Privacy Policy

Data controller

Controller: NETSYNTAX SL · NIF B76204783 · Calle Tajaste 5, 35110, Las Palmas, España · [email protected] · https://eatoria.app

Legal framework

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPD-GDD).

Data we collect

When you register or use the dashboard, we may process:

• Identity and contact data (name, email) via our authentication provider
• Restaurant profile data (name, address, branding, menu content)
• Billing data handled by Stripe (we do not store full card numbers)
• Technical logs (IP address, browser type, timestamps) for security
• Support conversations and the files you attach to them (images and PDF documents), and menus you send us to set up
• Push-notification subscriptions for the devices where you enable them
• Language and dashboard preferences
• Where you use the reservations module: your guests' booking and contact data, which we process on your behalf (see “Role as processor”)
• On eatoria.app: usage data via Google Analytics (pages visited, device, approximate region)

Purposes and legal basis

We use your data to provide and improve the Service, manage trials and subscriptions, authenticate users, respond to support requests, set up menus you ask us to, run AI-assisted import and translation features you use, and comply with legal obligations.

We also send service communications — about your trial ending, your subscription, security, replies to your support requests and the status of a menu set-up — on the basis of contract performance. Commercial communications require a separate lawful basis and always include an opt-out.

Legal bases include contract performance, legitimate interest (security, product improvement) and consent where required (e.g. optional marketing).

Public menu visitors

People who scan a restaurant’s QR code and view a public menu are not asked to create an account. Public menu pages do not use advertising cookies or profiling trackers.

Restaurant owners may receive aggregated analytics (such as menu or dish views) that do not identify individual visitors.

Retention

We keep account data while your trial or subscription is active. When a trial ends without a subscription, or a subscription is cancelled or remains unpaid, the workspace's menu content and uploaded images are deleted 15 days after the public menu is suspended. Account identifiers, billing records and support history are retained for up to 12 months after closure, or longer where the law requires it (for example billing, tax or dispute records).

Files attached to support conversations and menus sent for set-up are kept with the workspace and deleted with it. You may request deletion of your account at any time by contacting [email protected].

Processors and transfers

We use the following sub-processors: Clerk (authentication), Stripe (payments and invoicing), Cloudflare (content delivery, security and storage of uploaded images and documents), Microsoft 365 (transactional email), Crisp (support chat on the website and dashboard), OpenAI (AI-assisted menu import, set-up and translation, via API and without use of your data for model training), Google (business reviews shown on your public page and, only after consent, website analytics). Integrations you enable yourself — Stripe Connect or Redsys for booking deposits, Meta WhatsApp Business for guest messages — run under your own accounts with those providers.

The Service and its database are hosted on infrastructure operated via netsyntax.es at the NTT FRA1 datacenter in Frankfurt, Germany (DE-FFM2) — a Tier III+ facility within the EU/EEA. Account and menu database data is stored within the European Economic Area (EEA).

Some providers (such as Cloudflare, OpenAI, Crisp, Microsoft and Google) may process data outside the EEA under appropriate safeguards, including the European Commission’s Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Role as processor

For restaurant account and billing data, NETSYNTAX SL acts as data controller. For the personal data of your guests that you manage through the Service — in particular bookings, guest lists, deposits and booking communications in the reservations module — you are the controller and Eatoria acts as your processor, on your instructions and only to provide the Service. A data processing agreement can be provided on request at [email protected].

Web analytics

Our marketing website and dashboard use Google Analytics only after the visitor provides consent through the cookie banner. Google may set cookies and process usage data (such as pages visited, device type and approximate location) according to its own privacy policy.

Public restaurant menu pages viewed by diners do not load Google Analytics. For all privacy and data requests, contact [email protected].

Your rights

You may exercise rights of access, rectification, erasure, restriction, portability and objection by emailing [email protected]. We may request information to verify your identity.

You may lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Security

We apply appropriate technical and organisational measures to protect personal data. Infrastructure runs in a Tier III+ EU datacenter (NTT FRA1, Frankfurt). No method of transmission over the Internet is 100% secure.

Changes

We may update this policy. Material changes will be reflected on this page with an updated date.

Contact

Privacy enquiries: [email protected]