Privacy Policy

PrepStack Privacy Policy

Last updated: 13 October 2026

1. About this Policy

This Policy describes how PrepStack handles personal data across the PrepStack corporate website and the products currently operated by the PrepStack product family: PrepOrder and PrepIQ. PrepStack is the company-wide brand used in this Policy. PrepStack confirms the legal operator name as PrepStak Technologies Limited, matching the PrepIQ materials. Current product notices report incorporation in Uganda under company registration number 80042719963846 and list the address shown in the Contact section below; verify the jurisdiction, number and address against company records before publication.

This Policy applies to people who visit our websites, contact us, create or use an account, place or manage an order, work for a restaurant or business customer, or whose information an organization provides through a PrepStack service. A product-specific privacy notice may explain a feature or data flow in more detail. A notice for one product does not, by itself, authorize unrestricted access to or use of information collected by another product.

2. Who controls the information

The role PrepStak has depends on the activity:

• We generally act as a data controller when we decide why and how to process information for our corporate website, contact enquiries, user accounts, platform security, customer support, billing, and company-wide administration.
• For information an organization places in PrepIQ about its restaurant, staff, suppliers, sales, or operations, that organization generally decides the purposes and the information to use. It is generally the controller for that workspace information, while PrepStak processes it to provide PrepIQ under the organization’s agreement and instructions. PrepStak remains a controller for its own account, support, security, and billing records.
• In PrepOrder, PrepStak operates the ordering platform and determines how platform accounts, discovery, orders, payments, and support work. A restaurant receives the information needed to handle an order and may separately determine how it uses that information for preparation, fulfilment, customer service, and its own legal obligations.
• A connected integration or product feature can involve more than one organization. The applicable product notice and agreement describe the roles for that activity. Organizations must have authority to provide other people’s information and give them any notice required by law. PrepStak also follows the obligations that apply to its role.

3. Information we handle

The information depends on the product, feature, and choices made by the user or organization. It can include:

Payment providers may collect payment credentials directly. PrepStak may receive payment method details, payment status, amounts, currency, transaction references, and refund information. The information handled depends on the payment method and provider.

We receive information directly from people, from a restaurant or business administrator, from an authorized user, through an enabled device feature, from a POS or other connected service, from an import or connector, and from another PrepStack product when a user or organization enables a specific connection. Some technical information is generated when a service is used.

4. Why we use information and the applicable grounds

We use information to provide requested features, create and protect accounts, show relevant food or operational information, transmit and fulfil orders, process or reconcile payments, provide forecasts and reports, answer support requests, maintain integrations, investigate abuse or security incidents, and meet legal or accounting requirements. Optional product analytics and marketing are used only as described in the relevant product notice and subject to the choices and consent required by applicable law.

Where Uganda’s law applies, the Data Protection and Privacy Act, Cap. 97 generally requires prior consent unless a specific statutory exception applies. The Act includes grounds such as taking steps requested before a contract or performing a contract, processing authorized or required by law, and complying with a legal obligation. The ground depends on the purpose and information involved. For information that is special personal data, including information about health status, additional restrictions apply; PrepOrder users should share allergy or health-related details only when needed for a feature and after the relevant notice and consent. We will identify the applicable ground in the notice for each feature rather than treating all processing as having one basis. If another law applies, its required legal-basis information and rights will also be provided.

We will explain whether requested information is required or optional and what may happen if it is not provided. Where we rely on consent, you may withdraw it using an available product control or by contacting us. Withdrawal does not undo processing that was lawful before it was withdrawn, and it does not affect processing that has a separate ground under applicable law.

5. Cross-product use

PrepStack ownership does not create a shared pool of all information collected by every product. We use information across products only for a stated purpose, with the necessary authorization or consent, and where permitted by applicable law.

If an organization chooses to link PrepIQ and PrepOrder, the products may exchange organization and branch details, addresses and hours, menu categories and items, and the names, work contact details, roles, or branch assignments needed to configure the link. A person who links accounts may also exchange account identifiers or sign-in assertions needed to verify and maintain that link.

