This privacy policy explains how personal data is processed when you use Speisando's public pages, dashboard, accounts, communication channels and platform services.
If translated versions differ, the German version prevails.
The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing described in this policy is Philipp Schirmer, trading under the name Speisando, Tannenbergstraße 8, 57234 Wilnsdorf, Germany.
You can reach us at [email protected]. No data protection officer has been appointed because the statutory requirements are not met.
This policy covers the public Speisando pages, registration and login, the customer dashboard, account and team administration, billing, platform communication, support and platform operations.
Restaurant websites made available through Speisando are legally separate. The respective restaurant business is generally the controller for visitor, order and guest data processed on its website; Speisando usually processes that data on its behalf. The restaurant's own privacy policy governs its Matomo analytics, advertising and consent management, web push, Unsplash images and restaurant payment processing. Those services are not dashboard cookies or storage technologies.
Depending on the processing operation, we rely on performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR), legitimate interests (Art. 6(1)(f) GDPR) or consent (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time with effect for the future.
Our legitimate interests include secure and reliable platform operation, defence against abuse, improvement of usability, error analysis, the assertion and defence of legal claims and appropriate business communication. Where Section 25 TDDDG applies to access to terminal equipment, access is limited to what is strictly necessary for the service requested, unless separate consent is obtained.
Cloudflare is used as a reverse proxy, content delivery network and security service. IP address, request and response metadata, security signals and possible Network Error Logging (NEL) data may be processed in Cloudflare's global network. This supports fast, secure delivery and DDoS, bot and attack protection on the basis of Art. 6(1)(f) GDPR.
The dashboard and supporting workers run on Fly.io, primarily in Frankfurt. Application data is stored with Neon in a PostgreSQL database hosted on AWS infrastructure in Frankfurt. Fly.io application logs are generally retained for 7 days; incident-relevant extracts may be kept until the incident is resolved. We operate Matomo ourselves on a STRATO GmbH virtual server in the Frankfurt data centre, Germany.
We use the cookies and browser storage listed below in the dashboard. Technically necessary entries enable login, language selection, security, display preferences and chat continuity. Matomo is not loaded until consent is granted. The support-chat reference uses a versioned local value for no more than 180 days and is removed on expiry or closure; sales chat remains limited to the browser session.
| Entry | Purpose and legal basis | Duration |
|---|---|---|
| Auth.js session cookie | Keeps an authenticated session and protects access; Art. 6(1)(b) GDPR and strictly necessary under Section 25(2) TDDDG. | Until logout, expiry or invalidation of the session. |
| Auth.js OAuth/PKCE cookies | Protects OAuth login against replay and manipulation; Art. 6(1)(b) and (f) GDPR, strictly necessary. | Short-lived for the login process; then deleted or expired. |
| Google link state | Securely links an existing account to Google; Art. 6(1)(b) and (f) GDPR. | 5 minutes. |
| dashboard_locale | Stores the selected interface language; Art. 6(1)(b) and (f) GDPR, strictly necessary for the requested preference. | 1 year. |
| Theme preference | Stores light, dark or system display preference; Art. 6(1)(f) GDPR. | Until changed or deleted in the browser. |
| speisando_dashboard_analytics_consent_v1 | Stores the analytics choice, text version and timestamp. | Cookie for 180 days. |
| Support-chat reference | Continues a support conversation in this browser. | Local storage for up to 180 days; removed earlier on expiry or closure. |
| Sales-chat draft and reference | Continues a sales conversation during the current session. | Session storage until the browser session ends. |
| cf_clearance | Cloudflare pre-clearance after a successful Turnstile security check. | Necessary cookie for 30 minutes. |
We operate Matomo ourselves on a STRATO GmbH virtual server in the Frankfurt data centre, Germany. Analytics remains cookieless and processes page views, cleaned URLs, document titles, login status, role, language, route group, a known tenant ID where applicable, a pseudonymous HMAC user ID including setUserId, and semantic navigation, setup, billing, team and administration events. Email addresses, passwords, secret tokens, database URLs, chat texts, invoice details and form inputs are excluded.
