Privacy Policy

Cenaiva (“Cenaiva,” “we,” “us,” or “our”) is a dining platform for restaurant discovery, reservations, pre-ordering, on-demand delivery and pickup, and a voice and chat concierge, operated by Autor Technologies Inc. This Privacy Policy explains what personal information we collect through our websites and apps (the “Services”), how and why we use it, when and with whom we share it, where it is stored, how long we keep it, and the choices and rights you have.

We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Québec, the Act respecting the protection of personal information in the private sector (Law 25). By using the Services, you agree to this Policy. This Policy covers diners and other users of the consumer Services; Restaurants and Drivers are also subject to their separate agreements with us.

1. Who we are and how to reach our Privacy Officer

Autor Technologies Inc. is responsible for the personal information it handles as part of the Services. Our Privacy Officer oversees our compliance with privacy law and this Policy. You can reach the Privacy Officer at support@cenaiva.com.

2. Scope of this Policy

This Policy applies to the personal information we handle through our consumer websites and apps — restaurant discovery, reservations and deposits, pre-order, on-demand delivery and pickup, the “Hey Cenaiva” concierge, reviews and ratings, and Snap content. It covers diners and other users of the consumer Services. Restaurants and Drivers are independent businesses; when they act as our sub-processors this Policy applies, but their own handling of your information under their separate agreements with us, and their own privacy practices, are not governed by this Policy. Where a linked third-party service has its own privacy policy, that policy governs its handling of your information.

3. Information you provide

• Account — name, email, phone number, and password when you sign up.
• Reservations & orders — party size, dates and times, delivery or pickup address, dishes ordered, allergy, dietary or accessibility notes, and messages to Restaurants.
• Reviews & content — ratings, review text, driver ratings, and photos or video you submit (including “Snap” content).
• Concierge conversations — the text or voice of your interactions with “Hey Cenaiva,” so we can understand and complete your request (for example, book, modify, or cancel a booking).
• Support — anything you tell us when you contact us for help.

4. Information collected automatically

• Device & usage — device type, operating system, app version, IP address, language, and how you interact with the Services, for security, troubleshooting, and improvement.
• Cookies & local storage — see our Cookie Policy.
• Push tokens — a notification identifier if you enable push, used to send order, reservation, and delivery updates.

5. Location data

With your permission, we use your device’s precise location, or an approximate location or an address you enter, to show nearby Restaurants, quote delivery fees, and enable live delivery tracking. You control location access through your device settings and can turn it off at any time; some features (such as live tracking or distance-based delivery quotes) rely on it and may be limited without it. During an active delivery, limited location information is shared with the Driver and with you so both sides can follow the delivery’s progress.

6. Payment information

Card payments are processed by Stripe in Canadian dollars. We do not store your full card number; Stripe tokenizes it, and we receive only limited details (for example, card brand and last four digits) to operate, reconcile, and support your transactions, deposits, and refunds. Stripe handles card data as an independent controller under its own terms and privacy policy.

7. Information from Restaurants and Drivers

• Restaurants — status updates about your Reservation or Order.
• Delivery drivers — pickup and drop-off progress and, at delivery, proof of delivery.

If you are a Restaurant or Driver, we also process the account, business, verification, and operational data needed to provide those services, under your separate agreement with us.

8. Cookies and similar technologies

We use cookies and similar technologies (including your browser’s local storage) to keep you signed in, remember preferences, and understand usage so we can improve the Services. You can control these through your browser settings; disabling some may affect functionality. See our Cookie Policy for details.

9. How we use your information

• Provide the Services — create and manage your account, authenticate you, take Reservations and pre-orders, process payments and deposits, and coordinate delivery or pickup.
• Coordinate with Restaurants and Drivers — share the details they need to fulfil your request.
• Communicate with you — send transactional messages such as confirmations, updates, and receipts by email, SMS, or push.
• Power the Concierge and publish content — operate the voice and chat concierge and publish reviews or Snap content you choose to submit.
• Support, security, and fraud prevention — provide support, prevent fraud and abuse, and keep the Services secure.
• Legal obligations — meet tax, financial-record, and other legal requirements.
• Improve the Services — understand and improve the Services, using aggregated or de-identified data where we can.

10. Legal bases under Law 25 and PIPEDA

We rely on the following bases for the purposes above (under Law 25 and PIPEDA):

• Necessary to perform the service you requested — providing the Services, coordinating with Restaurants and Drivers, and sending transactional communications.
• Consent — optional processing such as precise location, push notifications, publishing Snap content, and non-essential analytics.
• Legitimate interest — support, security, fraud prevention, and improving the Services.
• Legal obligation — tax, financial-record, and other legal requirements.

Where we rely on your consent, you can withdraw it at any time (see “How to exercise your rights”), though some processing is necessary to provide the Services and cannot be turned off without ending your use of them.

