Privacy Policy

Last updated November 3, 2026

BagWit LLC, a New Jersey limited liability company (“BagWit”, “we”, “us”), provides an app that restaurants use to photograph delivery orders, and a website where restaurant owners manage their account. This policy explains what we collect, why, and the choices you have.

What we collect

• Owner accounts: email address, password (stored hashed by our authentication provider; we can't see it), the name you give us, and your restaurant names and locations.
• Employees: no account or email. We store the first name an employee enters, the restaurant they joined, and an anonymous sign-in ID for their device.
• Order photos and details: the photos your team takes, who took them, when (as recorded by our server), and the delivery platform, order number or name, and notes entered for the order. Photos can include whatever the camera sees, so we ask teams to photograph the order, not people.
• Billing: payments are handled by Stripe. We receive your subscription status and Stripe customer ID; we never see or store your full card or bank details.
• Website usage: anonymous, aggregated page-view statistics (which pages are visited, referring site, country and device type). These use no cookies and don't identify you.
• App error reports: when the app hits an unexpected error, it sends us the error message, the screen it happened on, the app version and the phone type, linked to the account ID, so we can fix it. Kept for 90 days.
• Technical logs: standard logs from our hosting providers (such as IP address and request times) used to keep the service secure and working.

What we use it for

Only to run BagWit: storing and showing order photos to the restaurant they belong to, managing team access, billing, support, preventing abuse, and improving the website. We don't sell or rent personal information, we don't share it for advertising, and we don't use your photos for any other purpose (including training AI models).

Cookies and browser storage

The website doesn't use advertising or tracking cookies. When you log in, your browser stores a login token so you stay signed in; it's strictly necessary and is removed when you sign out. Our page-view statistics are cookieless.

Who can see your photos

Photos are stored privately and are only visible to the owner of the restaurant they were taken for. Employees can see only the photos they took themselves. Owners may download or share photos, for example to submit them in a delivery-platform dispute. We access stored data only when needed to provide support you ask for, keep the service secure, or comply with the law.

How long we keep it

• Order photos are deleted automatically after the period the owner chooses (14 days by default, up to 30 days), unless the owner puts the order on hold. Owners can delete photos at any time.
• Deleting a location deletes its photos and team.
• Account information is kept while your account is open, and deleted right away when you use Delete account in the app (or within 30 days of an emailed request), except billing records we must keep by law.

Service providers

We use Supabase (database, authentication and file storage, hosted in the United States), Stripe (payments) and Cloudflare (website hosting, security and anonymous page-view statistics). They process data only on our behalf under their own security and privacy commitments.

Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Each restaurant's data is separated by database access rules, photo links expire after an hour, and order timestamps can't be edited. No system is perfectly secure; if we learn of a breach affecting your data, we'll notify you as required by law.

Your choices and rights

You can see and correct your account information in the app and on your account page. You can ask us for a copy of your data or to delete it by emailing us or using the delete-account page. Depending on where you live (for example California, New Jersey and other U.S. states with privacy laws), you may have additional rights to access, correct, delete or port your information and to appeal our decision; we honor these requests for everyone and won't treat you differently for making one. Employees can remove themselves with “Leave restaurant” in the app.

Children

BagWit is a business tool and is not directed to children under 13. We don't knowingly collect their information.

Changes

If we change this policy we'll update the date above, and notify owners of significant changes by email before they take effect.

Contact

Questions or requests: [email protected]