Privacy policy

Updated 2026-09-29

Controller

Nooa Lab Oy (business ID 3094082-9), Saniaistie 16 H, 00730 Helsinki. Contact: info@nooalab.fi.

This policy covers izikit (izikit.site): restaurant users, and people who visit restaurants' sites and place orders.

Restaurant users

We process your email address (sign-in), the restaurant details you enter (name, contact details, opening hours, menu, photos, business ID) and sign-in sessions. The legal basis is the contract to provide the service.

Data is kept while the account is in use. You can ask us to delete your data at info@nooalab.fi.

Customers who order

When you order on a restaurant's order page, we process your name, email address, phone number, the order contents, the pickup time or table, and any note. They are passed to the restaurant so it can fulfil the order.

The restaurant is the controller of this data and we process it on the restaurant's behalf. Please direct requests about orders to the restaurant first; we help the restaurant handle them.

Unconfirmed orders are deleted within a day. A verified email address is remembered in this browser for that restaurant's orders for up to 180 days.

When you pay online, you give your payment details directly to Stripe. We never see or store card details; Stripe only tells us whether the payment succeeded, with its reference.

Cookies and browser storage

We only use cookies the service needs to work: the dashboard sign-in session (30 days) and the diner's verification on a restaurant's order page (180 days, only on that restaurant's address). The basket and form details are kept in your browser's own storage. We use no tracking or advertising cookies.

Processors and transfers

Some processors are in the United States. Transfers rely on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, and to data portability. Requests: info@nooalab.fi. You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

Security

Connections are encrypted (HTTPS). Sign-in codes and session tokens are stored as hashes. Access to the production environment is restricted.