Privacy Policy

Last updated: 2026-07-20

1) Who we are

Cafe QR Menu is a cafe service: QR menu, table orders and staff notifications. This document describes data handling in the admin app and web service.

2) Data we process

Login data: cafe identifier (slug) and password (for authentication).
Session tokens: access/refresh tokens to maintain authorization.
Menu content: categories, dishes, prices, availability, descriptions.
Files and images: uploads for menu import and dish photos (if enabled).
Orders: order items, status and service data required for processing.
Staff data: operational data for notifications/assignments (e.g., Telegram name/ID).
Billing data: Stripe customer ID, subscription ID, subscription status, trial end and billing period dates.
Email and newsletter consent: email address and, only when you opt in, the consent text/version, date, source, and limited technical evidence such as IP address and user agent.

3) How we use data

to provide core functionality (menu, tables, orders, staff);
to authenticate and maintain sessions;
for integrations you enabled (e.g., Telegram);
to manage subscription status, trial access, billing portal access and payment-related support;
to process uploads (e.g., menu import) if enabled on your server.
when you explicitly opt in, to send CafeOrder24 news, tips and product updates by email; you can unsubscribe at any time.

4) Sharing with third parties

We do not sell personal data. Data is sent to the Cafe QR Menu server configured by the service owner. The server may send messages to Telegram for staff notifications. Subscription payments are processed by Stripe; Stripe receives and processes payment details according to its own terms and privacy policy. Cafe QR Menu does not store full card numbers. If you opt in to newsletters, your email address and subscription status may be shared with our email delivery provider, Resend, solely to send and manage those communications. Other integrations depend on server configuration.

5) Storage and security

We recommend using the service over HTTPS only.
Authorization tokens should be stored in secure storage (mobile) or secure sessions (web).

6) Retention

Data is retained as required to provide the service and according to your server settings. Newsletter consent records are retained while the subscription is active and as reasonably necessary to document your consent or withdrawal. On the device, session data remains until logout or app data cleanup.

7) Your rights

To request deletion/export of cafe data, contact the administrator of the server hosting your cabinet. You can withdraw newsletter consent using the unsubscribe link in an email or by contacting support. Withdrawal does not affect processing performed before it.

8) Contact

Support: set SUPPORT_EMAIL in .env on the server.