MNI Food PRIVACY POLICY Effective date: 11 August 2026 This Privacy Policy explains how MNI Food (“MNI Food”, “we”, “us” or “our”) collects, uses, stores and shares personal data when customers, restaurant owners, restaurant staff, delivery drivers and administrators use the MNI Food mobile application, website and related services (together, the “Service”). MNI Food is responsible for the processing described in this policy. Privacy questions and requests can be sent to mnifoodinfo@gmail.com. 1. Data we collect • Customer account data: name, mobile number, email address, general location, account identifiers, account status and password credentials stored as a one-way password hash. • Email-verification data (customer registration only): customer accounts must verify an email address with Firebase Authentication. We receive a Firebase ID token confirming the verified email. Phone numbers for customer accounts are entered manually and are used for sign-in; they are not verified by SMS OTP in the current Service. • Restaurant, owner and staff data: owner or staff name, email address, telephone number, username, staff role, restaurant name, business address, cuisine, opening hours, operational status and registration or approval information. • Order and delivery data: restaurant, ordered items, customisations, quantities, prices, subtotals, any delivery charge, totals, collection or delivery choice, delivery address, customer notes, customer contact details, order status, timestamps and assigned driver details. • Payment data: payment status, Stripe payment identifier, card brand and last four digits where returned by Stripe. Full card numbers, security codes and complete card details are collected directly by Stripe and are not received or stored by MNI Food. • Content and preferences: menu items, ingredients, prices, restaurant and menu photographs, saved restaurants, cart contents, ratings, notification preferences (including whether alerts are enabled and whether visual alerts and sound are used) and in-app notifications. • Support and communications data: password reset requests, temporary-password administration, messages sent by SMS or email, delivery and order communications, and information included in enquiries. • Authentication and security data: session identifiers, account role, session expiry, failed sign-in events, lockout status, WebAuthn/passkey public credentials where used, Firebase email-verification token checks, and security activity records. • Device and permission data: whether biometric unlock is enabled on the device; photographs selected through the photo library; notification permission status; and, where notifications are allowed, a device push token (for example an Expo push token) used to deliver order and service alerts when the app is backgrounded or closed. The app may request photo-library or camera access only when an authorised user chooses an image-upload feature. In production mobile app builds, the app also requests when-in-use precise device location (latitude and longitude) from the operating system to confirm you are physically in Montserrat before the Service opens; this check is performed on your device and those coordinates are not sent to or stored by MNI Food servers. • Technical data: network request information such as IP address, timestamps, request headers and server or service logs that may be processed by our hosting, security and infrastructure providers. 2. Data we do not collect through the app • We do not receive your fingerprint, face template or other biometric template. Android or iOS performs biometric matching on the device; the app stores only an enabled/disabled setting in secure device storage. • We do not use precise device location to calculate delivery routes or auto-fill delivery addresses. Delivery and location information for orders is entered by the user. We do not track your location in the background or send Montserrat availability-check coordinates to our servers. • We do not use advertising SDKs, sell personal data or use personal data for third-party behavioural advertising. • We do not read your SMS inbox for customer registration. Email verification is handled through Firebase Authentication email links. 3. How we collect data • Directly from you when you register, sign in, place an order, upload an image, rate a restaurant, request support or change account preferences. • From restaurants, their authorised staff, delivery drivers and administrators when they manage orders, accounts, menus, deliveries or support requests. • Automatically from the app, our servers and service providers when the Service is accessed, authenticated or used, including when a push token is registered for device alerts. • From your device's location services when you open the production mobile app, to perform the on-device Montserrat availability check described above. • From Stripe when it confirms a payment and returns limited transaction and card-summary information. • From Firebase Authentication (Google) when a customer completes required email verification during customer registration. 4. How we use data • Create and administer accounts, authenticate users and maintain secure sessions. • Verify email-address possession for customer registration and account security using required Firebase email verification, including checking signed Firebase ID tokens on our servers. • Display restaurants and menus, maintain carts and saved restaurants, and process collection or delivery orders (including any delivery charge shown at checkout). • Confirm, in production mobile app builds, that you are physically in Montserrat before allowing use of the Service, using a when-in-use location check performed on your device. • Provide order details to the selected restaurant and delivery details to an assigned driver. • Process and reconcile payments, refunds, disputes, invoices and financial reporting. • Send service messages, including password-reset, temporary-password, order and delivery communications. • Show order and service alerts on your device (visual banners and/or sound, according to your preferences) and, when enabled, send Expo push / platform device alerts while the app is backgrounded or closed. • Review restaurant applications, manage staff permissions and operate owner and administrator tools. • Publish restaurant-provided business information, menus and images, and display ratings in aggregate or in connection with a restaurant. • Protect users and the Service, investigate failed sign-ins, prevent fraud and abuse, diagnose errors and enforce our rules. • Comply with legal, tax, accounting, regulatory and law-enforcement requirements and establish or defend legal claims. • Improve the reliability, usability and performance of the Service using operational information. We do not currently use third-party behavioural analytics or advertising SDKs. 5. Legal reasons for processing Where data-protection law requires a legal basis, we process personal data as necessary to provide the Service and perform our contract with you (including required Firebase email verification for customer registration and fulfilling orders you place); for our legitimate interests in operating, securing and improving the Service; to comply with legal obligations; and, where required, with your consent. You may withdraw consent for future processing where consent is the basis, but this does not affect earlier lawful processing. 