Privacy Policy

1. Scope and responsibilities

This policy explains how information is processed through Servonio's workspace tools, digital menus, QR access, restaurant ordering, customer accounts, and optional external features. Servonio operates the software platform; each venue determines the restaurant services it offers and manages the customer, menu, and order information associated with its workspace.

For restaurant transactions or information entered into a restaurant account, the venue is the primary contact. Workspace owners are responsible for their own customer notices, lawful collection and use of information, and appropriate team permissions. Platform account and service-operation questions should be raised through the Servonio contact channel provided with the workspace or service agreement.

2. Account and workspace information

Workspace accounts include names, usernames, email addresses, password hashes, profile images where supplied, team roles, branch access, and session information. New owner registrations record a terms-acceptance timestamp and policy version. If you choose Google sign-in, Google supplies verified account information such as your email address, name, and available profile image.

Workspace records include business names and URLs, branches, table or service-point settings, menus, translations, uploaded media, contact links, subscription and trial status, AI credit balances and usage, and operational or audit records. Customer accounts include a name, email address, phone number, password hash, restaurant association, creation date, and session records.

3. Orders, reviews, and operational records

Orders can include selected dishes and options, quantities, prices, currency, customer contact details, table identifiers, delivery addresses or location text, instructions, timestamps, fulfillment method, and status history. Guest dine-in orders may include contact details without a customer account. Signed-in orders are associated with the relevant restaurant customer account.

The platform processes order history, staff workflow updates, bill requests, recorded cash payments, and invoice information. Reviews include the customer's name, rating, text, timestamps, and moderation status. Account and workspace changes can also produce security or audit records.

4. Why information is processed

Information is processed to authenticate users, enforce workspace and branch access, display menus, receive and fulfill orders, show customer order history, moderate reviews, manage business content, record payments and invoices, and provide reporting and optional AI tools.

Security processing includes preventing repeated sign-in attempts, checking session and QR credentials, and keeping relevant audit records. This can involve IP addresses, browser or user-agent information, request timing, and hashed sign-in identifiers. Information is also used to administer workspace plans, usage limits, credits, and support issues.

5. Cookies, browser storage, and sessions

Staff and owner browser sessions use an HttpOnly session cookie together with a session-bound request-verification handle. Sessions normally expire after eight hours. Selecting “Trust this device for 30 days” at sign-in extends both the cookie and server session to 30 days and stores the account's session handle and workspace information in local storage for later visits. Otherwise the handle is kept in session storage. Signing out revokes that session; changing the account email or password revokes all sessions, including trusted devices. Trust does not bypass verification of a new email address.

A separate signed HttpOnly browser cookie, normally retained for one year, helps limit account creation and repeated sign-in attempts. The service stores hashed browser and network identifiers and registration timing for abuse protection. This identifies a browser profile rather than immutable physical hardware. Signing out does not clear that identifier or reset signup limits. Temporary cooldown deadlines and checkout retry identifiers can be held in session storage.

Customer sign-in uses a restaurant-specific credential stored in local storage or session storage according to the Remember me choice. Current customer sessions expire after 30 days unless revoked earlier. Session storage normally lasts for the browser-tab session; local storage can remain across visits until cleared. Sign-out removes the current local credential and requests revocation of that session on the server.

The interface also uses browser storage for carts, favorites, language preferences, recent-order tracking, and some appearance or workspace preferences. Clearing browser storage can remove these preferences and sign-in information but does not erase orders, accounts, or other records already held by the service. QR and guest-order credentials can identify a service point or permit access to a specific order; treat these credentials as private access information.

6. Optional delivery location

You can enter a delivery address manually. If you choose the location-detection feature and grant browser permission, the browser obtains coordinates and sends rounded latitude and longitude to OpenStreetMap's Nominatim reverse-geocoding service to obtain address text. That external request also exposes normal connection information, such as your IP address, to the provider.

