Privacy
Last updated 12 September 2026
KitchenStack is restaurant management software operated by Genesys 360 Limited. This page explains what personal data we handle, why, and what you can ask us to do about it.
Who we are
Genesys 360 Limited, a company registered in England and Wales, company number 16167468. Registered office: 151 Dataller Drive, Hazlerigg, Newcastle upon Tyne, NE13 7FY, United Kingdom. Contact founder@kitchenstack.app for anything on this page.
Data a restaurant holds in KitchenStack
Restaurants using our software store information about their own customers and staff. Typically:
| Guests | Name, phone, email, delivery address, allergen and dietary notes, order and booking history, marketing preferences |
|---|---|
| Staff | Name, contact details, role, PIN, shifts and hours worked, right to work documents where the restaurant records them |
| Drivers | The above, plus location while a delivery is in progress |
We hold this on the restaurant's behalf. We do not sell it, we do not use it to advertise, and we do not use one restaurant's data to benefit another. Where we produce anonymous benchmarks, they are aggregated so that no individual restaurant or person can be identified.
Driver location
While a delivery is in progress, a driver's app shares its location so the restaurant and the customer can see where the order is. It is deleted one hour after the delivery finishes. We keep no history of where anybody has been.
Allergen information
Allergen and dietary notes are health related, and we treat them as special category data. They exist so that a kitchen does not serve somebody something that harms them, and they are used for nothing else.
Data we hold about restaurants
Business name and address, the contact details of the people who use the system, billing information, and technical logs of how the software is used. We use this to run the service, to bill for it, to provide support and to keep it secure.
Lawful basis
- Contract: providing the service a restaurant has signed up for.
- Legitimate interests: keeping the service secure, preventing abuse, and improving it.
- Consent: marketing messages. Guests opt in, and can opt out at any time.
- Legal obligation: tax and accounting records we are required to keep.
Companies that process data for us
We use a small number of established providers. Each is bound by a data processing agreement and may only act on our instructions.
| Stripe | Card payments. Card numbers go directly to Stripe and never reach our systems. |
|---|---|
| Twilio | SMS and WhatsApp messages, such as a booking confirmation or a delivery tracking link. |
| Postmark | Transactional email. |
| Clerk | Sign in and account security. |
| Cloudflare | Hosting, file storage and protection against attacks. |
| Sentry / Axiom | Error reports and logs, so we can find and fix faults. |
Messages we send on a restaurant's behalf
Booking confirmations, reminders, receipts, order updates and delivery tracking links are sent because a guest has placed an order or made a booking. They are part of the service, not marketing.
Marketing messages are separate and only go to people who have opted in. Every one includes a way to stop. Replying STOP to a WhatsApp or SMS message stops marketing from us immediately and across every restaurant using our platform.
Where data is held
In the United Kingdom and the European Economic Area wherever we can. Some providers listed above operate in the United States, in which case transfers rely on the UK International Data Transfer Addendum or equivalent safeguards.
How long we keep it
- Order and payment records: six years, as tax law requires.
- Guest profiles: while the restaurant is using the service, unless the guest asks to be removed sooner.
- Driver location: one hour after the delivery ends.
- Right to work documents: employment plus two years, then deleted.
- Technical logs: typically 90 days.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict that use. The software has export and erasure built in, so a restaurant can act on a request without waiting for us.
If you are a guest of a restaurant, the quickest route is usually to ask that restaurant directly, since they control the data. If you would rather come to us, or they do not respond, email founder@kitchenstack.app and we will help.
You can also complain to the Information Commissioner's Office at ico.org.uk. We would rather you spoke to us first so we can put things right.
Security
Traffic is encrypted in transit. Passwords and PINs are hashed, never stored in a readable form. Each restaurant's data is isolated from every other restaurant's at the database level. Actions that matter are recorded in an audit log.
Changes
If we change this page we will update the date at the top, and tell our customers directly where the change is significant.