Terms of service

These terms govern the use of the Flavoso software by restaurants and other food businesses (the “customer”).

Notice: pre-production and testing phase

Flavoso is currently in a pre-production setup and testing phase. As long as this notice is shown, these terms do not apply and no binding, paid contract is concluded. The service is provided without warranty and without any guarantee of availability; features, prices and content may change at any time.

1. Provider, scope and who may contract

The provider is Ulrich Henne, Neuffenstraße 4, 71126 Gäufelden, Germany (the “provider”). These terms apply to all contracts between the provider and the customer regarding the use of the software-as-a-service offered at flavoso.com. Deviating terms of the customer do not apply unless the provider expressly agrees in text form.

The offer is addressed exclusively to entrepreneurs within the meaning of § 14 of the German Civil Code, to legal persons under public law and to special funds under public law. No contracts are concluded with consumers. There is therefore no right of withdrawal.

2. Subject of the contract

The provider grants the customer access to web-based software with which the customer can operate their own online ordering system: a public ordering page under its own address, table QR codes, a kitchen display, a dashboard for the business and apps for Android and iOS. The software is provided as a service over the internet; no installation by the customer is required. The scope follows the plan booked, as described on the pricing page.

The provider is not a delivery service, not a point of sale within the meaning of the German cash register regulation and not a payment service provider. It does not broker orders and does not act as a contracting party towards the customer's guests.

Accounting export and process documentation

The software evaluates the recorded orders and provides them as a spreadsheet, as a DATEV posting batch in EXTF format and as process documentation. All three are aids, not tax or legal advice. Which VAT rate applies to which dish or drink, which chart of accounts the customer's tax advisor keeps and which accounts are posted to is decided by the customer or their tax advisor. Rates and account numbers pre-filled by the provider are suggestions, which the customer checks before use.

The process documentation describes the ordering system only. The cash register and its technical security device, cash handling, receipt issuance under section 146a of the German Fiscal Code and the filing of paper receipts are not part of the software; the customer adds those parts themselves. The statutory duty to retain tax-relevant records lies with the customer. They can export their data in a machine-readable form at any time and are expected to do so before the contract ends.

3. Conclusion of contract, registration and contract text

The contract is concluded once the customer account is activated. The customer must provide truthful information at registration, keep their access credentials confidential and report any misuse to the provider without delay.

Before submitting an order, the customer can review their entries on the order screen and correct them using the usual browser functions. The provider confirms receipt of the order without delay by email. The contract text is stored and sent to the customer together with these terms in text form; it is also available in the account. The contract language is German. The applicability of § 312i(1) sentence 1 nos. 1 to 3 and sentence 2 of the German Civil Code is not excluded.

4. Trial period

Where offered, the customer may test the service free for 14 days. The trial does not roll over into a paid contract before the customer actively selects a plan. No data created during the trial is lost.

5. Prices, VAT and payment

The prices shown on the pricing page at the time of order apply. All prices are net prices and are subject to statutory VAT. Subscriptions are billed in advance for the respective billing period.

For customers from another Member State of the European Union who provide a valid VAT identification number, invoices are issued without German VAT; the tax liability passes to the customer under Art. 196 of Directive 2006/112/EC (reverse charge). The customer is responsible for the validity of the VAT identification number provided and reports any change without delay.

The provider charges no commission on orders the customer receives through the software. Payments from the customer's guests are processed via the payment account connected by the customer; the provider never takes possession of these funds. Fees charged by the respective payment service provider are borne by the customer.

6. SMS credit and automatic top-up

SMS notifications to the customer's guests are paid from an SMS credit. Part of it is included in the respective plan and resets monthly; beyond that the customer may purchase SMS packs as one-off purchases. Purchased credit does not expire and is not refunded.

In the settings the customer may switch on the automatic top-up. In doing so they give the provider an authorisation, revocable at any time, to charge an SMS pack of the size they selected to the payment method stored with our payment service provider whenever their chosen threshold is undercut. The customer sets a monthly maximum amount themselves; this is never exceeded. The authorisation, its exact wording and the time it was given are stored. The customer receives an invoice for every top-up. Revocation is done by switching the feature off in the settings and takes effect immediately for all future top-ups.

If an automatic charge fails, the feature is suspended until the end of the calendar month and the customer is informed. SMS sending stops once credit and included allowance are used up; email notifications to guests are not affected.

7. Term and termination

Monthly subscriptions can be cancelled at any time with effect from the end of the current billing period, annual ones from the end of the contract year. The notice period is in no case longer than two months. One-time lifetime licences are not term-bound. Termination is possible in text form, for example by email to support@flavoso.com, and also in the account. The right to extraordinary termination for good cause remains unaffected.

