Privacy policy

Last updated 9 November 2026

Crumb (getacrumb.com) is made by Axtra Studios, Plot 03-H1, Valencia, Lahore 54850, Pakistan. This policy explains what we collect when you use our website, Crumb Card (our cards, the links on go.getacrumb.com, a café’s menu page, ordering from the table, its link page and the owner dashboard), Crumb Orders (ordering on a restaurant’s own WhatsApp number) and the Crumb iPhone app and its App Clip, why we collect it, who we share it with and how you can have it deleted.

What we collect

Restaurant owners and their staff

• Your email address, your WhatsApp number, and your name if you give it.
• Your restaurant’s name, branch address, Google Maps link, WhatsApp number and logo.
• When you sign up at getacrumb.com/start: what you want to start with, and your café’s Google place. To find it, what you type into the search box is sent to Google. We keep only the place’s identifier, never Google’s other details about it.
• Card orders: designs, quantities, how you chose to pay and where we deliver.
• Where you point your cards, and the names you give them in your dashboard.
• Messages and emails you send us.
• When you sign in, a one-time code or link (stored only in scrambled form and valid for 20 minutes) and a cookie that keeps you signed in for up to 30 days.
• For Crumb Orders, the details WhatsApp shares when you connect your number: your WhatsApp Business account and phone number identifiers, and the access needed to send and receive messages for your restaurant.

Diners who tap or scan a card

When a diner taps or scans a Crumb card we record which card it was, the time, whether it was a tap or a scan, and the kind of phone and browser that opened it. To avoid counting the same tap twice we also keep a scrambled code made from the visitor’s internet address and browser together with a random key that changes every day and is deleted once that day is over. The code cannot be turned back into the address, cannot be used to follow anyone from one day to the next, and once the key is gone nobody, including us, can work out which address made it. We do not store the internet address itself. The card link also sets one cookie on the phone: a random number with nothing about the diner in it, so a phone counts once a day however often it taps. We keep it only scrambled with the same daily key, so it cannot follow anyone from one day to the next either. We do not know who the diner is. On an iPhone a card can open in the Crumb App Clip (below) in place of the browser. Then the App Clip asks us for the card the same way, and sends its own random tap number in place of the cookie, a different number from the one it uses for club cards, so a tap is never tied to a club member. It is kept only scrambled with the same daily key, and the tap is recorded and counted exactly as one from a browser. The review itself is written on Google and is covered by Google’s own privacy policy.

Phones a café marks as its own

An owner can mark their own phone, and the person carrying a card can link theirs, so that their own taps open the card’s page or their numbers and never count. The mark is a random number in a cookie on the card link (or kept in the App Clip), with nothing about the person in it. We keep only a scrambled copy, the kind of phone and browser it was marked on, and when it was last used, so the owner can see and remove it on their dashboard.

Guests who order from the table

When a guest orders from a café’s menu at a table, or calls a waiter from it, we keep the order, the table, any note they write and the time, for the café. We set one cookie on their phone, crumb_guest, which holds a random number. It lets the page show the guest their own orders at that table and stops one phone sending orders for another table. It lasts a year, it is never used for advertising and it does not tell us who the guest is. On the café’s customer list (below), the orders from one phone are kept together by it.

Visitors to a café’s menu page or link page

We count how a café’s link page and menu are used, without cookies. On a link page we record views, which buttons are tapped and where the visitor came from (a card, Instagram, Google or directly), with the same kind of scrambled daily code described above, made with the same random daily key. On a menu page we count how often the “Not sure what to order?” questions are started and finished, with a random number that lasts only while the page is open. Link previews and search engines are not counted.

Customers who order through Crumb Orders

When a customer messages a restaurant that uses Crumb Orders, we process, on that restaurant’s behalf:

• their WhatsApp name, phone number or WhatsApp user ID;
• their messages, voice notes and a written transcript of each voice note;
• the location pin, address and landmark they share for delivery;
• their orders with that restaurant;
• whether they agreed to receive offers from that restaurant.

