Privacy policy

We take the protection of your personal data seriously and process it confidentially in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act and this privacy policy.

Two roles, and which one applies when

Flavoso processes data in two different roles, and that determines whom you turn to.

• For everything on flavoso.com, app.flavoso.com, admin.flavoso.com and docs.flavoso.com we are the controller: opening these pages, a business account, billing, support.
• For everything that happens on a business's ordering page (orders, reservations, guest data) that business is the controller. There we are a processor under Art. 28 GDPR and act only on their instructions. Requests from guests about their data are answered by the business; we forward them.

Controller

The controller for data processing on this website is:

Ulrich Henne, Neuffenstraße 4, 71126 Gäufelden, Germany, imprint@flavoso.com, phone +49 151 11355044

No data protection officer has been appointed. The conditions of Art. 37 GDPR and § 38 BDSG are not met: fewer than twenty people are permanently engaged in automated processing, and neither large-scale regular monitoring of individuals nor large-scale processing of special categories of data forms part of our core activity.

Hosting

This website and all associated services run on a server of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The server is located in Germany. The database runs there too: we operate Supabase ourselves on the same server, so there is no further provider in between. Hetzner processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in secure and efficient provision (Art. 6(1)(f) GDPR).

Server log files

When a page is opened, the server automatically collects and stores information in log files that your browser transmits, including:

• browser type and version
• operating system used
• referrer URL
• host name of the accessing device
• time of the server request
• shortened IP address

This data is not merged with other sources and serves solely technically correct operation and the defence against attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after seven days at the latest.

Cookies and local storage

We use very few cookies, and most of them are technically necessary:

• flavoso-consent-site and flavoso-consent: your answer to the reach-measurement question. The first applies to all Flavoso pages under flavoso.com (website, help centre, dashboard), the second only to the site where you answered, such as a restaurant's ordering page. We have to store the answer in order to honour it. Six months.
• flavoso-theme and the language choice: whether you read in light or dark mode and in which language. One year.
• Sign-in cookies: only if you have an account and are signed in. They hold the session and expire with it.
• flavoso-visitor: a random number for reach measurement. Set only with your consent and deleted when you withdraw it. Six months.

The legal basis for the necessary cookies is Art. 6(1)(f) GDPR in conjunction with § 25(2) no. 2 TDDDG, and for reach measurement your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Reach measurement

We count how often the pages of this website are opened. This happens on our own servers in Germany, without Google Analytics and without any other third-party service. Without your consent nothing is measured at all: if you decline or do not answer, no record is created. If you agree, we store the path opened without its parameters, the domain you came from, the kind of device (phone, tablet, computer), the language, the time spent and the time of day. Repeat visits are grouped by an irreversible short value derived from your IP address and browser identification, computed on the server only and rotated every day; we do not store your IP address itself. In addition, with your consent we place a random identifier in your browser (cookie “flavoso-visitor”, six months) and read your device time zone. From that we derive the estimated country, browser and operating system, and whether a visit is new or returning. The identifier is a random number unrelated to your person and is hashed again before storage. No profile is built, there is no combination with other data, and none of it is passed to third parties or used for advertising. The legal basis is Art. 6(1)(a) GDPR, and for storing on and reading from your device additionally § 25(1) TDDDG. You can withdraw your consent at any time via “Cookie settings” in the footer; the identifier is deleted in the process. Withdrawal takes effect for the future and does not affect the lawfulness of processing up to that point. The data is deleted after 400 days at the latest.

Use of the signed-in area

So that we can see which parts of the service are actually used and where setup gets stuck, we count within the signed-in area which area was opened and how long a step of the setup wizard took. What is stored is only a total per business, per day, per area, with no identifier of the person acting and no time of day. It therefore cannot be used to tell who did what and when. Nothing is stored on or read from your device for this; § 25 TDDDG does not apply. The legal bases are Art. 6(1)(b) GDPR for providing and improving the service we owe you under the contract, and Art. 6(1)(f) GDPR for our legitimate interest in a product whose usability we can verify. The figures are deleted after 400 days. Security-relevant events in the signed-in area are logged separately and with personal reference, because we have to be able to evidence them.

