Privacy Policy

Last updated: October 24, 2026

Batch 9 lets restaurants post time-boxed meal deals that go ahead only if enough people book them. This policy explains what personal information we collect to run that, why, who we share it with, and what control you have. It applies to batchnine.com and the Batch 9 mobile app.

Who we are

Batch 9 is operated by Batch Nine, Toronto, ON. We are responsible for the personal information described here. You can reach our privacy officer at privacy@batchnine.com.

Information we collect

Account information

Your name, email address, mobile number and address, which you give us when you sign up.
Your password, if you use one. Our authentication provider stores it hashed; we never see it.
A two-factor authentication secret, if you turn that on.

Profile information

An optional profile photo and favourite cuisines.
The map coordinates of your saved address, so we can show deals near you.
The distance you choose for “deals near me.”

Location information

If you use “Near me” on the website or allow location in the app, your device’s location is used to sort deals by distance. We don’t store it unless you save it as your address.
Addresses you type are sent through our server to Google Places to suggest matches and find their coordinates.

Payment information

Card details are entered directly with our payment processors: Stripe for Canadian deals and PayHere for Sri Lankan deals. We never receive or store your full card number or security code.
We store what the processor gives back: a customer or card token, the card brand, the last four digits and the expiry date, so you can see and manage your saved card.
We keep a record of each charge and refund: amount, currency, date, status and the processor’s payment reference.

Bookings and activity

The deals you book, your pickup slot, your booking status (booked, paid, released, refunded or collected) and your pickup code.
A log of booking attempts, used to prevent duplicate and fraudulent bookings.

Reviews and messages

Ratings and comments you leave for a restaurant. They’re shown publicly with your display name.
Messages you type into our support chat, and emails you send us.
If you join the waitlist: your email, and your postal code or restaurant name if you give them.

Restaurant owner information

The restaurant’s name, address, contact details, cuisine, menu, prices and photos. These are shown publicly to diners.
Business and licence details we check during onboarding, and the bank account details used for weekly payouts. These are never shown publicly.

Technical information

Basic device, browser and usage information (pages viewed, performance, and error reports when something breaks).

How we use your information

To create and secure your account and sign you in.
To show you deals near you and run each deal: counting bookings, tracking deadlines and pickup slots.
To charge your card when a deal you booked tips, and to issue refunds.
To give the restaurant what it needs to hand over your meal.
To pay restaurants their weekly payouts and keep accounting and tax records.
To email you about your bookings, for example when a deal tips, changes or is cancelled.
To answer support questions, including through our AI support chat.
To show reviews and ratings.
To detect and prevent fraud and abuse, fix errors and improve Batch 9.

We don’t use your information for advertising, and we don’t sell it. We’ll ask for your consent before using it for anything new.

Restaurants

When you book a deal, the restaurant sees your name, your pickup slot, your booking status and your pickup code, so it can prepare and hand over your meal. Restaurants don’t see your card details, email address or home address.

Service providers

These companies process information for us, only to provide their service:

Supabase: database, sign-in and file storage.
Stripe: card payments for Canadian deals.
PayHere: card payments for Sri Lankan deals.
Vercel: website hosting, plus privacy-friendly page-view and performance analytics.
Google (Places / Maps): address search, map coordinates and restaurant ratings.
Resend: sends our emails.
Anthropic: powers the AI support chat (the messages you type into it) and helps restaurants turn menu photos into menu items.
Sentry: error reports, so we can fix bugs.
Expo: builds and delivers the mobile app.

We may also disclose information if the law requires it, to respond to a valid legal request, to investigate fraud or a chargeback, or to protect the safety of our users or the public. If Batch 9 is sold or merged, your information may transfer to the new owner, who must keep protecting it under this policy.

Cookies & analytics

We use cookies only to keep you signed in. Our analytics (Vercel Analytics and Speed Insights) count page views and measure speed without advertising cookies or cross-site tracking. We don’t use advertising or social-media tracking cookies.

Data retention & deletion

We keep your account and profile while your account is open.
When you ask us to delete your account, we delete or de-identify your profile, saved address, saved card tokens and support messages within 30 days.
We keep payment, refund and payout records for as long as tax and accounting law requires (in Canada, generally six years; in Sri Lanka, as required by the Inland Revenue Act), and booking records needed to handle a dispute or chargeback until it’s resolved.
Reviews you wrote are removed or de-identified, as you prefer.
Error reports and analytics are kept for a limited period by our providers and then deleted.

Your rights & choices

You can:

See and edit most of your information in your profile, and remove your saved card at any time.
Ask for a copy of the personal information we hold about you.
Ask us to correct information that’s wrong.
Ask us to delete your account and personal information.
Withdraw consent, for example by turning off location access in your browser or phone settings. This only limits features that need it.
Complain to a regulator: in Canada, the Office of the Privacy Commissioner of Canada; in Sri Lanka, the Data Protection Authority under the Personal Data Protection Act, No. 9 of 2022.

To use any of these rights, email privacy@batchnine.com. We’ll reply within 30 days and may need to confirm your identity first.

Children’s privacy

You must be 18 or older to create an account. We don’t knowingly collect personal information from children. If you think a child has given us personal information, contact us and we’ll delete it.

Security

We protect your information with encrypted connections (HTTPS), database access rules that limit who can read each record, hashed passwords, and payment processors that meet card-industry security standards (PCI DSS). No system is perfectly secure. If a breach puts your personal information at real risk, we’ll notify you and the relevant regulator as the law requires.

Where your data is processed

We operate in Canada and Sri Lanka, and follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Sri Lanka’s Personal Data Protection Act, No. 9 of 2022. Some of our service providers store or process data outside your country, including in the United States. When that happens, we use providers that protect it under contract, but it may be accessible to authorities in those countries under their laws.

Changes to this policy

We may update this policy as Batch 9 grows. We’ll post the new version here with an updated date and email you before significant changes take effect.

Contact us

Questions about this policy or your personal information? Email our privacy officer at privacy@batchnine.com. Our full mailing address is available on request.