A café’s customer list

Every café on Crumb gets a list of its own customers, made from the orders it takes through Crumb and the people its staff add:

• a guest who orders on the café’s WhatsApp: their WhatsApp name and number;
• a guest who orders at a table: the first name they give, if any, and the random number in the crumb_guest cookie;
• someone the café’s staff add at the counter: the name and number they give. A number added this way is marked as not checked, and Crumb never sends it a message.

For each person the café sees how they first came, their orders with it, how many days they visited, when they last came, the dish they usually have, and any notes the café writes. The list belongs to that café. No other café can see it, and a person who goes to two cafés on Crumb is two separate entries that neither café can see the other’s side of. The café can download its list, join two entries for the same person, and delete anyone who asks.

A café’s counter staff

When a café adds someone who gives club stamps or points, we keep their name and mobile number for that café, a code made from their PIN (never the PIN itself), when they signed in at the counter, and the stamps, rewards, bills and points they gave. The number is used only so that it cannot earn stamps or points at that café. The café can remove them at any time, and the records of what was given stay with the café.

Members of a café’s club

When a guest joins a café’s club on Crumb (for example “Kafi Club”), we keep, for that café only: their WhatsApp number (proved by the message they send to join), their name, when and where they joined, every stamp, reward or points entry with the branch, the staff member who gave it, the order number and, for points, the amount of the bill, and whether they agreed to hear news and offers from that café, with when and where they said so. Their card opens on their phone with one cookie per club, crumb_club_…, set from the one-time link in their WhatsApp reply, and the browser that pressed Join is remembered by crumb_club_b, a random id, so it can open the card once they join. Both only say which card is theirs, last a year, and are never used for analytics or advertising. A guest in two cafés’ clubs has two separate cards, and neither café sees the other’s.

A member who adds their card to Apple Wallet or Google Wallet gets it from Apple or Google, which then hold what the card shows: their name, member code, stamps or points, rewards, tier and the club’s terms. Apple keeps a push address for their iPhone so the card updates itself. The café’s news (one short line at most once a week) shows on every member’s card page, and on the Wallet card only of members who have not said no to offers. Replying STOP on WhatsApp, or switching offers off on their card, stops the café’s news and offers; the card and what is on it stay. Replying LEAVE leaves the club. A member the café deletes is gone at once, and their Wallet card is switched off.

If the café gives a birthday treat, a member may choose to tell it their birthday, on WhatsApp or on their card: the day and month only, never the year. It is optional, used only to put the treat on their card in their birthday week, kept with that café only (another café’s club never sees it), set once by the member and corrected only by the café, and deleted with the member.

The Crumb iPhone app and its App Clip

The Crumb app (“Crumb: Café Rewards” on the App Store) and its App Clip, the small part of it an iPhone opens from a café’s Crumb page or a Crumb card without installing anything, show a café’s club and link page, and let a guest join the club and keep their card. They have no accounts and no sign-in. On first use they make a random id for the phone, 16 random bytes kept in the phone’s Keychain, with nothing about the person or the phone in it, and send it with each request in place of a cookie: it does what crumb_club_b does in a browser, saying which club cards this phone joined, and nothing else. A card opened in the App Clip uses a separate random tap number, as described for card taps above. Joining works exactly as on the web: the guest sends one WhatsApp message, and we keep what a club member’s card holds (above). The camera is used only while the guest scans a Crumb code, and nothing it sees is kept or sent. The app and the App Clip have no third-party analytics, no advertising and no tracking, and use no advertising identifier. iOS deletes an App Clip, and what it kept on the phone, after a while without use; installing the full app keeps the same cards.

Visitors to this website

We do not use analytics or advertising cookies. Our servers keep short technical logs, and our error reports have personal details such as addresses, emails and form contents removed before they leave our systems.