The resulting address or coordinate text can be included with your order if submitted. The application does not need continuous background location tracking for this feature. Declining browser location permission allows you to continue with a manually entered address.

7. Who can see information

Authorized restaurant staff access customer and operational information according to their workspace, branch, role, and assigned permissions. Authorized platform personnel have separate permissions for service administration, workspace management, billing, usage, and support. Customer accounts and order access are checked against the relevant restaurant context.

Published menus, business contact details, public media, and approved reviews are visible to visitors. A public review may show the customer's name, rating, review text, and timestamp. Avoid putting private information in public reviews or menu content. Information may also be processed by relevant external providers when their features or resources are used, or disclosed where required by applicable law.

8. External sign-in, AI, and hosted resources

When Cloudflare R2 storage is configured, uploaded and saved service media is stored in Cloudflare object storage, organized by workspace or platform ownership. The application controls public or authenticated delivery from the private bucket. Cloudflare processes the stored content and related service requests under its own terms. Storage credentials are kept on the backend and are not sent to visitors.

Google sign-in sends the information needed to verify your Google identity to Google and returns account information to Servonio. Customer email/password accounts do not currently offer Google sign-in. Google's own policies govern its processing.

Optional workspace AI tools send the text, prompts, and any reference images needed for the requested task to the configured provider, such as Google Gemini or Magnific. The platform records relevant task, model, usage, status, cost, and credit information. Providers may process requests outside your country under their own service terms. Do not submit unnecessary customer information or confidential content to AI tools.

Menu themes may load Google Fonts, externally hosted photographs such as Unsplash images, venue-supplied media URLs, or embedded video. Opening these resources can disclose IP addresses, browser information, and permitted referrer information to their hosts; embedded providers may use their own cookies. External social, website, map, or contact links are governed by the destination service when opened.

9. Security, retention, and deletion

Deleting a media-library asset revokes its normal delivery and requests physical deletion from object storage. If the storage service is unavailable, the object key is retained in a deletion journal for retry. Removing a photo from one placement does not erase an image still retained in the library or needed by another reference. Already downloaded copies or responses cached before a policy change cannot be remotely recalled.

Passwords are stored as hashes, not plaintext. Server-side session credentials are stored as hashes, and access is checked against the applicable account and permissions. Browser-stored customer credentials still grant access while valid, so protect shared devices and sign out when appropriate. No system can guarantee uninterrupted availability or protection against every security incident.

Operational records are retained while needed for the workspace, restaurant service, account, or relevant security and recordkeeping purposes. Session expiration prevents further use but is not a guarantee that the expired database record is immediately removed. The current maintenance process removes expired staff sessions, can prune old sign-in-attempt records after one day, and by default prunes platform audit events older than 365 days.

Deleted workspaces lose normal access and are eligible for permanent removal of workspace data and associated media after 30 days through scheduled maintenance. Completion depends on maintenance running. Related user-account, security, audit, financial, or separately retained records may remain where needed. These settings do not promise immediate deletion of every record, and customer sessions or accounts are not deleted simply by signing out.

10. Your choices and information requests

You can choose session-only sign-in, sign out, clear browser storage, decline optional location access, and avoid optional Google sign-in or AI tools. Workspace users can update their account details where the interface permits and owners can manage their staff access and workspace content.

For access, correction, deletion, or other requests concerning restaurant customer details or orders, contact the venue using its published contact information. For workspace-account or platform-operation requests, use the Servonio contact channel provided with the workspace or service agreement. Identity or authorization may need to be checked before a request is handled.

Rights and applicable exceptions depend on the law governing the request. The service does not currently provide a universal self-service customer deletion or data-export control. Signing out or clearing storage is not a substitute for a request concerning server-held information.

11. Policy revisions

This policy describes the current service and will be revised as features and operational arrangements change. The date and version identify the published revision. New owner registrations record the accepted terms version; existing acceptance records are not changed merely because this policy is revised.