PrepOrder’s current product notice describes selected order, sales, and marketplace signals being sent to PrepIQ for connected business tools and demand analysis. These signals can include restaurant, branch, or item identifiers; activity counts and time periods; order-line details, quantities, revenue, currency, fulfilment time, and refund adjustments; and structured food-demand information such as query text, dietary request, price range, party size, or approximate area. The documented sales-event feed is designed to omit a customer’s name, email address, phone number, and delivery address. Event identifiers can still be linkable to business records, and query or dietary information may reveal something about a person. The exact fields and controls must be disclosed for the enabled connection; they are not necessarily anonymous.

Users and organizations should review and authorize a connection before enabling it. A future PrepStack product will be added to this Policy and, where needed, receive its own supplement before information is collected through it.

6. Service providers and other recipients

We may share information with:

• the restaurant selected for an order, to accept, prepare, fulfil, deliver, or resolve an issue with that order;
• the organization that administers a PrepIQ workspace, for its users, branches, integrations, and operational records;
• hosting, database, file and image storage, email, SMS, notification, mapping, analytics, security, and technical-support providers that operate or protect a requested service;
• payment providers that process a payment or subscription, and POS or integration providers that a user or organization connects;
• AI, image-analysis, speech-to-text, or speech-generation providers when a user requests a feature that needs them;
• regulators, courts, law-enforcement bodies, professional advisers, or other recipients when disclosure is required or permitted by law, needed to protect people or the service, or needed to establish or defend a legal claim; and
• a successor or transaction partner in a proposed or completed transfer of all or part of the business, subject to applicable law and required protections.

The provider depends on the product and enabled feature. Current product notices may identify providers such as Resend, payment processors, hosting or image providers, POS platforms, and AI or speech services. Provider names, roles, locations, and terms can change; the relevant product notice should identify the providers currently used. A provider may process information under its own legal role and privacy notice.

PrepStak does not sell personal information as a standalone product. We do not use PrepIQ restaurant operational data to advertise unrelated products to restaurant guests. We may send optional marketing only as allowed by your preferences and applicable law.

7. AI and automated processing

When you request an AI feature, the service may send your prompt and relevant conversation, account, menu, restaurant, sales, or other context to the AI provider configured for that feature. A voice, image, or speech feature may send the submitted recording, image, or related text to its configured provider. The provider and its retention or model-training terms can depend on the feature and configuration. Do not include unnecessary personal, payment, or confidential information in a prompt. The current product notice should identify the provider and explain the data and controls for that feature.

AI-generated forecasts, summaries, and suggestions can be incomplete or inaccurate and should be checked against your records and judgment. If a product uses a decision made solely by automated processing that significantly affects a person, we will provide the notice, review options, and other protections required by the law that applies.

8. Cookies, app storage, and device permissions

Websites and apps may use essential session, authentication, security, language, and preference storage, as well as device identifiers or push-notification tokens. A product may offer optional usage analytics. Mobile features may request camera, photo-library, microphone, or location access when needed for a feature and subject to device permissions. PrepOrder and PrepIQ explain their app-specific permissions and analytics choices in their product notices. Our separate Cookie Policy will describe the corporate website’s actual cookies and similar technologies; it should be checked against the deployed sites before publication.

9. How long we keep information

We keep information for the period needed for the purpose for which it was collected, to provide a requested service, maintain relevant account or business records, resolve a complaint or dispute, protect users and services, and comply with law. When it is no longer needed, we delete it, anonymize it, or restrict access, unless law or a legitimate recordkeeping requirement permits or requires continued retention. Backups and provider records may remain for a limited time under the applicable retention process.

