Privacy Policy

Version 1.0 · Last updated 2026-08-26

Controller: [COMPANY NAME], [RESTAURANT ADDRESS]. Privacy contact: [DATA PROTECTION CONTACT]. Phone: [PHONE]. Email: [EMAIL].

This notice is based on the Swiss Federal Act on Data Protection (FADP / nDSG) and the Data Protection Ordinance. If the website targets customers in the EU/EEA, additional EU requirements may apply — legal review required.

What data we process

• Account data: name, email, phone, password hash, verification status.
• Order data: items, type, notes, amounts, status.
• Delivery address: street, number, postcode, city.
• Contact form: name, email, optional phone, subject, message.
• Consents: type, status, policy version, time, locale, source.
• Technical data: session tokens, usual server logs.

Purposes

To accept and fulfil orders, manage accounts, answer enquiries and keep the service secure. Marketing only with an explicit, voluntary consent.

Recipients / processors

• Hosting: [HOSTING PROVIDER — e.g. configured Netlify / Railway / Hetzner]
• Payment: [PAYMENT PROVIDER — not live until configured]
• Email: [EMAIL PROVIDER — not configured]
• External ordering platforms (if active): Just Eat, Uber Eats, Wolt — only within the relevant integration.

Analytics / marketing providers: none currently active.

International transfers

[CONFIRM after hosting/payment/email providers are known] [CONFIRM — e.g. SCCs / adequacy if applicable]

Retention

Criteria as configured (to be confirmed): account [CONFIRM — while account active / legal duties]; orders [CONFIRM — commercial / tax retention]; finance [CONFIRM — statutory retention]; consents [CONFIRM — proof of consent period]; logs [CONFIRM — operational logs]; contact [CONFIRM — inquiry handling period].

Profiling / automated individual decisions

Not used in this application.

Cookies / local storage

See the Cookie Policy. Analytics/marketing scripts load only after your consent (no tracking scripts are currently installed).

Your rights

Access, rectification, erasure, restriction and objection where applicable. Contact [DATA PROTECTION CONTACT]. In your account: data export and account deletion (statutory retention may still apply).