Data Processing Terms
Version of September 27, 2026 · Part of the Terms of Service
Between the restaurant that uses Kalimenu (the "Business") and (the "Service Provider"). These terms apply from the acceptance of the Terms of Service at sign-up.
1. Scope
| Subject and purpose | Providing a digital menu, ordering from the table, server calls and check copies |
|---|---|
| Duration | For as long as the Business's account exists |
| People concerned | The Business's guests and staff |
| Data | Orders (dishes, table, time, language, notes), calls, check copies, staff sign-in details (PINs), technical data (IP). Guest names or contact details are not needed. |
| Sensitive data | Not intended. Order notes may contain information such as allergies, which the Business uses only to serve the guest. |
2. What the Service Provider does
- Processes the data only to provide the service and following the Business's instructions, as set in the service's settings and in these terms. It does not sell the data, and does not use it for any other purpose.
- Binds every person with access to the data to confidentiality.
- Takes appropriate technical and organizational measures, among others:
- encryption in transit (HTTPS)
- passwords stored with scrypt
- data kept separate per restaurant
- access control and limits on sign-in attempts
- hosting in the EU
- backups
- Helps the Business answer requests from the people concerned (access, deletion and so on).
- Informs the Business without undue delay, and at the latest within 48 hours, after becoming aware of a data breach that affects it.
- Deletes the data when the service ends, unless the law requires keeping it. Before that, the Business can download it from the admin.
- Makes available the information needed to show compliance, and allows reasonable audits with prior notice.
3. Subprocessors
The Business authorizes the use of the subprocessors below. The Service Provider announces by e-mail, at least 30 days in advance, any addition or replacement, and the Business may object or terminate.
- Render Services, Inc.: hosting (Frankfurt, EU)
- Neon, Inc. or Supabase, Inc.: database (Frankfurt, EU)
- Resend, Inc.: account e-mails
Subprocessors are bound by equivalent obligations.
4. What the Business does
The Business informs its guests about the processing (for example with a note in the restaurant or in its own privacy policy) and makes sure it is allowed to process the data.
5. Contact
For anything about these terms, contact us at .