Privacy policy
Last updated 1 November 2026
This policy explains how Direct Dine handles personal data under the UK GDPR and the Data Protection Act 2018.
Venue owners and staff
When you sign up we collect your name, email, password (stored only as a one-way hash), venue details and billing information. We use it to run your account, bill you, and send you service emails. Card details are handled by Stripe; we never see your full card number. Our lawful basis is performance of our contract with you.
To help with setup or a support request, a member of the Direct Dine team may sign in to your venue's dashboard for up to an hour. We only do this for a recorded reason, we email the owner each time, every change we make is logged, and we can't change your billing, payment accounts or logins while signed in.
Diners who order from a venue
When someone orders from a venue's Direct Dine site, the venue is the data controller and Direct Dine is its processor. We store the details needed to fulfil the order (name, phone, email, delivery address, allergy notes) on the venue's behalf. Marketing contact only happens if the diner opts in, and is sent by the venue, not by us. We never sell diner data or market to diners ourselves.
Who we share data with
- Stripe, for subscription billing.
- The payment provider a venue chooses (Stripe, PayPal, SumUp or Dojo), when a diner pays online. Card details go directly to that provider; Direct Dine never sees or stores them.
- Our hosting provider, which runs our servers in the UK/EU.
- SMTP2GO, our email provider, for account, password, order-alert and support emails.
- postcodes.io, which receives postcodes (not names) to work out delivery distances.
How long we keep it
Account data is kept while your account is open and for up to 6 years afterwards for tax records. Venue data is deleted within 90 days of an account closing unless the venue asks us to delete it sooner.
Your rights
You can ask to see, correct, export or delete your personal data. Diners should contact the venue they ordered from; we'll help the venue respond. You can also complain to the Information Commissioner's Office (ico.org.uk).
Cookies
We use one essential cookie to keep you signed in to your dashboard. On the Direct Dine website (not on venues' ordering sites), we also use Google Analytics, but only if you agree when we ask. It sets cookies (named _ga) that help us see which pages people visit and how they found us; Google processes this data for us and IP addresses are not stored. You can change your mind at any time with the “Cookie settings” link at the bottom of every page. We don't use advertising cookies.