How to Build a Restaurant Customer Database You Actually Own

Why owning the customer list is the only durable growth lever

A restaurant on DoorDash for two years can serve the same person 40 times and still not be allowed to email them. That is not an oversight; it is contract design. The marketplace keeps the contact record and rents you access to it, one paid order at a time. Building a customer database you actually own is the work that flips that economic equation.

What marketplace apps will and will not give you

Both DoorDash and Uber Eats publish what data merchants can pull from their portals. The pattern is consistent: order metadata yes, customer identity no.

Sources: DoorDash Merchant Portal documentation and Uber Eats Merchant Resource Center. Both platforms offer paid in-app advertising as their substitute for the contact information they withhold.

That is the gap. Every dollar you spend acquiring a marketplace customer goes back to the marketplace when you want to reach that same customer again. The fix is not to leave the apps; it is to build a parallel first-party list. For the strategic shift, see our delivery app dependency playbook and the customer data ownership guide.

The retention math nobody runs

A short LTV calculation sets the prize. Most independents underestimate this number by a factor of 5 to 10.

The Bain finding is the load-bearing one. A 5 percent improvement in customer retention can grow profits 25 to 95 percent because returning diners spend more, refer more, and cost almost nothing to serve. You cannot retain a customer you cannot contact, and you cannot contact a customer who lives in someone else's database.

Capture channels that actually fill the list

There is no single magic channel. The restaurants who hit 1,000 active opted-in contacts within 90 days are running 5 to 7 channels in parallel, each feeding the same source-of-truth contact record.

Source: aggregated benchmarks from Klaviyo restaurant industry data, Attentive SMS benchmarks, and Statista QR code scan adoption data.

QR-driven capture has hardened into a real channel. US QR code scans nearly doubled between 2022 and 2024 per Statista, which means a sticker on a takeout bag is no longer a novelty; it is a default behavior. For a deeper look at the operational side, omnichannel ordering across channels covers the full surface area.

Compliance is not optional, and it is not hard

Four laws set the floor for every restaurant marketing list in the US, plus GDPR if you serve any EU residents.

Sources: FCC TCPA hub, FTC CAN-SPAM compliance guide, California Attorney General CCPA portal, and the European Commission GDPR rules for business.

The FCC's one-to-one consent rule, which took effect in 2025, ended the practice of buying or sharing SMS lists across business affiliates. Each restaurant must collect its own consent, on its own form, with its own brand named in the consent language. Klaviyo, Attentive, and DirectOrders all updated their default templates to comply, but anyone running a custom signup form should re-read the consent copy.

Double opt-in, in plain English

Double opt-in is the simplest way to satisfy TCPA, GDPR, and most state laws in one motion. The customer signs up once, then confirms via a second action before they enter your active list.

A clean SMS double opt-in flow looks like this:

1. Customer enters phone number on the website checkout page or scans a QR with the consent form.

2. The form captures: timestamp, IP address, source URL, exact consent text shown.

3. System sends a confirmation SMS: "Reply YES to receive marketing texts from [Restaurant]. Msg & data rates may apply. Reply STOP anytime."

4. Customer replies YES. The contact moves from pending to active.

5. The platform stores the YES timestamp on the contact record forever.

The auditable record is the part that matters legally. Most modern marketing platforms emit a webhook payload on confirmation. A typical structure looks like this:

{
  "event": "sms_consent_confirmed",
  "timestamp": "2026-04-28T15:42:08Z",
  "contact_id": "ct_8a2f91c4",
  "phone": "+15551234567",
  "consent_text": "Reply YES to receive marketing texts from Joe's Pizza...",
  "source_url": "https://joespizza.com/checkout?step=receipt",
  "ip_address": "73.118.44.201",
  "user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4)",
  "double_opt_in": true,
  "first_optin_timestamp": "2026-04-28T15:39:22Z",
  "confirmed_at": "2026-04-28T15:42:08Z"
}

Save these payloads to a contact log table. If a regulator or plaintiff's lawyer ever asks how you obtained consent, you produce the row. That is the entire defense.

What to capture, in priority order

Email and phone are the unlock. Everything else compounds value over time.

Resist the urge to ask for everything at once. A long form on day one drops conversion 30 to 50 percent. Ask for email or phone at signup; collect the rest progressively across the next 3 to 5 interactions.

Email and SMS benchmarks worth aiming for

Restaurant lists outperform most industries because the offer is universally desired (food) and the buying cadence is fast.

Source: Klaviyo benchmarks and Attentive SMS benchmarks.

If your list is below these numbers, the issue is almost always one of: poor segmentation, list rot from dormant addresses, or sending the same offer to everyone. The fix order is segmentation first, frequency second, creative third.

Tools, ranked by where you actually are

Different stages of the database journey call for different stacks. Pick by your monthly send volume and how much segmentation you need.

DirectOrders includes capture, double opt-in, segmentation, and a built-in email and SMS sender in the flat monthly fee. For most independents under 5,000 contacts, that is the right starting stack. Operators with 5,000 plus contacts and multiple locations usually graduate to Klaviyo for the depth of flow templating. See the marketing feature page for the capture and send architecture.