How we use it

• To run Crumb: sign you in, take and deliver card orders, send each tap to the right page, and show your dashboard.
• For Crumb Orders: to understand each message, build the order from your menu, confirm it with the customer and send it to you.
• To keep each café’s customer list, for that café only.
• To answer you when you contact us, and to send emails about your account and orders.
• To keep the service safe, for example limiting how often a form can be used.
• To keep the records Pakistani tax law requires.

We do not sell personal information, we do not use it for advertising, and we never message a restaurant’s customers for our own purposes.

Restaurants and their customers

Each restaurant decides why and how its customers’ information is used, and we handle it only to provide the service to that restaurant. The customer list belongs to the restaurant. Restaurants must have a person’s agreement before adding them by hand or sending them offers, and must follow WhatsApp’s business policies.

Who we share it with

We use these services to run Crumb, and they handle data for us under their own terms:

• Railway, which hosts our website, database and link service.
• Google, whose Places service finds a café when its owner signs up.
• Meta, whose WhatsApp Business Platform carries every Crumb Orders and Crumb Club message.
• Apple and Google, whose Wallet apps hold a club card a member chooses to add. Apple also delivers the Crumb iPhone app and its App Clip through the App Store.
• AI model providers, such as Anthropic, OpenAI and Google, reached through OpenRouter, which read order messages so the order can be understood. Where a provider offers it, we choose settings that stop it keeping the data or training on it.
• Soniox, which turns voice notes into text.
• Resend, which sends our emails.
• Sentry, which tells us about errors, with personal details removed.
• Banks, wallets and payment companies, when you pay us through them.

These services may store or process data outside Pakistan, including in Singapore, the United States and Europe. We also share information when Pakistani law requires it.

How long we keep it

• Owner accounts and restaurant details: while you use Crumb, and up to one year after you leave.
• Card taps and scans, link page and menu counts: while the restaurant uses Crumb.
• Table orders: as long as the restaurant uses Crumb. The guest cookie: one year.
• The card link’s cookie: one year. The App Clip’s tap number: on the phone until the App Clip is deleted.
• A café’s club members, their stamps, points and rewards: as long as the café runs its club on Crumb. A switched-off Wallet card is kept 30 days, with nothing personal on it, so the phone hears it is gone.
• The club cookies on a guest’s phone: one year.
• The Crumb app’s random id: on the phone until the app is deleted (iOS deletes an unused App Clip by itself); with us, only as part of the club card it opened, for as long as that card is kept.
• A café’s customer list: as long as the café uses Crumb. An entry the café deletes is gone at once, and the person’s name, number and address are wiped from the café’s orders with it.
• A note left in a café’s suggestions box: 12 months, or until the café deletes it. It goes only to that café, and a phone number written in it is removed after 90 days. It is never posted, and never joins any list.
• A signup that is never finished: its code stops working after 20 minutes.
• Crumb Orders voice notes: 90 days. Their transcripts and chats: 12 months.
• Orders and invoices: as long as the restaurant uses Crumb, and as long as tax law requires after that.
• Sign-in codes and links: 20 minutes, and they work only once.

Your choices

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. You can also ask a café to take you off its customer list, which it can do straight away. A member of a café’s club can reply STOP at any time, or switch offers off on their card, to stop its news and offers. The steps for deleting data are on our data deletion page. We answer every request within 30 days.

Keeping it safe

Everything travels over encrypted connections. Sign-in codes and links are stored only in scrambled form, access to data is limited to the people who need it to run Crumb, and the dashboard is protected by sign-in.

Children

Crumb is a service for businesses and is not meant for children under 13.

The law

Pakistan does not yet have a general data protection law in force. We follow this policy and the laws that do apply, including the Prevention of Electronic Crimes Act 2016.

Changes

If we change this policy we will update the date at the top, and tell signed-up owners by email when the change matters.

Contact

Email shahzaib@axtrastudios.com or message us on WhatsApp.