Last updated 6 October 2026. Written to be read, not to be skipped. Questions or requests: hello@nomback.com.
Who we areIf we emailed you about your restaurantIf you're a partnerIf you're just visitingWho else touches itThe automated checkHow long we keep itYour rightsSecurityChanges
Nomback builds commission-free ordering and loyalty apps for independent restaurants, and runs a partner program that pays people for introducing us to restaurant owners. We operate in the United States only. We are the business responsible for the personal information described here (a "controller", if you've read other policies).
Nomback is a sole proprietorship operated by Daniel Lomonaco, doing business as Nomback, in Pennsylvania, USA. Nomback is a trade name, not a separate company, so the person legally responsible for everything on this page is named above.
Daniel Lomonaco, d/b/a Nomback
[MAILING ADDRESS - PO BOX]
hello@nomback.com
You probably didn't sign up for anything. Here is exactly what happened and what we hold.
Someone in our partner program showed you a demo of a restaurant ordering app, in person or over the phone, and you gave them your email so we could follow up. They typed your details into their dashboard. Our partners are required to have your agreement before submitting you, and we reject submissions where that's in doubt. If a partner submitted you without asking, tell us: that referral gets declined and the record deleted, and it counts against that partner.
We email you about the app the partner showed you: what it costs, what it does, and a link to a demo. If you don't reply, a short follow-up sequence runs and then stops. That's the whole purpose. We do not add you to a newsletter, we do not sell or rent your address, and we do not use it to market anything other than the thing you were shown.
Reply "stop" to any email from us, use the unsubscribe link in it, or write to hello@nomback.com. We stop immediately and always within 10 business days, which is the deadline federal law gives us. If you also want the record gone rather than just the emails stopped, say "delete" and we'll delete it within 30 days and keep only a suppression entry (your email address, nothing else) so no partner can submit you again by accident.
Run your account, check and process your referrals, calculate what you're owed, pay you, and email you about your own account and referrals. If we ever send you something that isn't about your own account, it will have an unsubscribe link and turning it off will not affect your payouts.
Row-level security in the database means a partner account can read its own rows and nothing else. You cannot see other partners, their referrals or their earnings. The administrator can see everything, because someone has to check referrals and send the money.
| Who | What they do | What they see |
|---|---|---|
| Supabase | Database and sign-in | Everything stored: partner accounts, referrals, owner contact details, payout records |
| Resend | Sends our email | Recipient addresses and the contents of the messages |
| Cloudflare | Hosts and serves the site | Request logs, including IP addresses |
| Whop | Takes restaurant payments, pays partners, files partner tax forms | Restaurant checkout details on Whop's side; your Whop username and the amounts we pay you |
| Anthropic | Powers the automated referral check | The restaurant's business details and the email domain, see below |
| Google Fonts | Serves the typefaces | Your IP address and browser, at page load |
Data is stored on servers in the United States. Beyond this list, we disclose personal information only when the law requires it, or if the business is ever sold, in which case whoever buys it inherits this policy and we'll say so before anything moves.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California and other state privacy laws. We never have.
When a partner submits a restaurant, an automated check runs before a person looks at it. It searches public sources (the restaurant's website, its Google listing, delivery-app listings) to work out whether the place is real, currently open, independently owned rather than a chain or franchise, and whether the contact email plausibly belongs to the owner. It produces a score, a suggested verdict and a short written summary. It uses Anthropic's Claude model together with web search.
| What | How long |
|---|---|
| Partner account and referral history | While the account is open, then 12 months, unless you ask sooner |
| Payment records | 7 years, because tax law requires it |
| Restaurant owner contact details, declined referral | Deleted within 30 days of the decline |
| Restaurant owner contact details, accepted, no reply | 12 months after the last email, then deleted |
| Restaurant owner contact details, became a customer | Kept as customer records for as long as they're a customer |
| Suppression list (people who asked us to stop) | Kept indefinitely, on purpose; it's the only way to honour the request |
| Sent-email log | 24 months |
Twenty US states have comprehensive privacy statutes, and nearly all apply only above a threshold of 35,000 to 100,000 residents' data a year or around $25 million in revenue. Nomback is well under every one of those. We give you the rights below anyway, to anyone in any state:
Email hello@nomback.com from the address we have on file, or tell us enough to find you. We reply within 30 days. No charge, no lawyer needed.
Everything runs over HTTPS. The database uses row-level security, so accounts read only their own rows. Administrator access is limited to one account and signs out after 30 minutes idle. The site sets a strict content security policy that blocks injected scripts and third-party code. The publishable key shipped in the page is designed to be public; the row-level security rules are what protect the data.
If we ever have a breach affecting your personal information, we will tell you and the relevant state authorities as quickly as we can, as every state's breach law requires, with what happened and what to do about it.
This is a business program for adults. We don't knowingly collect anything from anyone under 18, and if we find out we have, we delete it. Partners must be 18 or older.
If we change this, the date at the top changes and partners see a note in the dashboard. If a change is significant (a new company touching the data, a new purpose) we'll email partners before it takes effect.
Related: Partner terms.
Nomback · nomback.com · Partner terms