8. Switching to another provider and porting data

The provider supplies a data processing service within the meaning of Regulation (EU) 2023/2854 (Data Act). The customer may switch to another provider or move to their own systems at any time. The provider assists in good faith and supplies the information needed on the structure and format of the data.

After the notice period ends, a transitional period of 30 calendar days begins in which the service remains available for the purpose of switching and the data can be retrieved. If the customer requests it and the switch cannot technically be completed in that time, the period is extended appropriately. Export is done via the export function in the dashboard in a structured, commonly used and machine-readable format (CSV and JSON) and covers orders, order items, guests, reservations, the menu and visitor figures.

The provider charges no separate fee for switching; from 12 January 2027 switching charges are excluded anyway under Art. 29 of the Data Act. After the transitional period ends, the provider deletes all customer data unless a statutory retention obligation applies.

9. Changes to these terms

The provider may change these terms where there is an objective reason, such as a change in the law, a change in case law or a change in the scope of the service. It announces the change in text form at least 30 days before it takes effect and provides the amended wording. If the customer does not object before the change takes effect, the change is deemed accepted; this is pointed out separately in the announcement. If the customer objects, either party may terminate the contract with effect from the date the change takes effect. The customer may waive the period by expressly accepting the new terms.

10. Suspension and termination by the provider

The provider may restrict or suspend access if the customer breaches material obligations under this contract, if illegal content is distributed through the ordering page, or if payment fails to arrive despite a reminder. It states the reasons to the customer, at the latest when the measure takes effect. Where the provider terminates, the notice period is at least 30 days; it is dispensed with only where a legal obligation applies or where there is a repeated serious breach. The customer may complain about the decision informally to support@flavoso.com; the provider reviews it again and answers with reasons.

11. Customer obligations

The customer is responsible for the content they publish and ensures that it complies with the law. This concerns in particular:

• the menu including prices, unit prices and the details required by price indication rules
• the labelling of the fourteen allergens and of additives under Regulation (EU) No 1169/2011 and national implementing rules; machine-generated suggestions from the provider do not remove the duty to check
• their own legal notice and privacy policy on the ordering page; the fields for this are provided in the settings
• compliance with the food, hygiene, trade and tax law obligations of their own business, including record-keeping duties and any obligation to use a certified technical security device at the register
• the rights to uploaded images, logos and texts

The customer may not use the software abusively or unlawfully, in particular not to send unsolicited advertising, to impair availability or to circumvent security measures.

12. Illegal content and notice-and-action

The provider stores the content of the ordering pages on behalf of the customer and is a hosting service provider within the meaning of Regulation (EU) 2022/2065 (Digital Services Act) in that respect. Reports about illegal content are received at support@flavoso.com; the procedure is described in the legal notice. If the provider removes or restricts content, the customer concerned receives a statement of reasons under Art. 17 of the regulation and may object informally.

13. Features using artificial intelligence

Several features use language models: the assistant, the menu import, the translation of the menu and the reply drafts in support. Their results are suggestions and not verified statements. The customer reviews them before publication; this applies in particular to allergens, prices and legally required information. Under Art. 50 of Regulation (EU) 2024/1689 the provider points out that the assistant is an AI system and that imported, translated or drafted texts are machine-generated. Liability for the substantive accuracy of machine-generated suggestions is excluded unless clause 16 provides otherwise.

14. Accessibility

The provider is a micro-enterprise and is exempt, for its services, from the requirements of the German Accessibility Strengthening Act (§ 1(3) no. 4 BFSG). It nevertheless follows EN 301 549 and WCAG 2.1 level AA. Whether the customer is subject to the requirements depends on their own size and their own offering; assessing that is up to them.

15. Availability and maintenance

The provider strives for high service availability. Planned maintenance is scheduled for quiet hours where possible and announced in advance. Force majeure and disruptions outside the provider's control, such as outages at network operators or payment service providers, may lead to temporary limitations. No specific availability rate is guaranteed while the notice about the testing phase is displayed.

16. Liability

The provider is liable without limitation for intent and gross negligence, for injury to life, body or health and under the German Product Liability Act. Otherwise it is liable only for the breach of material contractual obligations, that is obligations whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer may regularly rely, and limited to the foreseeable damage typical for the contract. For the loss of data the provider is liable only to the extent that would have arisen had the customer backed up properly and regularly; the export function is available for that.

17. Rights of use

For the term of the contract the customer receives a simple, non-transferable right to use the software as intended. All rights in the software remain with the provider. The provider acquires no rights in the content the customer publishes beyond what is necessary to provide the service.

