Privacy policy

This policy covers this website and your account as a restaurant using RESTONALDO. When a restaurant uses RESTONALDO to take orders, the data about their customers belongs to that restaurant — they decide what is collected and why, and RESTONALDO only processes it on their instructions under the Data Processing Agreement. If you are a customer of a restaurant, their own privacy policy applies to your order, not this one.

The data controller is Asad Siddiqi, reachable at hello@restonaldo.com. There is no data protection officer; the controller answers directly.

If you email us, for example to book a demo, we receive your email address and what you write. Apart from the signup form, nothing on the site collects anything.

If you create a restaurant, the form sends the restaurant's name, your name, your email address (which becomes your login), optionally a phone number, the plan you chose, and a password, which is stored only as a one-way hash. Your email address and phone number are not shown on your restaurant's public website.

When you add a card, you type it into a Stripe form and it goes straight to Stripe; we never see the full card number. We keep the card's brand and last four digits, your plan and billing status, and Stripe's references to your customer record and subscription.

If you use the owner app, we keep your login and, when you allow notifications, a push token for each device, so that new orders can ring on it.

The web server keeps an access log, which as a technical necessity records the IP address of every request along with the page requested and the time. These logs rotate automatically and are overwritten within weeks.

restonaldo.com sets no cookies, uses no analytics, and loads no third-party scripts. The fonts are served from this domain rather than from Google. The dashboard at app.restonaldo.com sets only the cookies it needs to work: a login cookie that keeps you signed in for up to 90 days, and, only if you pick Light or Dark, one that remembers that choice for a year. Neither tracks you or is shared with anyone. When you add a card, Stripe's own page sets its cookies under Stripe's privacy policy. Cookies that are strictly necessary for a service you asked for need no consent, so there is no cookie banner.

A demo request is used to reply to you and to prepare a quote — steps taken at your request before entering into a contract (GDPR Article 6(1)(b)). Server logs are kept to operate and secure the service, which is a legitimate interest (Article 6(1)(f)). Creating a restaurant is entering into that contract, and those details are used to run your account, bill your subscription and reach you about it (Article 6(1)(b)). Invoices are kept because bookkeeping law requires it (Article 6(1)(c)).

A demo request is kept while we are in contact and for up to two years afterwards, so that a conversation you resume is not starting from nothing. Ask and it will be deleted sooner. Access logs are overwritten automatically within weeks. The details you give when creating a restaurant are kept for as long as the account exists. Ask and we close the account and delete them, except what bookkeeping law requires us to keep for invoices.

The site and its data run on servers rented from Hetzner Online GmbH in Germany, inside the EU. Email to and from the address above — including the notice we send ourselves when you create a restaurant — is handled by Apple's iCloud Mail. Subscription payments are handled by Stripe. Notifications to the owner app are delivered through Expo (650 Industries, Inc.). Photos and other media uploaded to restaurant sites are stored in Cloudflare R2, in its EU jurisdiction. Nothing is sold, and nothing is shared for advertising.

Apple, Stripe, Expo and Cloudflare are US companies, so some of this data may be transferred to the United States. Stripe, Expo and Cloudflare are certified under the EU-US Data Privacy Framework, which the European Commission has decided gives an adequate level of protection (GDPR Article 45). iCloud Mail is provided in the EU by Apple Distribution International Ltd (Ireland), and Apple's transfers to the US are covered by the EU Standard Contractual Clauses (GDPR Article 46).

You can ask for a copy of your data, ask for it to be corrected or deleted, object to it being processed, or ask for it in a portable form. Write to hello@restonaldo.com and you will get an answer within a month.

You can complain to the data protection authority in your own country, or to the Danish Data Protection Agency, Datatilsynet — datatilsynet.dk — at any time. You do not have to raise it here first.