Skip to content

Privacy policy

Draft: highlighted details are still missing and will be added before publication.

1. Controller

The controller for personal data on this website is Company name, address and contact email.

2. Hosting

This website and the OrderTap application run on servers of Hetzner Online GmbH in Germany. When you visit, the server processes technically necessary data such as IP address, time, requested address and browser identifier to deliver the page and protect it from attacks (Art. 6(1)(f) GDPR). Server log retention period

3. Cookies and local storage

This website sets no cookies for advertising or analytics and includes no tracking services. Only technically necessary information is stored: your chosen language and – after you sign in – the session cookie that keeps you signed in (§ 25(2) TDDDG).

Fonts are loaded from our own server; no data is passed to third parties for that.

4. Beta access requests

When you request beta access through the form, we process the details you give (business name, contact person, email, optionally phone, city and message) to handle your request and set up a workspace (Art. 6(1)(b) GDPR). Retention period for declined requests

5. Sending email

Emails to confirm your address, reset your password and invitations are sent through Brevo (Sendinblue SAS, France). Your email address and the message content are passed to Brevo. Reference to data processing agreement

6. Your account and use of the application

For an account we process your name, email address and sign-in data (password as a hash, or a passkey), as well as the data you record in OrderTap for your restaurant. You, as the restaurant, are the controller for your guests' and staff's data; we process it on your behalf. Reference to customer data processing agreement

7. Error monitoring

Check: is error monitoring (e.g. Sentry) active in production? If so: provider, server location, legal basis

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection authority. Competent supervisory authority

9. Last updated

Date