18. Data protection and processing on behalf

Information on the processing of personal data can be found in our privacy policy. Where the provider processes personal data on behalf of the customer, in particular the data of their guests, the annex below applies as a data processing agreement under Art. 28 GDPR. It becomes part of the contract upon conclusion; no separate signature is required, and on request the provider supplies it additionally in text form.

19. Final provisions

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods. Mandatory provisions of the state in which the customer is established remain unaffected. Should any provision of these terms be invalid, the validity of the remaining provisions remains unaffected. The place of jurisdiction is, to the extent legally permissible, the provider's registered seat. Amendments and additions require text form.

Annex: data processing agreement (Art. 28 GDPR)

A1 Subject and duration. The subject is the processing of personal data by the provider (processor) for the customer (controller) within the scope of the services described in clause 2. The duration corresponds to the term of the main contract plus the transitional period under clause 8.

A2 Nature, purpose and scope. Processed is data arising in the operation of the ordering page, the kitchen display, reservations and notifications. Data subjects are the customer's guests and the members of their team. Categories of data are: name, email address, phone number, delivery and billing address, order and reservation data including notes, stamp card balances, timestamps and technical identifiers. Special categories under Art. 9 GDPR are not intended to be processed; the customer ensures that no such data is entered into free-text fields.

A3 Instructions. The provider processes the data solely on documented instructions from the customer. Using the features and the settings in the dashboard counts as an instruction. If the provider considers an instruction to infringe applicable data protection law, it says so without delay and may suspend execution.

A4 Confidentiality. Everyone involved in the processing is bound to confidentiality and has been briefed on the basics of data protection.

A5 Technical and organisational measures (Art. 32 GDPR). The provider maintains in particular: TLS encryption of all connections, encryption of backups, separation of data per business at database level via row-level security rules, passwords stored only as a hash, two-factor sign-in for accounts, role and area permissions per person, logging of security-relevant events, daily backups with tested restoration, and separate environments for development and production. The provider may develop the measures further as long as the level of protection is not reduced.

A6 Further processors. The customer grants general authorisation for the use of the sub-processors listed below. The provider imposes the same obligations on them and announces any change at least 30 days in advance; the customer may object and in that case terminate extraordinarily.

• Hetzner Online GmbH, Gunzenhausen, Germany: servers and storage, located in Germany
• Amazon Web Services EMEA SARL, Luxembourg: sending email, processed in the Frankfurt am Main region
• seven communications GmbH & Co. KG, Alzey, Germany: sending SMS
• Google Ireland Limited, Dublin, Ireland: push notifications, map and address services, language models for import, translation and the assistant
• Stripe Payments Europe Limited, Dublin, Ireland: subscription billing and, where connected by the customer, payments from their guests
• HeiGIT gGmbH, Heidelberg, Germany: computing delivery areas by driving distance
• Komoot GmbH, Berlin, Germany and OpenStreetMap Foundation, Cambridge, United Kingdom: searching and checking addresses, and the list of towns
• The destination the customer enters themselves (an e-mail address of their kitchen, or a webhook of their till or merchandise system): transmission of their orders, where they set up forwarding

A7 Assisting the customer. The provider assists the customer by appropriate measures in responding to requests from data subjects and with the obligations under Art. 32 to 36 GDPR. If a data subject contacts the provider directly, it forwards the request to the customer without delay and does not answer itself.

A8 Personal data breaches. The provider reports any breach it becomes aware of to the customer without delay, at the latest within 48 hours of becoming aware, and supplies the information needed for a notification under Art. 33 GDPR.

A9 Deletion and return. After the end of provision the provider deletes the data or returns it, at the customer's choice. Absent a different instruction, deletion follows the end of the 30-day transitional period. Backup copies are overwritten in the regular backup cycle, at the latest after 90 days. Statutory retention obligations remain unaffected.

A10 Evidence and audits. On request the provider demonstrates compliance with its obligations, in particular by providing information and by supplying the description of its technical and organisational measures. On-site audits are possible with reasonable notice during normal business hours and without disrupting operations.

A11 Place of processing. Processing takes place in the European Union. Any transfer to a third country only occurs under the conditions of Art. 44 et seq. GDPR; the providers concerned and the respective basis are named in the privacy policy.

A12 Orders from public authorities. If the provider receives an order from a public authority to produce or preserve the customer's data, in particular a European Production or Preservation Order under Regulation (EU) 2023/1543, it informs the customer without delay unless it is barred from doing so. It checks the order for formal defects, hands over only the category of data expressly ordered, and points the issuing authority to the customer's role as controller where this is permitted. While a preservation order is in force, the provider cannot carry out the customer's deletion instructions for the data concerned; it says so where it is permitted to.