Ospitera privacy policy

1. Who we are

Ospitera ("Ospitera", "we") decides how and why the personal data described here is used: we are its controller. Version 2026-11-05.

Privacy questions and requests: support@ospitera.com.

We have not appointed a data protection officer under the GDPR, as it does not require one for our activities; the contact above reaches the person responsible for privacy at Ospitera. Where a country's law requires a named officer (for example a data protection officer in the Philippines, a privacy officer in New Zealand, or the person in charge in Quebec), that person holds the role. Where a country requires a local representative, Part 2 says how we meet it.

2. What this policy covers

People who visit ospitera.com and its country sites; people who apply to open a venue or send us a question; venue owners, their staff and contact persons, as users of the admin and kitchen board and as our customers; people we contact to offer our service (business outreach); and anyone who writes to us.

Not covered: guests who order on a venue's storefront. The venue is responsible for that data and explains it in its own privacy notice, linked from its storefront; we process it for the venue under our data processing agreement.

3.1 Visiting our website

Data: IP address, browser and device type, pages requested and time; the country your IP address belongs to; the language you chose.

Why: to show the website and keep it secure; to show you your own country's site, without ever blocking another one: outside the EU/EEA, ospitera.com opens it on your first visit, and inside it a bar suggests it (we read your country from your IP address on each visit and don't keep that lookup as a profile; the site that matches it is kept in a cookie so other sites can suggest it); and to remember the site and language you chose (cookies, section 11).

Basis: our legitimate interest in running a secure website and showing visitors their own country's site (GDPR art. 6(1)(f)). The site cookies are needed for functions you use.

Kept: our hosting provider's server logs for up to 30 days; rate-limit records hold only a keyed hash of the IP address and expire within 24 hours; the site cookies for 1 year. We use no advertising cookies, no third-party analytics or tracking, and no social media pixels.

3.2 Applying to open a venue

Data: venue name, address and country; contact person's name, email and phone; the venue's public phone and email; preferred language, brand colour, notes, and photos or a logo you upload; the username you choose. The password and staff PIN you choose are never stored in readable form, only as a one-way hash.

Why: to review your application, set up your ordering site, and contact you about it. Basis: steps you asked for before a contract where you apply for yourself (art. 6(1)(b)); where you apply for a company, our legitimate interest in setting up the business relationship (art. 6(1)(f)).

Kept: a sign-up link that is never submitted stops working after 30 days and is deleted 30 days later; an application that does not lead to a venue is deleted 12 months after it was submitted; if your venue opens, the data becomes account data (3.4).

3.3 Asking us a question

Data: your name, email (or phone number on WhatsApp), your message, and the language of the page.

Why: to answer you. Questions are emailed to our support team and may be stored in our support inbox, where an AI service may draft a reply that one of us reads, edits and decides whether to send; nothing is sent automatically. Basis: our legitimate interest in answering questions about our service, or steps before a contract (art. 6(1)(f) or (b)).

Kept: 24 months after the last message, unless the conversation becomes part of a customer relationship. WhatsApp is run by Meta under its own terms and privacy policy; use email if you prefer not to use it.

3.4 Venue accounts: owners and staff

Data: usernames; password and PIN hashes; sign-in sessions and known-device cookies; short-lived sign-in counters keyed by a hash of the IP address; the history of order status changes; and your acceptance of our terms (version, username, time, keyed hash of the IP address).

Why: to give you and your staff access, keep accounts secure (rate limits, new-device checks), show what happened to each order, and prove which terms were accepted. Basis: performing our contract where you contract with us yourself (art. 6(1)(b)); where you act for a company or work for the venue, our legitimate interest in running and securing the business relationship (art. 6(1)(f)); and our legitimate interest in security and in proving the contract (art. 6(1)(f)).

Kept: while the venue uses Ospitera. After the end, account data and order history are deleted on day 30, as the terms say (7.4); terms acceptances may be kept for up to 5 years as evidence in case of a dispute.

3.5 Billing

Data: business name, address, country and VAT or tax number; billing email and contact person; plan, price, invoices and payment status. Card and bank details are held by Stripe; we only see the type, last digits and expiry.