What to do with the list once it exists

A clean list is leverage; an empty list is a hobby. The flows that move revenue inside the first 90 days are predictable, and each one targets a specific moment in the customer relationship rather than blasting the same offer to everyone.

1. Welcome series. Three messages over 7 days for new opt-ins. Message one is a brand introduction with one strong photograph; message two is a single-use direct-order discount of 10 to 15 percent; message three reinforces what makes the restaurant worth coming back to. Klaviyo's hospitality benchmark for welcome flows shows roughly 40 percent open rates and a click-through that triples a generic batch send.

2. Abandoned cart. SMS within 30 minutes if the customer started checkout and left. Restaurant abandonment runs 60 to 75 percent because takeout decisions are interrupted by phone calls and chaos. A single recovery message converts 8 to 14 percent of abandoners on Attentive's reported numbers.

3. Reactivation. Email at day 30 of inactivity, SMS at day 45, final win-back offer at day 60. The progression matters: starting with a softer email respects subscriber attention, then escalates to a higher-margin SMS only for the customers who did not respond.

4. Birthday automation. Email a free dessert or appetizer code in the birthday week. Capture birthdays during loyalty signup, not at first opt-in. Asking for too much identifying information up front collapses signup conversion.

5. Weekly digest. One email per week with a chef's special, a behind-the-scenes photo, and a soft promo code. The cadence trains subscribers to expect the message; the photo content is what keeps unsubscribes low.

6. Segmented campaigns. Veg-leaning customers get the new plant-based menu; family-pizza customers get the family-bundle test. Segmentation is what separates a 1 percent campaign conversion from a 5 percent campaign conversion.

7. Catering and large-order outreach. Tag customers whose tickets exceed a threshold (commonly $80 to $120) and run a quarterly catering email to that segment with corporate-order pricing.

For tactical depth on each channel, the restaurant email marketing guide and SMS marketing for restaurants cover send cadence, segmentation, and creative templates.

The 90-day database build

A realistic plan for an independent starting from zero. The work is sequential because each phase produces the data the next phase needs.

Days 1 to 30: foundation

• Turn on direct ordering with email and phone capture at checkout. Make the marketing opt-in checkbox visible but unchecked by default; pre-checked boxes fail GDPR and are increasingly hostile to email deliverability.
• Write and publish a privacy policy listing what you collect, why, the retention window, and how a customer can request deletion. A single linked page satisfies the disclosure requirement under CCPA, CPRA, and most state laws.
• Set the consent checkbox copy to comply with the FCC one-to-one rule. The text should name the restaurant explicitly and describe the type of message ("marketing texts about specials and new items").
• Print packaging inserts for every marketplace order with a 10 percent direct discount QR code. A 1,000-card print run typically runs $40 to $80 from a local printer; the unit economics work even at a 5 percent conversion rate.
• Add a QR table tent on every dining-room table that lands on the direct site, not a static menu PDF. The point is to build the pathway, not the convenience.

Days 31 to 60: activation

• Launch the welcome series and abandoned-cart flow. Both should be live before any campaign sends start; new contacts deserve a welcome before they start receiving promos.
• Run a one-time SMS to past direct-order customers reactivating with a 15 percent code. Keep the message under 160 characters to avoid SMS segmentation costs.
• Add a Wi-Fi captive portal in the dining room with email signup as the toll. A free 2-hour Wi-Fi session in exchange for an email is a fair exchange most diners accept.
• Wire Google Business Profile so the order button points at the direct site rather than a third-party redirect. This single change can shift 5 to 12 percent of "near me" search traffic from marketplace orders to direct.
• Start tracking attribution: tag every signup with its source (checkout, QR, insert, captive portal, referral) so the channel ROI conversation has data.

Days 61 to 90: scale

• Launch loyalty (points or visit-based; either works). The mechanic matters less than running it consistently.
• Start segmented weekly campaigns to active subscribers. The first segments to build are: ordered in last 30 days, ordered 30 to 90 days ago, ordered 90+ days ago, never ordered direct (still on the marketplace).
• Audit list health, suppress bounces, build a top-20-percent VIP segment. The Pareto curve in restaurant data is steep: roughly 20 percent of customers drive 60 to 70 percent of revenue.
• Decide whether to upgrade from the bundled ESP to Klaviyo at the 5,000-contact mark. The trigger is segmentation depth, not list size alone.
• Document the data ownership story for any vendor change: every contact must export with consent timestamp, source, and confirmation status intact, or the migration breaks compliance.

For platform selection beyond marketing tools, the restaurant marketing trends 2026 piece covers what is changing in the channel mix and where to weight investment next year.

Bottom line

Every order on a delivery app is a customer you are renting at 25 to 30 percent commission. Every direct order, captured under proper consent, is a customer you compound for 30 months at no incremental marginal cost. Build the list, run the flows, mind the compliance trail, and the math works without heroics. Skip the list, keep paying rent.

For the underlying platform that captures customers automatically and sends compliant email and SMS in one bill, see DirectOrders pricing and the marketing feature page.

See how DirectOrders captures customer data automatically on every order, runs TCPA-compliant double opt-in by default, and sends segmented email and SMS without a separate ESP. Book a demo or run the numbers on the commission calculator.