Privacy Policy

Tortal Pty Ltd (ABN 16 697 930 733), [Suburb], NSW · Effective 6 October 2026

This policy explains how Tortal Pty Ltd ("Tortal", "we") handles personal information when you use tortal.com.au and the Tortal Customer, Restaurant and Delivery apps. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1. Information we collect

• Customers: name, mobile number, email, password (stored encrypted), saved delivery addresses and instructions, order history, favourites, ratings and reviews, messages to restaurants, drivers or support, and device and app details (device type, app version, IP address, notification token).
• Location: if you allow it, we use your device location to find restaurants in your area and set your delivery address. You can decline and type an address instead.
• Voice search: if you use voice search, your device's speech service may process your voice to produce text.
• Delivery partners: name, contact details, date of birth, address, citizenship or visa status, ABN, driving licence, identity document, vehicle details and photos, vehicle registration and CTP insurance, bank details, and background-check results. We also collect your real-time location, including in the background while you are online, so customers and Tortal can track deliveries. Location is collected only while you are online. Going offline or turning off permission stops it.
• Restaurant partners: business and owner details, ABN, ACN, GST status, licences and certificates, photo ID, store address and hours, menu content and images, and bank details used to pay you.
• Payments: card payments are processed by our payment provider, Kuber Financial. We never see or store your full card number, only the payment status and a reference. For cash on delivery, we record the amount.
• Delivery records: a verification code and a proof-of-delivery photo may be stored with an order.

2. Why we use it
To take and deliver orders, show restaurants in your zone, process payments and refunds, send order updates, provide support, verify identity and prevent fraud, pay restaurants and delivery partners, check driver eligibility, improve the service, and meet legal obligations. We send marketing only if you have not opted out.

3. Who we share it with

• Restaurants (your name, order, instructions and phone, so they can prepare it).
• Delivery partners (name, phone, address and order status).
• Service providers: Kuber Financial (payments), Google (Maps, address search, sign-in and Firebase push notifications), Twilio (verification codes and SMS messages), our hosting provider, and National Crime Check (NCC), which verifies delivery partners (police check and right-to-work) and contacts applicants directly.
• Authorities when the law requires.

We do not sell your personal information.

4. Overseas storage
Our servers and some of our service providers (including Google and Twilio) are located outside Australia, including in the United States. We take reasonable steps to make sure they protect your information.

5. Notifications
Order updates arrive as push notifications. You can disable them in your phone settings, but you may then miss order alerts. To stop marketing, use the unsubscribe link or email support@tortal.com.au.

6. Cookies (website)
We use cookies to keep you signed in, remember your location and preferences, and measure usage. You can block cookies in your browser.

7. How long we keep it
We keep account data while your account is active. After you delete it, we delete or de-identify your information within 30 days, except records we must keep for tax, accounting or disputes (generally 5 to 7 years), such as order and payment records. Partner records and background-check results are kept as the law and our safety obligations require.

8. Your rights and account deletion

• In the app: Profile → Delete Account.
• By email: support@tortal.com.au, from your registered email or number.
• Restaurant and delivery partners can request deletion by email once pending orders and payouts are settled.

You can also ask to access or correct your information. We reply within 30 days.

9. Security
We use encrypted connections, hashed passwords and restricted access. No system is perfectly secure. If a breach is likely to cause serious harm, we will notify you and the OAIC.

10. Children
Tortal is not for people under [16], and we do not knowingly collect their information.

11. Complaints
Email support@tortal.com.au. If you are not satisfied, contact the OAIC at oaic.gov.au or 1300 363 992.

12. Changes
We will post updates on tortal.com.au and in the apps.