6. How we share data Restaurant names, business contact information, addresses, menus, prices, opening hours and restaurant-supplied images are intended to be public. Customer identity is not publicly displayed with restaurant ratings. We do not sell or rent personal data. • Restaurants and authorised restaurant staff receive the customer, order, collection or delivery information needed to prepare and fulfil an order. • Assigned delivery drivers receive the customer name, contact and delivery information needed to complete a delivery. • Stripe processes card and payment data under its own privacy terms and sends us transaction status and limited card-summary data. • Supabase provides hosted database and storage infrastructure used to retain platform data. • Fly.io provides hosting and network infrastructure for the MNI Food platform API. • Twilio and its communications services may process phone numbers, email addresses and message content when SMS or email features are configured and used. • Google (including Firebase Authentication) may process email-verification information when a customer completes required email verification during customer registration. • Expo, Google and Apple may process app-distribution, device, crash or store-related information under their own terms when you obtain or operate the app through their services. When you allow notifications, Expo and Apple/Google push services may process your device push token to deliver remote alerts while the app is backgrounded or closed. • Professional advisers, regulators, courts, law enforcement, acquirers or other parties may receive data when required by law, to protect rights and safety, or in connection with a merger, financing, reorganisation or sale of the Service. 7. Storage, international transfers and retention Data is transmitted to the MNI Food platform API over HTTPS in production and is stored using Supabase and our hosting providers. These providers may process data outside Montserrat or your country. Where required, we rely on provider safeguards and contractual protections for international transfers. Account, restaurant, order, payment-summary, rating, support and operational records are kept for as long as reasonably necessary to provide the Service, meet legal, tax and accounting duties, resolve disputes, prevent fraud and enforce agreements. Authentication sessions normally expire after 30 days. Firebase email-verification ID tokens are checked promptly and are not retained as long-lived credentials. Device push tokens are kept while notifications remain enabled for that account on the device and are removed or unregistered when you turn notifications off or sign out where the Service supports that. Some information may remain in backups or security records for a limited period after deletion. The Service does not currently apply one fixed deletion period to every record type. 8. Security We use measures designed to protect personal data, including HTTPS for production network traffic, one-way password hashing, restricted server credentials, row-level database security, role-based access, release-build hardening, secure device storage for session and biometric-unlock settings, and cryptographic verification of Firebase ID tokens where email verification is used. No method of storage or transmission is completely secure, so absolute security cannot be guaranteed. 9. Your choices and rights • You may review or update available profile and preference information in the app. • You may choose whether to upload photographs and may remove uploaded images through available owner tools. • You may disable biometric unlock in the app or device settings. Biometric authentication is optional. • In production mobile app builds, you must allow when-in-use location access to open the Service. That check uses precise coordinates on your device only; denying permission blocks use of the app in those builds. Development and preview builds do not enforce this check. • You may turn notifications off, or choose visual alerts and/or sound, in customer Profile or owner Settings. Background / Expo push alerts require notifications (and typically visual alerts) to be enabled; sound-only preferences may apply only while the app or browser tab is open. • By placing an order you agree to that purchase. Checkout shows the line “By placing this order you've agreed to this purchase” under the order total. • Customer registration requires Firebase email verification. Restaurant/vendor registration does not use this flow. Existing customers may sign in with phone and password without repeating email verification. • You may ask to access, correct, delete or restrict your personal data, object to certain processing, withdraw consent, or request a portable copy where applicable law grants those rights. • To exercise a privacy right or close an account, email mnifoodinfo@gmail.com. We may need to verify your identity. Some records may be retained where legally required or necessary for security, disputes or completed transactions. • You may complain to the data-protection or privacy regulator that applies where you live. 10. Children The Service is not directed to children under 13, and we do not knowingly create accounts for children under 13. Users must also satisfy any higher minimum age required in their country or use the Service with the involvement of a parent or guardian. Contact us if you believe a child has provided personal data improperly. 11. Third-party services and links The Service may load content or connect to services operated by third parties. Their handling of personal data is governed by their own privacy notices. We encourage you to review the privacy terms of Stripe, Supabase, Fly.io, Twilio, Firebase/Google, Expo and Apple where relevant. 12. Changes to this policy We may update this policy when the Service, our providers or legal requirements change. We will change the effective date and, where appropriate, provide an additional notice in the app or on the public policy page. 13. Contact For privacy questions, requests or complaints, contact MNI Food at mnifoodinfo@gmail.com. No advertising, analytics or tracking cookies are used on this page.