Privacy Policy
Version of September 27, 2026 · Terms of Service · Data Processing Terms · Cookie Policy
1. Who we are
, . Privacy questions: .
This policy covers our customers (restaurant owners) and visitors of kalimenu.com. For guests who order through a restaurant's QR code, the restaurant decides how their data is used and we act on its behalf (see section 6).
2. What we collect and why
| Data | Purpose |
|---|---|
| E-mail, password (stored hashed), restaurant name | Your account and providing the service |
| Billing details and payment history | Charging your subscription and keeping records |
| Card details | Paying your subscription. Handled only by Stripe; we never see or store them |
| Menus, tables, orders, check copies, restaurant settings | Running the service for your restaurant |
| IP address, time and page of each request (logs) | Security, preventing abuse, fixing errors |
| Messages you send us | Support |
| Analytics and advertising cookies, only if you accept them | Understanding visits to our website and measuring our ads (see the Cookie Policy) |
3. Cookies
The service itself uses only cookies that are strictly necessary (keeping you signed in). Our website may use analytics and advertising cookies only after you accept them in the cookie banner; you can change your choice at any time from "Cookie settings". Details are in the Cookie Policy.
4. Who we share it with (service providers)
| Provider | Role | Data location |
|---|---|---|
| Render Services, Inc. | Hosting the application | Frankfurt (EU) |
| Neon, Inc. (or Supabase, Inc.) | Database | Frankfurt (EU) |
| Stripe, Inc. | Subscription payments | United States / EU |
| Resend, Inc. | Sending e-mail (password reset, notifications) | United States / EU |
| Google, Meta (only if you accept analytics or advertising cookies) | Website analytics and ad measurement | United States / EU |
We do not sell your personal information, and we do not share it for cross-context behavioral advertising unless you accept advertising cookies on our website. You can withdraw that choice at any time from "Cookie settings".
5. How long we keep it
- Account and restaurant data: for as long as the account exists. It is deleted right away if you delete your account.
- Billing records: as long as tax law requires.
- Logs: up to 30 days.
- Backups: deleted automatically within a few days.
6. Guests of restaurants
Guests who scan a restaurant's QR code don't need an account. For the restaurant we store:
- Orders from the table: the dishes, the table, the time, the language and optional notes. No name or phone number.
- Pick-up orders: also a name, a phone number and the pick-up time, so the restaurant can prepare and hand over the order.
- Feedback and loyalty card: the rating and optional comment, and a random code of the device so visits can be counted, with nothing that identifies the guest.
On the guest's device we keep only the language, the cart and that random code (browser storage, no tracking cookies). This data belongs to the restaurant, which decides how it is used; we process it on the restaurant's behalf (data processing terms) and keep it as long as the restaurant keeps its order history or its account. For requests about it, contact the restaurant; we help it respond. We do not sell guests' data or use it for advertising.
7. Security
Encrypted connections (HTTPS), passwords stored with scrypt, data kept separate per restaurant, each restaurant on its own address, limits on sign-in attempts, hosting in the EU and regular backups.
8. Your rights
You can access, correct, download and delete your data from Admin → Subscription, or by writing to us at . Depending on your state (for example California, Colorado, Connecticut, Virginia or New York), you may have additional rights, such as knowing what we collect and opting out of targeted advertising. We answer within 30 days and we never treat you differently for using your rights.
9. Your privacy choices in the United States
We do not sell personal information. If you accept advertising cookies on our website, the Meta Pixel may count as "sharing" for cross-context behavioral advertising under some state laws (for example California's CCPA/CPRA). You can opt out at any time with Your privacy choices, and we honor the Global Privacy Control (GPC) signal of your browser as an opt-out. You may use an authorized agent to make a request; we may need to verify your identity first.
10. International transfers
The service is run from the European Union, and data is hosted in Frankfurt, Germany. Transfers to providers in the United States follow the EU-U.S. Data Privacy Framework or standard contractual clauses.
11. Changes
If this policy changes materially, we will tell you by e-mail before the change applies.