Why: to invoice and collect our fee, apply the right tax and keep accounting records. Basis: our contract (art. 6(1)(b)) or, for a contact person acting for a company, our legitimate interest in administering the relationship (art. 6(1)(f)); and our legal obligations under accounting and tax law (art. 6(1)(c)).

Kept: invoices, credit notes and the records that support them for 10 years from 1 January after the year each document was issued, as Belgian accounting and VAT law requires, or longer where a legal hold applies; other billing data while the venue uses Ospitera.

3.6 Running the service

Data: messages we exchange with you, support requests, and service emails (sign-in links, invoices, notices of changes). Why: to provide and support the service and tell you about changes, as the terms require. Basis: our contract (art. 6(1)(b)). Kept: while the venue uses Ospitera, and questions as in 3.3.

3.7 Business outreach

Data: a venue's name, address, public phone number and website, and a business email address the venue publishes (for example info@… or the address on its website or listing), including a name only where it is part of that published address.

From: public sources — the venue's own website, public business listings and maps, and public business registers. We don't buy lists of people.

Why: to send the venue a short email offering our service, and to avoid contacting it again if it says no. Basis: our legitimate interest in offering a service relevant to the business's activity (art. 6(1)(f)). We send a promotional email only where we have documented consent or a verified exception under the email-marketing rules that apply to that message; an address being public does not by itself allow marketing. Before each campaign we record the source, the kind of recipient and the permission we rely on (Part 2).

Every outreach email says who we are, where we found the address, and how to stop further emails in one step; you may object at any time and we stop. Kept: 12 months after our last email if you don't reply. If you ask us to stop, we keep only the email address, or a hash of it, on a do-not-contact list so that we never email you again.

3.8 Security, errors and legal claims

Technical error reports (Sentry) are configured not to collect contact data, cookies or form contents, and are kept for 90 days. Rate limits and logs hold keyed hashes of IP addresses. Basis: our legitimate interest in a secure, working service (art. 6(1)(f)).

Where needed we use the data above to establish, exercise or defend legal claims and to answer lawful requests from authorities (art. 6(1)(c) or (f)), for as long as the matter requires.

4. What we don't do

We don't sell personal data, share it for other companies' advertising, or build profiles of you.

We make no decisions about you by automated means that have legal or similarly significant effects (rate limits may briefly block repeated sign-in attempts; contact us if you are affected).

Our tools for reading and translating menus send the text and images you submit to an AI provider for that purpose. A menu or photo can itself contain business contact details or other personal data, so don't submit guest data or personal data you don't need to. The provider is listed at /legal/subprocessors.

5. Who we share data with

Service providers who process it for us under contracts that bind them to our instructions and to confidentiality (Stripe also acts as a separate controller for its own legal duties, such as fraud prevention and anti-money-laundering checks, and so does Meta for WhatsApp): Netlify (hosting, US), Neon (database, EU region), Stripe (billing, Ireland and US), Resend (sending emails, US), Anthropic (drafting replies to emails sent to us, and reading and translating menus; US), Sentry (error monitoring, EU region), the OpenStreetMap Foundation (map tiles in the admin, which receives your IP address; UK), and Meta only if you contact us on WhatsApp. The list for venue data is at /legal/subprocessors.

Professional advisers (accountants, lawyers) under confidentiality; authorities and courts where the law requires it or to protect our rights; and a buyer or successor of our business, who would continue under this policy, after we tell you.

6. Transfers outside your country

We are based in Belgium (EU). Some providers process data in other countries, notably the United States. For data from the EU/EEA these transfers rely on an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or on the European Commission's standard contractual clauses with extra safeguards where needed; for the UK and Switzerland, on their equivalents. You can ask us for a copy of the safeguards. Where the law of your country has its own rules for sending data abroad, Part 2 says how we meet them.

7. How long we keep data

Your country from your IP address: looked up on each visit and not kept; your country's site is kept in a cookie (1 year). Site and language cookie: 1 year. Server logs: up to 30 days. Unsubmitted sign-up link: closes after 30 days, deleted 30 days later. Application without a venue: 12 months. Questions: 24 months after the last message. Account data and order history: while the venue uses Ospitera, deleted on day 30 after the end. Terms acceptances: up to 5 years after the end. Invoices and accounting records: up to 10 years. Outreach without reply: 12 months after the last email. Do-not-contact list: for as long as we do outreach (address or hash only). Error reports: 90 days. When a period ends we delete or anonymise the data.

