Driver App Privacy Policy

Last updated: September 28, 2026

This Privacy Policy explains what personal data is collected when you use Restroship: the restaurant ordering app for customers, the delivery app for drivers, and this website. It also explains why the data is used, who it is shared with, how long it is kept, and your rights.

Our apps are often shown under the name and branding of the restaurant you order from or deliver for. Wherever this policy says "the app", it means any customer or driver app powered by Restroship, whatever name it appears under.

Who we are

  • Company: Restroship AS[TO CONFIRM]
  • Organisation number: 000 000 000[TO CONFIRM]
  • Address: Street address, postcode, city, Norway[TO CONFIRM]
  • Privacy contact: privacy@restroship.com[TO CONFIRM]

Restroship operates the platform: the apps, the ordering and delivery system and the technology behind them. Each restaurant is responsible for its own orders, menu, prices, payments, refunds and deliveries, and for how it uses the order and delivery information of its customers and drivers. For that information the restaurant is the data controller and Restroship processes it on the restaurant's behalf. Restroship is the controller for data it uses to run, secure and improve the platform itself, such as your login, crash reports and app analytics.

You can contact either the restaurant or us. If you contact us about data a restaurant controls, we will forward your request and help the restaurant respond.

Data we collect

Drivers

  • Account details: name and phone number, and the restaurant(s) you deliver for.
  • Precise location, including background location during active deliveries: while you are delivering an order, the app collects your location even when it is closed or you are using a navigation app. It is shared with the restaurant and with the customer whose order you are delivering so they can follow the delivery. Location is not collected for tracking when you have no active delivery.
  • Delivery history: assigned orders, delivery addresses and customer contact details needed to complete a delivery, delivery status and times.
  • Cash collected for cash-on-delivery orders and whether it has been settled with the restaurant.
  • Order chat messages, push notification token, and device, crash and analytics data, as described for customers.

Customer information you see as a driver may only be used to complete that delivery. When you delete your account, your driver profile and location data are removed; delivery and cash records are kept anonymised for the restaurant's accounting.

Why we use your data and our legal basis

The app is used in Norway and the EEA, so we follow the GDPR. We rely on:

  • Contract — to create your account, verify your phone number, place, prepare, deliver and track orders, process payments, and send order and delivery updates.
  • Legitimate interest — to keep the platform secure, prevent fraud and misuse, fix crashes, and understand how the app is used so we can improve it.
  • Consent — for location access and push notifications. You can withdraw consent at any time in your device settings. Drivers need location access during active deliveries for delivery tracking to work.
  • Legal obligation — to keep order, payment and cash records as required by accounting and tax law.

Who we share data with

We do not sell your personal data. It is shared only with:

  • The restaurant you order from or deliver for, and its staff.
  • The customer whose order you deliver, limited to what is needed for that delivery.
  • Processors that provide services to us under data processing agreements:
    • Google Firebase — Analytics, Crashlytics, Cloud Messaging (push notifications) and Remote Config
    • Google Maps — maps, addresses and navigation
    • Stripe — card payments
    • Twilio — SMS login codes
    • Hosting: Vercel (website) and Render (API and databases)[TO CONFIRM]
  • Authorities, when the law requires it.

Some processors may handle data outside the EEA. Where they do, transfers are protected by the EU Standard Contractual Clauses or another lawful transfer mechanism.

How long we keep data

  • Account data is kept until you delete your account.
  • Order, payment and cash records are kept for the period required by accounting law (5 years[TO CONFIRM]). When you delete your account these records are anonymised, so they no longer identify you.
  • Location data is kept only as long as needed for delivery records and handling complaints, and is removed when you delete your account.
  • Crash and analytics datais kept according to Google Firebase's retention settings.

Security

Each restaurant's data is kept in an isolated database. We use encryption in transit, access controls and monitoring to protect it.

Your rights

You have the right to:

  • access the personal data we hold about you;
  • have incorrect data corrected;
  • have your data deleted;
  • receive your data in a portable format (data portability);
  • object to processing based on legitimate interest, and withdraw consent at any time;
  • complain to Datatilsynet (the Norwegian Data Protection Authority) at datatilsynet.no, or to the data protection authority where you live.

To use your rights, contact the restaurant or email privacy@restroship.com[TO CONFIRM]. We reply within one month.

Deleting your account

You can delete your account at any time. It deletes the customer and driver accounts for your phone number in every restaurant that uses Restroship.

  • In the app: Account → Settings → Delete account.
  • On the web: go to Delete account and confirm with a code sent to your phone.

Deleted

  • Your name, phone number and email address
  • Saved delivery addresses and favourites
  • Location data linked to you, including driver location history
  • Your driver profile
  • Notifications and order chat messages
  • Your sessions and push tokens — you are signed out of the app on all devices

Kept anonymised

  • Past orders, payments, deliveries and driver cash records are kept for the restaurants' accounting for 5 years[TO CONFIRM]. They show "Deleted user" and are no longer linked to your name or phone number.

Deletion can't be undone. You can sign up again later with the same number, but it will be a new account.

Children

Restroship is not directed to children under 13, or under 16 in EEA countries where that age applies. We do not knowingly collect data from them. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

We may update this policy. We will change the "Last updated" date above and, for significant changes, tell you in the app.

Contact

Restroship AS[TO CONFIRM], Street address, postcode, city, Norway[TO CONFIRM]. Email: privacy@restroship.com[TO CONFIRM].

This page shows the parts of our policy that apply to the driver app. Read the full privacy policy.