty ends.

7. Security

We use HTTPS encryption in transit, access controls, password hashing, encrypted token storage where implemented, session revocation, and operational monitoring. No system is risk-free; if a breach creates a real risk of significant harm, we will investigate, document, notify affected people and regulators when required, and take corrective action.

8. Your privacy rights

Subject to applicable law, you may ask to access or correct your information, withdraw optional consent, export available account data, challenge our handling of personal information, or request account deletion. We may need to verify that the request is yours. You may also contact the Office of the Privacy Commissioner of Canada if a concern remains unresolved.

9. Children and changes to this policy

The services are not directed to children under 13. We may update this policy when the app, processors, or legal requirements change. The effective date above will change, and material changes will be communicated through an appropriate in-app, website, or account notice.