The questions that operators should ask every vendor
4 Min Read
Getty Images
Loyalty programs used to be about points. Today, the name of the game is customer data: scale, quality, and ownership. You know the saying: “Data is the new oil.” And it’s true: Restaurants’ own personalization engines that drive incremental sales are fueled by consumer data. But if restaurants are not careful, their data could be powering something else altogether: their next competitor.
It’s a story all too familiar for every restaurant that has grown dependent on third-party delivery. The marketplace, not the restaurant, owns the customer relationship and all the data about their purchasing. Sure, they sometimes share that data with the restaurant. But sharing is different from owning; only owning lets you direct the next purchase and control the economics.
Every AI tool that touches your guest data is learning from it. The one taking a phone order. The one timing an offer to a lapsed guest. The one managing inventory or building the schedule. All of them get better on your data. And that’s fine… so long as you trust them to use what they learn for your benefit, not just their own.
Amid this backdrop and growing pressure from investors to be “AI native,” many software companies are asserting more control and ownership over data, especially customer data, that really belongs to the restaurant that worked hard to build that relationship. At Thanx, we’re going the other direction, making it unequivocal that restaurants own their data.
-
In 2025, we shut down a consumer-facing “Thanx Network” app that brought many merchant loyalty programs into one place and dismantled the cross-merchant network profiles the app created.
-
This year, we helped brands on Thanx migrate to merchant-specific privacy policies they fully owned, not the Thanx privacy policy, which gave us control (in exchange for the brand not having to talk to a lawyer). This added friction to deployments with time-strapped operators, but we believe guests should agree to your terms, not ours. Ultimately, we transitioned hundreds of restaurant brands in just weeks.
-
And finally, we made all customer data fully portable in both directions with our Data Continuity Service: Import your full customer history when you launch on Thanx, take all of it with you if you leave. We’re not talking SFTPs here either; Thanx Connex provides near-real-time programmatic access directly into any data lake or storage system (e.g., Snowflake, BigQuery, Redshift, Databricks, etc.).
California’s CCPA is the strictest consumer privacy standard in the U.S.; plenty of restaurants outside California still consider it the gold standard. And CCPA draws a hard line: The business that “consented” the guest is the one who controls that customer relationship. Everyone else who touches the data is a “service provider,” allowed to use the data only on that business’s behalf. For a restaurant, the owner should always be the restaurant.
As our Chief Data Officer Aaron Newton puts it: “As a service provider to our brands, Thanx has no ownership of our merchants’ consumer relationships or data. We’re no different than Amazon, which hosts the infrastructure on which this data lives.”
Every industry is dealing with this, but restaurants are more exposed than most. A lot of the software that runs your business also runs a consumer app or website where guests browse restaurants, not just yours. Delivery apps. Reservation and waitlist apps. Ordering aggregators. Payment and wallet apps with a “discover” tab. Gift card marketplaces. Even some POS and ordering middleware providers now ship their own branded guest-facing apps and marketplaces.
You don’t have to imagine how this plays out. In March, Uber Eats raised its Marketplace Fees with little notice; even restaurants with custom-negotiated rates saw fees climb. If your vendor is also selling directly to a consumer audience, one they legally own, they don’t need your permission to change the terms of that relationship.
The question that settles it: If we leave, do you keep our customer data? If the answer is yes, even when you also get a copy, that vendor isn’t a service provider. They’re an owner. Owners can market other restaurants to your guests, charge you a fee to reach a guest you brought them, or sell that data downstream, including to a competitor.
If you’re not sure where you stand on customer data — owner or recipient — in any relationship, ask the partner these three questions:
-
Under the CCPA framework, are you our service provider, or a business in your own right with our guests? A good answer is “your service provider — the relationship is yours,” with no hedging. Watch out for “joint ownership,” “shared data,” or a long pause.
-
What can you do with our customer data while we work together? A good answer is a short, specific list limited to running your program and making the technology better on your behalf (including across all customers). Watch out for any right to resale, or share even if “aggregated” or “anonymized” beyond their product.
-
If we leave, can we take all of it, and will you delete your copy? A good answer is “yes” to both. Watch out for a vendor who will happily send you a file but quietly keep theirs too.
If third-party marketplaces have taught the restaurant industry one thing, it’s that “possession is nine-tenths of the law” applies to customer data more than ever. You either own your customers or you don’t. In 2026, there is no middle ground.