Registration and account

When you create an account, we process the data you provide: email address, password (only as an irreversible hash), the name of the business, address, phone number, role in the team and, if you switch it on, the details for two-factor sign-in. Technical data such as the time of the last sign-in is added. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

Data belonging to a business's guests

Orders, reservations, delivery addresses, notes to the kitchen and stamp cards belong to the respective business. We store them on the same server in Germany, separated per business, and process them only in order to provide the service. Between guest and business the legal basis is regularly Art. 6(1)(b) GDPR. We act as a processor; the details are set out in the annex to our terms.

Payment processing

We bill our own subscriptions through Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe processes the payment data under its own responsibility; Stripe's privacy terms apply additionally. We ourselves never see full card numbers or bank credentials.

If a guest pays online on a business's ordering page, the payment runs through the payment account that the business connected itself. Stripe, PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) and Mollie (Mollie B.V., Amsterdam, Netherlands) can be connected. The money flows directly to the business; we never become the payee and never hold anyone else's money. The legal basis is Art. 6(1)(b) GDPR.

Sending email

Confirmations, notifications and invitations are sent via Amazon Simple Email Service. The provider is Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg. Sending runs through the Frankfurt am Main region (eu-central-1), so the content is processed in the European Union. Amazon processes the data on our behalf under Art. 28 GDPR. The legal basis is Art. 6(1)(b) GDPR.

Sending SMS

SMS notifications to guests are sent via seven communications GmbH & Co. KG, Marktplatz 6, 55232 Alzey, Germany. The mobile number and the text of the message are transmitted. The business decides whether and at which moments an SMS goes out. The legal basis is Art. 6(1)(b) GDPR.

Push notifications in the app

If you use our app and allow push notifications, your device receives a device token from the operating system. We store it in order to send messages to exactly that device and transmit it for delivery to Firebase Cloud Messaging of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is your consent, which you can withdraw at any time in your device settings (Art. 6(1)(a) GDPR). Without permission no token is stored.

Maps, addresses and delivery areas

To search for your own restaurant, to check delivery addresses and to display the map in the dashboard, we use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Maps, Places, Geocoding). The address you enter is transmitted to Google; when a map is displayed, your browser additionally establishes a direct connection to Google and transmits your IP address. Maps are only loaded in the signed-in area and only where a delivery area is edited or an address is checked. The legal basis is Art. 6(1)(b) GDPR, because without this check neither a delivery area nor a delivery would be possible.

For delivery areas based on driving distance we compute the area via OpenRouteService of the Heidelberg Institute for Geoinformation Technology (HeiGIT gGmbH), Berliner Straße 45, 69120 Heidelberg, Germany. Only the coordinates of the business and the desired driving time are transmitted, no guest data.

Besides Google we query two further address services for the same tasks, because no single one knows every address: Photon by Komoot GmbH, Chausseestraße 111, 10115 Berlin, Germany, and Nominatim by the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. For the list of towns around a business we additionally query the OpenStreetMap project's Overpass API. Only the address being searched for, or the location of the business, is transmitted, and the request goes out from our server, not from your browser. For the United Kingdom an adequacy decision of the European Commission is in place. The legal basis is Art. 6(1)(b) GDPR.

Connected apps and webhooks

A business can pass its orders on to further destinations it chooses itself. We transmit data there only on its behalf and only if it has set this up:

• Orders by email: every new order also goes to an email address the business enters, such as that of its kitchen. The email contains the line items, amounts, time and the note to the kitchen, plus the guest's name and, depending on the order type, phone number and delivery address.
• Connected apps: the business decides which application from another provider it connects through the Flavoso API and which permissions it grants. The app receives only the data the business has released. Orders contain no guest email address, no phone number for orders at the table, and an address only for deliveries. The app's provider is a recipient and responsible for its own processing; the business is responsible towards the guests.
• The business's own webhooks: it can have events such as new orders sent to addresses (webhooks) it enters itself, for example to its own system.

