Privacy Policy

Who we are

“Eat Ozzo” is the trading name for two related companies, one per counter. The company that runs the counter you order from is the one holding your information. Both apply this same Privacy Policy.

For privacy questions about either, email privacy@eatozzo.com.

What we collect and why

We collect the least amount of personal information we can get away with: enough to make and hand you a sandwich, and not much more.

Phone number

You give us your number when you place an order (so we can text you when it's ready) or when you log in via one-time-code (so we can verify it's you). SMS is sent through Twilio.

Email and name

If you sign in with Google, Google passes us your email and name. We use email to identify your account and name to greet you correctly.

Order history

When you place an order, the order itself is created in Square, the same Square our counter staff use to print the docket. We see the order in our system to confirm payment and route it to the right counter; Square holds the long-term record.

Payment information

Card numbers, expiry dates and CVCs go directly to Square via their Web Payments SDK. They never touch our servers. We see only that the payment succeeded and the last four digits.

Analytics

We use Google Analytics 4 to see which pages get read, what device you're on, and roughly where in the world (city level). This is aggregated and isn't used to identify you.

The Eat Ozzo app

Everything above applies to the app as well as the website. The app also records how it is used: screens opened, orders started and completed, whether notifications were allowed, and errors. We use this to see what works and fix what doesn't — for example, to find out where people get stuck before paying.

When the app is first opened it generates a random identifier for that installation. It lets us count devices and tell one session apart from another. It is not your phone's identifier, we can't use it to recognise you anywhere else, and it is gone when you uninstall the app. If you are signed in, this activity is also linked to your account, so we can see whether your own orders and plan are working.

We also collect crash reports, through Sentry, to find and fix faults. Crash reports are grouped by that same random installation identifier and are not linked to your account. Sentry stores them on servers in the European Union.

None of this is used for advertising, none of it is shared with anyone for their own purposes, and none of it is sold. If you delete your account, we unlink this activity from you — the counts remain, but they stop being about you.

Who else sees it

We use a handful of trusted third-party services. Each has its own privacy commitments, which we've linked to so you can read them yourself.

• Square: payments and order records. Square's privacy notice
• Twilio: SMS for order updates and one-time codes. Twilio's privacy notice
• Google: sign-in (OAuth) and Google Analytics 4. Google's privacy policy
• Resend: delivers order confirmations and the emails sent from our contact and newsletter forms. Resend's privacy policy
• Sentry: crash and error reports from our app and website, so we can fix faults. Sentry's privacy policy

We use each of them as a processor: they handle data on our instructions and are bound by their own commitments to you. We don't pass your data to any other third parties.

Where your information goes

The services above are run overseas, so using them means your information is handled outside Australia. Under Australian Privacy Principle 8 we have to tell you where, so:

• Sentry (crash reports from the app) stores data in the European Union.
• Square, Twilio, Google and Resend are United States companies and may handle your information there or in other countries where they operate.

We choose providers that commit to protecting your information to a standard comparable with the Australian Privacy Principles, and we use each of them only as a processor acting on our instructions.

Cookies and similar tech

We use two kinds of cookies:

• A session cookie that keeps you logged in (set by Auth.js, our login library).
• Google Analytics cookies that track page views.

You can clear or block cookies in your browser settings. If you block them, you can still browse. You just won't stay logged in between visits, and analytics won't see you.

We don't show a cookie consent banner. Australian law doesn't require one, and this policy gives you the same information.

How long we keep it

Order records are held by Square. Their privacy notice covers how long they retain payment and order data — typically several years for tax and compliance reasons. We don't keep a separate copy beyond what Square stores.

Account data on our servers (your name, email, phone number, account preferences) is kept until you ask us to delete it.

Analytics data is held by Google for 14 months (the default Google Analytics 4 retention), then anonymised.

App usage data is held on our own servers. If you delete your account it is unlinked from you, so what remains is a count that isn't about anyone in particular. Crash reports are kept by Sentry for 90 days and then deleted.

Newsletter

When you enter your email in the footer signup, we send that address to ourselves by email (via Resend) so we can add you when our newsletter launches. We don't yet use a dedicated mailing-list provider; when we do, we'll update this page to name it. You can ask us to remove your email at any time using the contact details below.

Your rights

Under the Australian Privacy Principles (APPs 12 and 13), you can:

• Access the personal information we hold about you
• Correct anything that's wrong
• Delete your account data on our servers

Email privacy@eatozzo.com with what you want. We'll respond within 30 days.

A note on order records: because order data is held by Square (not by us), if you want your order history deleted, we'll forward the request to Square and let you know.

Complaints

If you're not happy with how we've handled your information or your request, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

We'll update the date at the top whenever this page changes. For material changes, like adding a new third-party processor or a new category of data, we'll email account holders.

Contact

privacy@eatozzo.com

Harmony Rug Haven Pty Ltd (ACN 673 862 498), trading as Eat Ozzo Pyrmont
ozzo foods pty ltd (ACN 687 970 181), trading as Eat Ozzo Marrickville

Last updated: 23 September 2026