Privacy policy

1. The controller

[FIRMA], with its registered office at [ADRESA], tax identification number [CUI], email [EMAIL].

2. What data we process

Account: name, email address, password (stored only as a hash), role in the restaurant and the language chosen for the panel.

Billing: company name, address, VAT number and subscription history. Card details are entered directly with Stripe; we do not see or store them.

Messages sent through the contact form or by email: name, email address, restaurant and the content of the message.

Technical data: IP address and server logs, used for security, limiting abuse and troubleshooting.

3. Cookies

The website and the public menus do not use tracking cookies, advertising or analytics tools. The restaurant panel and the order tablet use only cookies that are strictly necessary for authentication (the account session, the paired tablet and the staff session).

4. Why, and on what legal basis

To create and manage your account and provide the service: performance of a contract (Article 6(1)(b) GDPR).

For invoicing and accounting records: legal obligation (Article 6(1)(c) GDPR).

For security, abuse prevention and replying to messages: our legitimate interests (Article 6(1)(f) GDPR); for conversations before a contract, steps taken at your request (Article 6(1)(b) GDPR).

5. How long we keep data

Account data: for as long as the account is active and for 90 days after the subscription is cancelled. Billing documents: for as long as accounting law requires. Contact messages: up to 12 months. Technical logs: up to 30 days, unless they are needed to investigate an incident.

6. Who we share data with

We use providers that process data on our behalf under contract: OVH (server hosting, in the European Union), Stripe (subscription payments and invoicing), [FURNIZOR_EMAIL] (sending emails) and Anthropic (automatic translation of menu texts, which contain no personal data).

We do not sell personal data and we do not use it for advertising.

7. Transfers outside the EEA

Some providers (for example Stripe or Anthropic) may process data outside the European Economic Area (EEA). In these cases, the transfer is based on a European Commission adequacy decision or on standard contractual clauses.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw your consent where processing is based on consent. You can write to us at [EMAIL]; we will reply within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (in Romania, the ANSPDCP; elsewhere, the authority in the country where you live or work).

9. Security

We use encrypted connections (HTTPS), passwords and PINs are stored only as hashes, access to each restaurant's data is checked on the server with every request, and the database is backed up daily.

10. Restaurant guests

A guest who scans a QR code does not need an account, and we do not ask for their name, email or phone number. The order is linked to the table and to a random identifier kept in their browser only for the duration of the visit. Allergen filters stay in the browser and never reach us.

For this data, the restaurant is the controller. Questions about it should be addressed to the restaurant; we help the restaurant answer them.

11. Changes

We may update this policy. The date of the last update appears at the top of the page, and we notify account holders of significant changes by email.