Privacy policy

1. Who's responsible

FIG, based in Markham, Ontario, Canada, is responsible for your personal information. We follow Canada's privacy law (PIPEDA). Our Privacy Officer, Brendan Lau, answers questions sent with Message us in the app, or from the contact page at fig-promo.vercel.app/contact.

2. What we collect

Account: name, username, email (confirmed with a code), mobile number (we'll confirm it with a text code once texts are switched on), photo, and your password (stored scrambled, never readable).

Taste: cravings, budget, dietary needs and home area from Profile setup.

Location: your precise location while you use FIG, to show nearby deals. It's optional: you can find, claim and use every deal with it off. If you tap I'm here on a takeout order, we keep how far you were from the restaurant with that order. If you turn on arrival reminders, also when you arrive at a restaurant where you have a claimed deal.

Activity: claims, verified visits, searches, takeout orders, and the reviews and photos you post (chat isn't available yet; if we turn it on, your messages will be kept here too).

Device: phone model, app version, notification token and crash reports.

Terms: which version of our terms you accepted, and when.

Two-step login: if you turn it on, the key that links FIG to your authenticator app. The codes it makes stay on your phone.

Support: messages and reports you send us.

How you found FIG: the tag on the link you came from (a creator’s link or a flyer’s QR code, for example), noted once when you join the waitlist, sign up or add a restaurant, and your answer to “How did you hear about FIG?” if you give one (you can skip it). We use them only to see which outreach works. Restaurants never see them.

In your browser: your sign-in and the app's saved state (so you stay signed in), which link brought you to FIG (until you close the tab), whether FIG is open to diners, and an offline copy of the website's pages. No tracking or advertising cookies.

3. How we use it

Show deals and places near you

Verify redemptions and stop fraud

Keep a record of your visits, so you can rate them and find places again

Personalise Home (you can turn this off)

Send the alerts and emails you chose

Emails about deals and FIG news only if you said yes when you signed up. Each one has an unsubscribe link, and you can turn them off anytime in Account & password

Answer support requests and improve FIG

FIG doesn't show ads for now. We don't sell your information or show you third-party ads based on it.

4. Dietary needs

Dietary needs can say something about your health or beliefs, so we treat them as sensitive. They're only used to filter places and deals for you, and they're never shared, with restaurants or anyone else.

5. What restaurants see

When staff scan your QR, the restaurant sees your first name and last initial, the deal, and the time. Their dashboard shows totals, like "42 redemptions this week", not who you are. Restaurants never see your email or location. When you order takeout, they see how many of your takeout orders in the last 12 months you picked up or missed, nothing else. They never see your mobile number, not even for a takeout order: they reach you only through FIG, for example "We're waiting" on a takeout order. Reviews you post are public and show your first name and last initial.

6. Companies that help us

These companies process data for us, only to run FIG, under contracts that protect it:

Supabase: database and sign-in

Vercel: hosting, and anonymous visit counts for the website (Vercel Web Analytics: no cookies, no personal profile)

Resend: sends FIG's emails, so it gets your email address and what the email says

Stripe: card payments for takeout orders, and restaurants’ payouts. To set up a restaurant’s payouts, FIG shares its business name, address, phone and email with Stripe. ID and bank details go straight to Stripe and never pass through FIG.

Twilio: text messages, like codes that confirm your mobile number or sign you in, once we switch texts on

Komoot (Photon): the address search when you or a restaurant look up an address. What you type, and your internet address, go to its servers in Germany

OpenFreeMap (map tiles), jsDelivr (code the pages load) and Unsplash (some pictures on Home): they see your internet address, as any website does, so they can send it

Apple and Google: sign-in, maps, notifications

7. Where your data lives

Some of these companies store data outside Canada, mostly in the United States. There, it's protected by our contracts but also covered by local law. Address searches go to Komoot in Germany, where the European Union's privacy law applies.

8. How long we keep it

We keep your data while your account is open. When you delete your account, we erase your personal information within 30 days, and it's gone from our backup copies within 60 days.

Restaurants keep the records of your takeout orders and visits for their tax and accounting records, for as long as they're on FIG. Payments are also recorded by Stripe, our payment processor. When you delete your account, your name on those records is replaced with "Former diner", and your notes on dishes and your distance from the restaurant are removed.

If you tick "Keep a way to bring back my past visits and orders" when you delete, we also keep a one-way code made from your email (not the email itself) for 12 months. If you sign up again with the same confirmed email in that time, you can choose to bring back those orders and visits, or start fresh, which deletes the saved link. Your saved places, claims and reviews can't come back. If you don't tick it, the records can't be linked to you again.

9. Your choices

See or fix your info in Profile

Download it in Privacy & terms

Turn off location, alerts or personalised picks

Delete your account at any time

No account (on the waitlist, or you wrote to us)? Ask for a copy of your information, a correction or its deletion through the contact page (choose Privacy or my data). We answer within 30 days

Not happy with our answer? You can complain to the Office of the Privacy Commissioner of Canada.

10. Keeping it safe

We encrypt data in transit, scramble passwords and limit who on our team can access data. You can turn on two-step login, so signing in also needs a code from an authenticator app. Where it's available, you can sign in with a code we text to your confirmed mobile number instead of a password. No system is perfect. If a breach could put you at risk, we'll tell you and the Privacy Commissioner, as the law requires.

11. Age

FIG is for people 14 and older. We don't knowingly collect information from anyone younger. If we learn that someone under 14 has an account, we delete it.

12. Changes

If we change how we use your information in an important way, we'll tell you in the app first, and ask for your consent where the law requires it.

The waitlist

While FIG opens to restaurants first, diners can join a waitlist, here on the website or in the FIG app. We keep your email, your school if you add one (in the app: picked from a list of local high schools, colleges and universities built into the app, or typed in; it only helps us see which schools to reach first), that you agreed to “I agree to get emails from FIG and can unsubscribe at any time.” and when (joining needs it), when you joined, and which link brought you, if any. We email you to say FIG is open in Markham. If you unsubscribe, the emails stop and you keep your place. Every email comes from FIG, Markham, Ontario, and has an unsubscribe link: you can withdraw your consent anytime, through that link or by messaging us. To stop people flooding the list, we briefly count tries from your internet address. If you make a FIG account instead, your account is your place on the list. We never sell the list or share it with restaurants or advertisers.