We have no contract with the provider behind an email address or webhook entered by the business. The legal basis is Art. 6(1)(b) GDPR.

Features using artificial intelligence

In several places we use language models of Google Ireland Limited (Gemini): for the assistant that answers questions about the product, for importing a menu from a file or photo, for translating the menu into further languages and for reply drafts in support. Only what is needed for the task is transmitted: your question together with the manual text, the uploaded menu, or the text of your support request. Payment data, passwords and guest data from orders are not sent to the model. Google processes the data on our behalf; under the terms applicable to us it is not used to train the models. The legal basis is Art. 6(1)(b) GDPR, and for support our legitimate interest in handling requests quickly (Art. 6(1)(f) GDPR).

Pursuant to Art. 50 of Regulation (EU) 2024/1689 (AI Act) we point out: the assistant is an AI system, you are not talking to a human there. Translated menus, imported menus and support drafts are machine-generated and are reviewed by a human before publication. No model takes a decision with legal effect.

Support

If you write to support@flavoso.com, we process your email address, your name and the content of your message in order to answer the request. The legal basis is Art. 6(1)(b) GDPR where a contract is concerned, otherwise Art. 6(1)(f) GDPR. Requests are kept for three years after they are closed so that we know the history if you come back to us; after that they are deleted.

Transfers to third countries

Our data sits in Germany. Three of the providers named above belong to groups headquartered in the United States, so access from a third country cannot be ruled out: Amazon Web Services, Google and Stripe. All three are certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR). In addition, the Commission's standard contractual clauses are agreed with all three (Art. 46(2)(c) GDPR).

Disclosure to public authorities

We disclose data to public authorities only where we are legally obliged to do so. Since 18 August 2026, judicial authorities in all Member States of the European Union may order the production or preservation of data directly from us in criminal proceedings (Regulation (EU) 2023/1543). We check every order for formal defects and hand over only the category of data expressly ordered. The legal basis is Art. 6(1)(c) GDPR in conjunction with that Regulation.

You are informed about an order concerning you by the issuing authority (Art. 13 of the Regulation). We ourselves are barred from informing you where the authority so requires in order not to jeopardise the investigation. Where an order concerns the data of a restaurant's guests, we inform the restaurant as the controller unless we are barred from doing so. A preservation order may mean that a deletion request cannot be carried out for the time being.

How long we store data

• Server log files: seven days.
• Reach measurement: 400 days at most, immediately upon withdrawal.
• Account and business data: for as long as the contract runs, then 30 days for export and restoration, then deletion.
• Orders, reservations and guest data: according to the instructions of the respective business, at the latest until 30 days after the end of the contract.
• Invoices and accounting records: ten years under § 147 of the German Fiscal Code and § 257 of the German Commercial Code. This period takes precedence over a deletion request.
• Support requests: three years after closure.

Your rights

You have the right at any time to:

• access your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on a legitimate interest (Art. 21 GDPR)
• withdraw a consent you have given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, write to imprint@flavoso.com. An account can also pull its data out at any time: under Export in the dashboard, orders, guests, reservations and the menu are available as a file.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany. You may also contact the supervisory authority where you are.

No automated decision-making in individual cases

There is no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). There is no profiling for advertising purposes.

Security of transmission

This site uses TLS encryption. You can recognise an encrypted connection by the “https://” in your browser's address bar. Passwords are stored only as an irreversible hash, and access to a business's data is separated per business at database level.

Changes to this policy

We update this policy as soon as changes in our processing or in the law require it. The current version is always available on this page; the date above states when it was last updated.