Privacy Policy
Who processes the data
The data controller is Antonio Dragan, România. Contact: office@waiterpos.eu.
What we collect
Account: email address, display name and a password (stored only as a hash; we cannot read it).
Venue: name, type, menu, prices.
Crew: each member's display name and PIN (stored only as a hash).
Activity: orders, who took, edited, cancelled or collected them and when. This trail exists precisely so the owner can check the takings.
Technical: IP address and time of sign-in attempts (to limit failed attempts), and, if the app crashes, an error report without order contents.
Why we use it
To make the app work: syncing orders between the venue's phones, history, permissions.
For security: blocking repeated sign-in attempts.
For the subscription: Apple tells us the subscription status, never your card details. We never see payment data.
We do not sell data, profile users or show ads.
Service providers
Supabase (database hosting, EU), Apple and RevenueCat (subscription status, tied to the venue id, no payment data), Sentry (crash reports) and Resend (verification and password reset emails). Each processes only what it needs for that service.
Where it is stored
Data is stored in the European Union (Frankfurt) on Supabase infrastructure. Transfer is encrypted (TLS).
How long we keep it
As long as the account exists. The owner can delete order history in the app. The owner can delete the account in Settings. The venues and their data disappear from the app at once and from server backups within 30 days. An active subscription is cancelled separately, in your Apple account.
Your rights
You have the rights of access, rectification, erasure, restriction and portability under the GDPR. Write to office@waiterpos.eu. You may also complain to your data protection authority.
Venue staff: your data is entered by the owner, who is responsible to you for it. You may also contact us directly.