Current product notices describe these configured examples, which must be checked before this Policy is published: PrepOrder’s account-deletion flow has a 14-day pending period before the deletion task runs; selected food or menu image-analysis results have a 48-hour default expiry; PrepIQ schedules individual account identifiers for anonymization after 30 days and organization and branch identifiers after 90 days following the applicable closure. These periods do not mean every order, payment, audit, security, or organization record is erased at the same time. Product-specific notices explain what remains and why. The corporate enquiry form has no fixed public retention period in the current implementation notes; its schedule must be confirmed and published.

10. International processing

PrepStak is described in current product notices as based in Uganda. Our providers or their infrastructure may process information in Uganda or other countries. The countries and safeguards depend on the provider and feature. Before an international transfer, PrepStak and the organization responsible for the information must meet the transfer rules that apply, including any required consent or safeguards. We will identify relevant transfer information in product-specific notices or provide it on request. Current provider locations and transfer arrangements need confirmation before publication.

11. Your choices and privacy rights

Depending on the law and the role we have, you may ask us to:

• confirm whether we hold personal information about you and provide access to it;
• correct information that is inaccurate or incomplete;
• delete, block, or restrict information where the applicable legal conditions are met;
• stop or limit processing in circumstances provided by law, object to direct marketing, or withdraw consent where consent is the basis;
• review a significant decision made solely through automated processing where the law provides that right; or
• explain how information is used and identify relevant recipients or categories of recipient.

Deletion is not absolute. We may retain transaction, payment, security, audit, or organization records where a law, the organization’s documented instructions, or a dispute or security need permits or requires it. If an organization controls information in its PrepIQ workspace, contact its owner or administrator as well; PrepStak will help route or respond to a request according to its role.

Send a request to customer@prepiq.net and state which product or service it concerns. We may ask for information needed to verify your identity and locate the records. Do not include a password, payment PIN, or full card security details. Under Uganda’s Act, a verified access request is generally handled promptly and within 30 days, subject to the Act’s exceptions. You may also contact Uganda’s Personal Data Protection Office (PDPO) about a privacy complaint. See the Data Protection and Privacy Act, Cap. 97.

12. Children and managed profiles

PrepOrder may let a user create a group or managed profile and provide information about another person. Add another person only when you have authority to do so, give them any notice required by law, and provide only the information needed for the feature. If the information concerns a child, a parent or guardian must be involved where required by law. Do not submit a child’s allergy, health, location, or contact details unless they are needed, you have the necessary authority, and the relevant product permits the feature.

PrepIQ is business software for restaurant and food-service organizations. Organizations should not put children’s information into a workspace unless the information is necessary, the organization has authority to provide it, and the processing is permitted by law. Contact us if you believe a child’s information has been provided improperly.

13. Security

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, alteration, or disclosure. Controls may include role-based access, secure authentication, encrypted connections, restricted access to systems, monitoring, and controls for integration credentials. The measures appropriate to a particular feature depend on the information and provider involved. No online service or storage method can be guaranteed completely secure. Contact us promptly if you suspect misuse of a PrepStack account or information.

14. Changes and contact

We may update this Policy when a product, data flow, provider, or applicable law changes. We will update the date above and provide notice of a material change through a product, by email, or by another reasonable method where required. Product-specific notices may also be updated when a feature changes.

For privacy requests or questions, contact:

• PrepStak Technologies Limited (confirm registration and official address details)
• Company registration number listed in current product notices: 80042719963846 (confirm)
• Email: customer@prepiq.net (confirm this mailbox is monitored for company-wide privacy requests)
• Telephone: +256 709 802 259
• Address listed in current product notices: Dubai, Makindye II, Makindye Division, Kampala, Uganda

---

Internal publication checks — remove this section before publishing

1. Verify the company's registered details and PDPO registration/declared purposes against official records.
2. Confirm current product data flows, provider contracts and transfer locations, retention schedules, age controls, and legal bases with the product owners.
3. Publish a separate, public Account & Data Deletion resource for PrepOrder, link it from the applicable store listing, and verify that its instructions and any web request path match the live in-app deletion flow, grace period, and retained records.
4. Confirm that the privacy contact is monitored for company-wide requests, then obtain qualified Ugandan legal review and set the effective date.