Privacy Policy

01Who is responsible

Aniworld Technologies, S.L., Carrer de Mallorca, 401, Bajos, 08013 Barcelona, Spain, operates ComidaQR. Contact for anything in this policy: legal@comidaqr.com.

We are the controller for the data of restaurant owners and staff who use our platform, people who contact us, and partner applicants.

For data about diners collected through a restaurant's menu, ordering, payment or booking pages, the restaurant is the controller and we process the data on its behalf under our Data Processing Agreement. Diners can contact the restaurant, or us, to exercise their rights.

02What we collect

• Account data: name, email address, optional phone number and profile image, the restaurants you belong to and your role, your marketing preference, and your confirmation that you are over 18.
• Restaurant data: business name, address and contact details, menus, photos, opening hours and settings; and, if you answer the survey in the dashboard, which tools you use and what would help you, which we use to choose which plans and features to show you in the dashboard.
• Language and weekly summary: the language you use the app in and the one you choose for emails, so we write to you in your language; and, unless you turn it off, a summary of your week every Monday (scans, most looked-at dishes and, depending on your plan, sales and bookings). Basis: our legitimate interest in keeping you informed about a service you already use (Spanish LSSI art. 21.2); you can unsubscribe from any of those emails or in Settings.
• Billing data: plan, subscription status and invoices. Card details are collected by Stripe and never reach our servers.
• Diner data handled for restaurants: table sessions, orders and notes added to an order; for reservations, name, email, optional phone number and notes; for card payments, an optional email for the receipt.
• Messages: what you send through our contact form or partner application.
• Security and technical data: IP address and browser user agent recorded in security audit logs, and error reports when something breaks.
• Analytics, only with consent: if you accept optional analytics in the cookie banner, we record that a restaurant's QR menu was scanned (restaurant, table and the phone's language) and which dishes are opened on it. We do not track page views.

03Why we use it and on what legal basis

• To provide the service you signed up for (contract): accounts, menus, orders, payments, bookings, service emails such as trial reminders and receipts.
• To keep the service secure and working (legitimate interest): audit logs, error monitoring, preventing abuse.
• To answer you (legitimate interest or steps before a contract): contact messages and partner applications.
• To send offers to customers about our own similar services (art. 21.2 LSSI-CE): for example a discount when your trial ends. You can opt out at signup and in every such email.
• For QR scan analytics (consent): only if you accept them in the cookie banner. You can withdraw consent at any time from Cookie settings.
• To meet legal duties (legal obligation): invoicing, tax and accounting records.

04Who processes data for us

We do not sell personal data. We share it only with providers who help us run ComidaQR, under contracts that limit what they may do with it. The current list, with what each one does and where, is our Subprocessor Register. In short: Replit (hosting, database, file storage, login, and access to AI and email providers), Stripe (billing and diner payments), Resend (email delivery), OpenAI (AI menu import, translation and dish images, used only when a restaurant runs those features) and Sentry (error monitoring).

We may also disclose data when the law requires it or to protect our legal rights.

05Transfers outside the EEA

Our hosting provider, Replit, Inc., and some other providers are based in the United States, so personal data is transferred outside the European Economic Area. These transfers rely on the European Commission's Standard Contractual Clauses and, where a provider is certified, the EU-US Data Privacy Framework.

06How long we keep it

We keep account and restaurant data while your account is active. You can export it at any time from your account.

When an owner asks to delete a restaurant account, deletion is scheduled for 30 days later and can be cancelled in that time. Then the restaurant's data, uploaded files and diner data are permanently deleted, and any subscription is cancelled. Your user profile is deleted too, unless you still have another role on ComidaQR (another restaurant, staff access or a partner account).

• Security audit log entries older than 90 days are deleted and the rest are anonymised.
• Invoices, payment amounts and commission records are kept for as long as tax and accounting law requires (generally up to 7 years), without the diner's email.
• Encrypted backups are overwritten on a rolling basis within 90 days.
• Login sessions expire after 7 days.

07Your rights

You can ask to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

Account owners can export or delete their data from the privacy section of their account. For anything else, email legal@comidaqr.com. We answer within one month, as the GDPR requires. We may ask you to confirm your identity.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority where you live.

08Cookies

We use only the cookies and local storage needed for the service, plus optional QR scan analytics if you accept them. See our Cookie Policy for the full list.

09Security

Data travels over encrypted connections, access inside ComidaQR is limited by role, security-relevant actions are logged, and backups are encrypted. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

10Children

Restaurant accounts are for adults: signing up requires confirming you are over 18. Diners of any age may view a menu; we do not knowingly collect data from children beyond what a restaurant's booking or ordering requires.

11Changes to this policy

We will update this page when our practices change and change the date at the top. For material changes we will also tell account owners by email.