Privacy Policy

Data controller

Controller: NETSYNTAX SL · NIF B76204783 · Calle Tajaste 5, 35110, Las Palmas, España · [email protected] · https://eatoria.app

Legal framework

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPD-GDD).

Data we collect

When you register or use the dashboard, we may process:

• Identity and contact data (name, email) via our authentication provider
• Restaurant profile data (name, address, branding, menu content)
• Billing data handled by Stripe (we do not store full card numbers)
• Technical logs (IP address, browser type, timestamps) for security
• Support communications you send to us
• On eatoria.app: usage data via Google Analytics (pages visited, device, approximate region)

Purposes and legal basis

We use your data to provide and improve the Service, manage subscriptions, authenticate users, respond to support requests and comply with legal obligations.

Legal bases include contract performance, legitimate interest (security, product improvement) and consent where required (e.g. optional marketing).

Public menu visitors

People who scan a restaurant’s QR code and view a public menu are not asked to create an account. Public menu pages do not use advertising cookies or profiling trackers.

Restaurant owners may receive aggregated analytics (such as menu or dish views) that do not identify individual visitors.

Retention

We keep account data while your subscription is active. After account closure, we retain data for up to 12 months unless a longer retention period is required by law (for example billing, tax or dispute records).

You may request deletion of your account by contacting [email protected].

Processors and transfers

We use sub-processors including Clerk (authentication), Stripe (payments) and Google Analytics (website usage statistics on eatoria.app, only after consent).

The Service is hosted on infrastructure operated via netsyntax.es at the NTT FRA1 datacenter in Frankfurt, Germany (DE-FFM2) — a Tier III+ facility within the EU/EEA.

Customer account and menu data is stored exclusively within the European Economic Area (EEA).

Some service providers (such as Google Analytics) may process data outside the European Economic Area under appropriate safeguards, including the European Commission’s Standard Contractual Clauses.

Role as processor

For restaurant account and billing data, NETSYNTAX SL acts as data controller. Where required by GDPR, Eatoria may act as a processor on behalf of restaurant operators regarding certain information processed through the Service on their instructions. A data processing agreement can be provided on request at [email protected].

Web analytics

Our marketing website and dashboard use Google Analytics only after the visitor provides consent through the cookie banner. Google may set cookies and process usage data (such as pages visited, device type and approximate location) according to its own privacy policy.

Public restaurant menu pages viewed by diners do not load Google Analytics. For all privacy and data requests, contact [email protected].

Your rights

You may exercise rights of access, rectification, erasure, restriction, portability and objection by emailing [email protected]. We may request information to verify your identity.

You may lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Security

We apply appropriate technical and organisational measures to protect personal data. Infrastructure runs in a Tier III+ EU datacenter (NTT FRA1, Frankfurt). No method of transmission over the Internet is 100% secure.

Changes

We may update this policy. Material changes will be reflected on this page with an updated date.

Contact

Privacy enquiries: [email protected]