8. Your rights

Depending on the law of your country (see Part 2), you can ask for access to your data and a copy of it; correction; deletion; restriction; object to our use of it based on legitimate interest (you can always object to outreach, and we stop); receive the data you gave us in a portable format; and withdraw consent where we rely on it, without affecting what was done before.

Write to support@ospitera.com. We may ask you to confirm your identity. We answer within one month (or the shorter period your law sets), and may extend this for complex requests where the law allows, telling you why. Requests are free unless clearly unfounded or excessive.

You may complain to the data protection authority of your country. Our lead authority in the EU is the Belgian Autorité de protection des données / Gegevensbeschermingsautoriteit (dataprotectionauthority.be); Part 2 names others. We would like the chance to resolve your concern first.

9. Security

We protect data with encryption in transit, encryption at rest of sensitive data, one-way hashes for passwords, PINs and IP addresses, strict separation between venues, rate limits, logging of sensitive actions, automatic deletion and backups. If a breach puts your rights at risk, we tell you and the authority as the law requires.

10. Age

Our service is for businesses and not meant for anyone under 16, or the age of majority where your law sets it higher. We don't knowingly collect data from children.

11. Cookies and similar technology

We use only what is needed for our website and admin to work, so we don't ask for consent; if we ever add analytics or other optional cookies, we will ask first.

os_site: remembers the country site and language you chose in the switcher or the suggestion bar (1 year). os_home: the country site that matches your location, so other sites can suggest it (1 year). os_suggest_off: you closed that suggestion (1 year). Owner and staff session cookies (per venue): keep you signed in until you sign out or the session expires. Known-device cookie: recognises a device you signed in on before, for security (90 days). Platform and franchise session cookies: sign-in for our team and for franchise consoles. Browser storage (for example the admin's setup guide, the kitchen board's sound and print settings, the chosen language): settings kept on your device and never sent to us, until you clear them.

The full list is also at /legal/cookies.

12. Changes

We may update this policy when our services or the law change; the version date is at the top. Where a change materially affects you, we tell you beforehand in your admin or by email.

Part 2. What particular countries add

In each section, "the law" means the data protection law named in it. Where it gives you more rights than Part 1, you have those rights.

Colombia

Law 1581 of 2012 and Decree 1377 of 2013; this policy is our data processing policy. You may know, update and correct your data, request proof of authorisation where we rely on it, be informed of its use, complain to the Superintendencia de Industria y Comercio (sic.gov.co), and revoke authorisation or ask for deletion. We answer queries within 10 business days and claims within 15.

Business outreach by country

We email a business only with documented consent or a verified exception under the rules that apply to the message, checked country by country before each campaign. Where we rely on an exception: Belgium (impersonal addresses of companies, not a named employee's address), France (an address relevant to the recipient's role, with information and a way to object), Ireland and the UK (corporate subscribers only, not sole traders or partnerships), the US (CAN-SPAM) and Canada (CASL, addresses the business published itself). Each email names us, says where we found the address and has a one-step opt-out.

Not sent without prior consent: Germany, Austria, Poland, Switzerland, Italy, the Netherlands, Spain, Denmark and South Africa, and any other country where we have not verified an exception.

Australia (Spam Act 2003) and New Zealand (Unsolicited Electronic Messages Act 2007): we rely on inferred consent only where the business published the address itself, did not say it does not want commercial messages, and the email relates to its business.

Singapore (Spam Control Act 2007): the subject starts with <ADV> and we act on an unsubscribe within 10 working days. Brazil (LGPD) and the Philippines (Data Privacy Act 2012): we rely on our legitimate interest after a documented assessment, only for addresses the business published itself. Mexico (LFPDPPP): our privacy notice is linked in the first email and we stop as soon as you object. Argentina (Ley 25.326): only addresses from public sources; each email is marked as advertising and explains how to have your data withdrawn or blocked.