11. The voice and chat concierge

The “Hey Cenaiva” concierge, powered by our provider Loquent, processes the text or voice of your interaction along with your account and order context so it can understand and complete your request — for example, to book, modify, or cancel a Reservation or Order. Concierge conversations are retained for a limited period to operate and improve the service, then deleted or de-identified (see our Data Retention schedule). You can always complete the same actions yourself without the Concierge.

12. Sharing with Restaurants and Drivers

We do not sell your personal information. We share it only as needed to run the Services:

• Restaurants you book or order from receive the details needed to fulfil and support your request.
• Delivery drivers receive only what the drop-off requires to complete a delivery.
• Legal & safety — we may disclose information where required by law, or to protect the rights, safety, and security of users, the public, or Cenaiva.
• Business transfers — in a merger, acquisition, financing, or sale of assets, subject to this Policy.

13. Our service providers (sub-processors)

We use the following service providers, who process data on our behalf under contract:

• Amazon Web Services (AWS) — hosting, database, and email delivery (Amazon SES), in the Canada (Montréal) region.
• Vercel — delivery of our web front-end.
• Stripe — payment processing and payouts.
• Twilio — SMS notifications.
• Google Maps Platform — maps, places, and routing.
• Google Firebase (FCM) / Apple (APNs) — push notifications.
• Loquent — the “Hey Cenaiva” voice and chat concierge.
• Apify — menu import for onboarding Restaurants.
• upload-post — publishing Snap content you approve to Cenaiva’s own social accounts.

14. Advertising and analytics

We use analytics to understand usage in aggregate so we can improve the Services — for example, which features are used and where problems occur. We do not sell your personal information, and we do not use it to build advertising profiles or to serve third-party targeted advertising. Where the law requires consent for non-essential analytics, we ask for it and honour your choice. See our Cookie Policy.

15. International transfers

We store your personal information in Canada (see below). Some of our service providers may process limited data outside Canada. Before disclosing information for processing outside Québec, we conduct the assessment Law 25 requires and take reasonable steps — including contractual safeguards — so your information continues to receive a comparable level of protection. We describe such transfers as the law requires.

16. Where your data is stored (Canada)

Your account, reservation, order, and related personal information is stored in Canada, in AWS’s Canada (Montréal) region (ca-central-1), consistent with our commitment to Canadian data residency. Backups are encrypted.

17. How long we keep it

We keep personal information only as long as needed for the purposes described above or as required by law — for example, to provide your account, honour your order history and receipts, resolve disputes, and meet tax and financial-record obligations. When information is no longer needed, we delete or de-identify it. See our Data Retention schedule for per-category periods.

18. Security

We use technical and organizational safeguards appropriate to the sensitivity of the information — including encryption in transit and at rest, access controls, least-privilege practices, and monitoring. No method of transmission or storage is completely secure, but we work to protect your information and to notify affected individuals and regulators of a confidentiality incident where the law requires.

19. Your privacy rights (PIPEDA & Law 25)

Subject to legal limits, you may:

• Access the personal information we hold about you and request a copy.
• Correct information that is inaccurate or incomplete.
• Delete your account and associated personal information — from the app under Account → Delete account, or by emailing us. Deletion anonymizes your data; records we must keep by law are retained in de-identified form (see Data Retention).
• Withdraw consent for optional processing — for example, turning off location or push notifications in your device settings, or unsubscribing from non-essential messages.
• Portability — request that certain computerized personal information you provided be released to you, or transferred, in a structured, commonly used technological format (Law 25).
• Complain to us or to a regulator (see below) if you have concerns.

20. How to exercise your rights

To exercise a right, contact our Privacy Officer at support@cenaiva.com. We may need to verify your identity first so we do not disclose your information to the wrong person, and we will respond within the timeframes required by applicable law. Most account information can also be viewed and updated directly in the app, and you can delete your account yourself under Account → Delete account.

21. Automated decision-making

The “Hey Cenaiva” concierge uses automated processing to understand your requests and act on them (for example, to book, modify, or cancel a Reservation or Order). We do not use automated processing to make decisions producing legal or similarly significant effects about you without a human able to review them. Where Law 25 applies to a decision based exclusively on automated processing, we will inform you and, on request, let you make observations and ask for a review by a member of our team.

22. Children and minors

The Services are intended for adults. We do not knowingly collect personal information from children under the age of majority in their province or territory without appropriate consent. If you believe a minor has provided us information, please contact us and we will take appropriate steps.

23. Third-party links

The Services may link to third-party sites and services — for example, a Restaurant’s own site, a mapping provider, or Cenaiva’s social accounts. We do not control those sites and are not responsible for their content or privacy practices. When you leave the Services, the privacy policy of the site you visit governs your information there.

24. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and change the “Last updated” date, and for material changes we will provide additional notice.

25. Contact and complaints (regulators)

Questions, requests, or concerns about your privacy can be sent to our Privacy Officer at Autor Technologies Inc., which operates Cenaiva, at support@cenaiva.com.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or, if you are a Québec resident, the Commission d’accès à l’information du Québec.

The Services are offered in English and French for our users in Québec and across Canada. Une version française de cette politique est disponible.