How we treat
your information.

Casa Manila Restaurant ("we", "us") operates the website at casamanila.ca and the related ordering, reservation, catering, and meal-plan services. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario's privacy laws. If you visit from the European Economic Area or the UK, we also honour the rights afforded by the GDPR / UK GDPR.

Casa Manila is owned and operated by Casa Manila Restaurant Inc. ("Casa Manila"), a privately-held Ontario corporation, with its address at 508 Danforth Avenue, Toronto, ON M4K 1P6. For privacy questions or requests, contact our Privacy Officer at privacy@casamanila.ca or by phone at (416) 443-9654.

We collect only what we need to serve you:

• When you reserve a table: name, email, phone number, party size, date/time, optional notes (e.g., allergies, occasion).
• When you place an online order: name, email, phone, billing/shipping address, the items in your order, and pickup/delivery preferences. Payment card details are collected directly by our payment processor (Stripe) and never stored on our servers.
• When you submit a catering inquiry: company name, contact name, email, phone, event date and headcount, and any notes you provide.
• When you create a customer account: email, name, optional phone, and your authentication identifier from Google or Firebase Authentication. We never see your password.
• When you subscribe to a meal plan: in addition to the above, we record your delivery preferences and dietary notes.
• Automatically: basic technical information such as IP address, device type, browser, and pages visited. This is used for security and to improve the site. We do not use third-party advertising trackers.
• From the in-restaurant point-of-sale (POS): if you previously dined or ordered with us, your contact information may be on file from our POS system. We use it only to operate your account, deliver orders, and (with your consent) send occasional updates.

We use your information to:

• Process orders, reservations, and catering inquiries.
• Send transactional messages: order receipts, reservation confirmations and reminders, and quote follow-ups.
• Operate your account and meal-plan subscription.
• Improve the website, the menu, and our service.
• Comply with our legal and tax obligations under Canadian and Ontario law.
• If you opt in, send occasional marketing emails about new menu items, seasonal promotions, or events. You can unsubscribe at any time using the link in every marketing email.

We do not sell your personal information to anyone.

We share your information only with the service providers we need to operate the business, and only for those specific purposes:

• Stripe Payments Canada Ltd. — payment processing. Stripe's privacy notice.
• SMTP2GO (operated by Smartserv Internet Services Pty Ltd, Australia) — transactional email delivery. SMTP2GO's privacy notice.
• Google LLC and its affiliates — Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Run hosting, and Vertex AI (Gemini) for the AI-assisted menu editor. Data is processed in Google Cloud's northamerica-northeast2 (Montréal) region for Firestore and us-central1 for the SSR runtime and Vertex AI. Google's privacy policy.
• Twilio Inc. — SMS for reservation confirmations and reminders (planned). Twilio's privacy notice.
• Government agencies — only when required by law (e.g., tax records, court orders, lawful production orders).

We require all our service providers to use your information only for the purposes for which we engaged them, and to keep it secure.

Some of our service providers store or process information outside Canada (notably the United States, EU, and Australia). When we transfer information across borders, we rely on contractual safeguards and the legal frameworks recognized under PIPEDA. By using the site you acknowledge that your information may be processed in those jurisdictions and may be subject to lawful access requests by foreign governments.

We retain your information only as long as we need it for the purposes described above:

• Reservations: 24 months after the booking date.
• Orders: 7 years (Canada Revenue Agency tax record requirement).
• Catering quotes / leads: 24 months from the inquiry date.
• Customer accounts: until you delete your account, plus a short retention period to handle disputes and chargebacks.
• Marketing consent: until you withdraw it.

After these periods, we delete or anonymize the information.

You may, at any time:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information, subject to legal record-keeping obligations.
• Withdraw consent for marketing emails, by clicking unsubscribe in any marketing email or by contacting us.
• Port your information to another service in a machine-readable format.
• Lodge a complaint with the Office of the Privacy Commissioner of Canada or, for EU residents, your local supervisory authority.

To exercise any of these rights, email privacy@casamanila.ca. We will respond within 30 days.

We protect your information with technical and organizational safeguards, including encryption in transit (TLS) and at rest, role-based access control, audit logging, and provider-vetted infrastructure (Google Cloud, Stripe). No method of transmission over the internet is 100% secure; if we learn of a breach affecting your information, we will notify you and the Privacy Commissioner as required by PIPEDA.

We use a small number of cookies:

• Essential cookies for authentication (your sign-in session) and the shopping cart. Without these, the site does not function.
• Preference cookies for things like remembering you accepted this notice.
• Analytics (only with your consent). If you click “Accept” on the cookie banner, we use Google Analytics 4 to understand how the site is used (pages visited, rough location, device) so we can improve it. IP addresses are anonymized. If you choose “Essential only” — or ignore the banner — analytics cookies are never set (Google Consent Mode keeps them denied). You can withdraw consent any time by clearing this site’s cookies.
• No advertising cookies, no ad personalization. We never run ads and keep Google’s ad-storage and ad-personalization signals denied at all times.

Our services are not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have collected information from your child, contact us and we will delete it.

We may update this policy as the business, the law, or our service providers change. The "last updated" date at the top reflects the most recent revision. If we make material changes, we will notify customers with active accounts by email at least 14 days before the changes take effect.

Questions, requests, or complaints about your privacy should go to:

Casa Manila — Privacy Officer
508 Danforth Avenue, Toronto, ON M4K 1P6
privacy@casamanila.ca
(416) 443-9654