Privacy Policy

1. Data we process

Restaurant owners: name, email, (hashed) password, and your venue's details (name, address, hours, menu, photos).

Diners (takeaway orders): name and, with your explicit consent, phone and email — only to prepare and hand over the order.

Usage data: pseudonymous menu statistics (views, scans), collected only after consent via the banner.

Billing: handled by Stripe; we do not store card data.

2. Purposes and legal bases

Providing the service (contract performance): account, menu editor, public page, ordering.

Menu statistics (consent): measuring menu reach for the owner.

Service & security messages (legitimate interest / legal obligation): verification, reset, alerts.

3. Processors

We use providers that process data on our behalf: Stripe (payment), Resend (transactional email), Cloudflare R2 (image/menu storage), Telegram FZ-LLC (United Arab Emirates — internal notifications when an account is created, including the account name and email address), and a machine-translation service (OpenRouter/DeepSeek, with MyMemory fallback) for menu content. Menu text sent for translation may be reused by the fallback service — do not put personal data in it.

4. Retention

Order customer data (name/phone/email): automatically deleted 24h after the order.

Account and menu: kept while the account is active. After cancellation the account stays viewable and exportable for at least 30 days and may then be permanently deleted; immediate deletion can be requested at any time.

Statistics: pseudonymous, kept for reach trends.

5. Your rights

You have rights of access, rectification, erasure, restriction, objection and portability. Email [email protected] to exercise them. You may also lodge a complaint with your data protection authority (BE/FR/NL).

Account deletion: Settings → Delete my account.

6. Cookies

The dashboard uses only strictly-necessary cookies (session, language). The public menu sets no analytics identifier before your consent (“Decline / Accept” banner).

7. Menu usage statistics

When you open a qartine menu, we measure page views, QR-code scans, which dish cards you open, how far you scroll through the menu, whether you click the link to leave a review, and whether a cart you started turned into an order.

These statistics are only recorded once you accept analytics cookies via the banner on the menu; if you decline or ignore the banner, nothing is recorded.

They carry no name, email or phone number. Your IP address is never attached to these statistics — it's used only momentarily to limit abuse, then discarded. Only a random, per-device identifier is attached to them; you can delete it at any time by clearing this site's stored data in your browser (browser settings).

This data is kept for 13 months, then automatically deleted.

8. Transfers outside the European Union

Kube IT Consulting FZCO is established in the United Arab Emirates, a third country with no adequacy decision. The application, database, images and menus are hosted in the European Union (Germany), but administering the service from the UAE involves remote access to some data.

These transfers rely on the European Commission's Standard Contractual Clauses and appropriate supplementary measures (encryption in transit, access control, minimisation). A copy of the safeguards can be requested at the contact address.

Some processors (Stripe, Cloudflare, Resend, Telegram) may also process data outside the EU, on the basis of the same safeguards.

9. Changes to this policy

We may update this policy. Any material change is notified by email or in the service; the last-updated date is shown at the top of the page.