Data Processing Agreement

Purpose: providing the digital menu, ordering and payment features described in our Terms. Duration: while your account is open, and for the deletion periods in section 7.

Data subjects: guests who order from your menus and your staff.

Personal data: order details, table numbers, notes, open tabs, and any email address or phone number a guest provides.

We process this data only to provide the Service and on your documented instructions, which include your use of the Service, unless a law we are subject to requires otherwise. We do not use it for our own purposes, sell it, or use it for advertising.

People authorised to process this data are bound by a duty of confidentiality.

We apply measures appropriate to the risk, including:

• Encryption in transit
• Access controls that scope every menu, order and image to the venue that owns it, checked on every request
• Keeping card data out of our systems: Stripe and Paddle handle it
• Rate limiting on sign-in, ordering and contact endpoints
• Encrypted off-site backups

You authorise us to use the providers on our Sub-processors page. We bind them to data protection obligations and remain responsible for their performance. We record changes on that page.

We will help you respond to requests from individuals and regulators, and will notify you without undue delay after becoming aware of a personal data breach affecting your data. Write to [email protected].

After termination you have 30 days to export or request a copy of your data. We then delete it, except where the law requires us to retain records. Copies in off-site backups are removed within 7 days of deletion from the live system.

The platform, its database and its image storage run in Tbilisi, Georgia, and backups are held in the European Union. Where personal data is transferred internationally we rely on appropriate safeguards, as described in our Privacy Policy.

We will make available the information reasonably needed to demonstrate compliance with this agreement. It is governed by the laws of Georgia, and the courts of Tbilisi, Georgia have jurisdiction, except where mandatory data protection law requires otherwise.