Privacy

Privacy Policy

How we collect, use, and protect your information — written to be readable, not just legally defensible.

Effective date: November 5, 2026 · Last updated: October 18, 2026

Section 10 promises 30 days' notice of a material change, which is why the effective date is later than the update date. This revision adds the assistant conversations, voice input, catering and event-space enquiries, and event attendance that the previous version predated.

1. Who we are

"DealsBanana" ("we", "us", "our") refers to Manviga LLC, a Texas limited liability company operating the website dealsbanana.com and related services. We are the data controller for personal information collected through our services.

2. What we collect

You give us

Account info: name, email, phone (optional), password (hashed), role (customer / vendor / admin), and birthday month and day if you add them
Diner info: dietary preferences, favorited restaurants
Coupon info: coupons you claim and their redemption status
Assistant conversations: what you type to Manvi, our assistant, and the replies, kept so a conversation survives a page reload and so we can see where the assistant answered badly. Where you use voice input, the audio is transcribed to text and we keep the text.
Catering requests: your event date, guest count, budget, cuisine and notes. Your name and contact details are withheld from caterers until a booking is confirmed.
Event-space enquiries: the date, guest count, occasion and any notes, with your name, email and phone — these go to the venue you asked, so it can reply to you.
Events you book: which event, how many seats, and whether your pass was scanned at the door.
Payment records for anything you buy through us: what was bought, the amount, and whether it was refunded. Card numbers never reach our servers.
Approximate location, when you share it or type a city — sent with your searches and chats so nearby results come first, and remembered in your browser for 30 days. It is not tracked in the background.
LunchBox orders: your office building, what you ordered, and when the box was delivered and collected. Your name and building are shared with the restaurant and the driver delivering it.
Driver location (LunchBox drivers only): while a driver has a delivery run open, their phone sends its location about every 30 seconds. We keep only the latest point, show it to the customers on that run, and clear it when the run ends. It is never collected outside a run.
Notifications you turn on: a web-push token for the device you allowed (removable at any time in your browser), and a verified phone number if you choose text updates (reply STOP to end them).
How you found us: the campaign link that brought you (for example a newsletter), attached to your sign-up.
Vendor info: business name, address, hours, subscription plan, coupons, uploaded compliance documents
Communications: emails, support tickets, review text

We collect automatically

Device + browser type, operating system, IP address
Pages viewed, search queries, timestamps
Cookies and similar technologies (see Cookie Policy)

From third parties

Google Maps Platform (Places, Geocoding, Routes, Time Zone and maps) — business data when vendors register, address suggestions, and drive times and maps for LunchBox delivery. Addresses and coordinates are sent to Google for these lookups
OpenStreetMap (Nominatim) — turning a typed city or postcode into an approximate location
Payment processor (Stripe) — last 4 digits of card, transaction confirmation; full card data is never stored on our servers
Google Analytics 4 — on unless you turn it off or your browser sends Do Not Track / Global Privacy Control (see the Cookie Policy)
Email provider (Resend) — delivery status of the emails we send you: delivered, opened, bounced
SMS and WhatsApp provider (Twilio), where those channels are enabled — delivery status of messages we send you
AI providers — to answer you, the text of a conversation with Manvi is sent to an AI model provider (currently Groq, Cerebras, OpenRouter, Google or Anthropic, depending on the request). We do not attach your name or account details, and before a message leaves our servers we mask phone numbers, card numbers, street addresses and email addresses in it. Other text features (coupon drafts, menu and photo descriptions, images a restaurant asks us to generate) use the same providers plus OpenAI, Cloudflare and Pollinations for images and search.
Error monitoring (Sentry), where enabled — technical details of a crash, without personal data
Facebook and Instagram (Meta) — when a restaurant connects its accounts, we publish its posts there; no diner data is sent

3. How we use it

To provide the service: publish vendor coupons, let diners claim and redeem them in person, process vendor subscriptions, handle support
To improve the service: analyze aggregate usage to understand which features matter, fix bugs
To keep things safe: detect fraud, enforce our terms, comply with legal requests
To communicate: transactional messages (coupon and redemption confirmations), service updates, optional marketing (you can opt out)

4. Who we share it with

Restaurants — for a coupon, only what is needed to honour the redemption: the coupon claimed and your name at the counter
A venue you enquire with — an event-space enquiry is sent to that venue with your name, email, phone and what you asked for. That is the point of the enquiry; the lead is not sold or passed to any other venue.
A caterer you book — your event details go out with the request so caterers can quote, and your contact details follow only when you confirm a booking.
A restaurant hosting an event you booked — your name and seat count, so the door knows to expect you.
A restaurant and driver delivering your LunchBox — your name, building and order, so the right box reaches the right reception.
Service providers — payment processor (Stripe), hosting (Hostinger), email (Resend) and SMS (Twilio) providers, Google Maps Platform, AI model providers, and analytics if you accept it
Legal — when compelled by court order or to protect our rights, our users, or the public

We do not sell personal information. We do not share data with third-party advertisers for cross-site targeting.

5. How long we keep it

Active account data: as long as your account exists
Coupon claim, redemption, and subscription history: 7 years for tax + accounting compliance
Reviews + public content: indefinitely (you can request deletion of your specific reviews)
Marketing emails: until you unsubscribe
Assistant conversations: kept while your account exists, so you can see your own history; deleted with your account
Driver location: only the latest point, cleared when the delivery run ends
Catering and event-space enquiries: kept with the booking record they belong to, under the same 7-year rule as other payment history where money changed hands
Server logs: 90 days

6. Your rights

If you're in the EU/UK (GDPR)

Access — request a copy of your data. We assemble this by hand on request; there is no self-service export yet
Rectification — correct inaccurate data
Erasure — delete your account yourself from your account settings, or ask us. Deleting removes your name, email, phone, saved addresses, Manvi conversations and remembered preferences, and notification subscriptions. Records of payments, claims and orders are kept (without your name) for the 7-year tax rule
Restriction — pause processing
Portability — receive your data in a machine-readable format
Object — to processing based on legitimate interests
Withdraw consent — for anything you opted in to

If you're in California (CCPA / CPRA)

Right to know what personal information we collect, use, disclose
Right to delete personal information
Right to correct inaccurate personal information
Right to opt out of "sale" or "sharing" (we don't sell — but you can still submit the request)
Right to non-discrimination for exercising your rights

To exercise any of these rights, send us a message via the contact form from the email associated with your account. We respond within 30 days (45 for complex requests).

7. Security

We use industry-standard technical safeguards: HTTPS/TLS for all data in transit, encryption at rest for sensitive fields (passwords, identity documents), role-based access for our team, audit logs for admin actions. No system is impenetrable; we will notify affected users of any breach involving their data within 72 hours of confirmation.

8. Children

DealsBanana is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe we have, contact us via the contact form and we will delete it.

9. International transfers

DealsBanana is operated from the United States. If you access from outside the US, your data is transferred to and processed in the US.

10. Changes to this policy

If we make material changes, we'll notify active users by email at least 30 days before the change takes effect. Non-material updates (typo fixes, clarifications) take effect immediately and are reflected in the "Last updated" date above.

11. Contact

Questions about privacy? Use our contact form and select Legal / privacy.