Neither matomo.js nor a tracking request is loaded before consent or after refusal. Once consent is granted, processing is based on Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Cookies remain disabled, URLs remain cleaned and sensitive interfaces remain excluded from visual capture. Consent can be withdrawn for the future using the control above. Matomo retention remains governed by the unchanged effective server configuration.
For registration, login and account administration, we process name, email address, password hash, account and session identifiers, verification status, locale, roles, security events and timestamps. The purpose is to create and secure the account and perform the user agreement (Art. 6(1)(b) GDPR); abuse prevention and evidence of security-relevant events also rely on Art. 6(1)(f) GDPR.
Required account information must be provided to use the dashboard. Verification and password-reset tokens expire after 24 hours. Account and security data is retained for the duration of the contractual relationship and subsequently only as required for legal obligations or legal claims.
These third-party services are used only in the contexts described below.
If you choose Google, Google provides us with account identifiers, name, email address, verification status and profile information approved in the login flow. This simplifies login or links your account (Art. 6(1)(b) GDPR). Google may process data in the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses. The temporary link state expires after 5 minutes.
Turnstile protects registration and public forms against automated abuse. Cloudflare processes IP address, browser and device signals, interaction and verification data. After successful verification, Cloudflare pre-clearance may set the necessary cf_clearance security cookie for 30 minutes. Processing is based on our legitimate interest in secure forms (Art. 6(1)(f) GDPR); terminal access is strictly necessary under Section 25(2) no. 2 TDDDG. Cloudflare may process data outside the EEA under the EU-US Data Privacy Framework and Standard Contractual Clauses.
We process contact and account data, business and restaurant details, team memberships and roles, invitation data, tenant and domain settings, provisioning and deployment statuses, operational identifiers and audit events to provide and administer the subscribed platform services (Art. 6(1)(b) GDPR). Security, traceability and reliable operations also rely on Art. 6(1)(f) GDPR.
Team members may receive data from the inviting owner or editor. Required contract and configuration data must be provided if the corresponding service is to be used. Team invitations expire after 7 days. Operational and audit data is retained for the contract term and afterwards according to statutory duties and objective requirements for security, evidence and legal claims.
For the optional Startklar service, we process uploaded menus, photographs, logos and other supplied files, source links, instructions, checksums, material and workflow status, access roles and audit information. Access is limited to the tenant and authorised Speisando administrators. Processing is necessary for the commissioned content transfer under Art. 6(1)(b) GDPR. Materials supplied in the dashboard are removed 90 days after completion, cancellation or a full refund. Website content and media already published or transferred manually to the Runtime are not affected by this deletion process.
The internal media library stores files, metadata, checksums, categories, share packages and authorised editors. Share links remain valid for 1, 7 or 30 days and can no longer be accessed after expiry or revocation. The Media Manager performs no automatic deletion; files, packages and associations remain until they are deleted manually.
For plan selection, checkout, subscriptions, invoices and payment reconciliation, we process customer and tenant identifiers, plan and price data, billing contact details, tax and transaction information, payment status and Stripe event identifiers. Card details are entered directly with Stripe and are not stored by us in full.
Processing is necessary to take pre-contractual steps and perform the contract (Art. 6(1)(b) GDPR) and to meet tax and accounting duties (Art. 6(1)(c) GDPR). Stripe acts as an independent controller for parts of payment processing and as our processor for other services. Checkout reservations expire after 1 day. Billing records are retained for the applicable statutory retention periods; failed or abandoned checkout data is deleted when it is no longer needed for reconciliation, fraud prevention or legal claims.
We process the contact and message data needed for the chosen communication channel.
The German Brevo/Sendinblue entity shown on our contract or invoice sends verification, password-reset, invitation, status, billing and service emails on our behalf. We transmit recipient address, locale, template, delivery metadata and the necessary message content. Open and click tracking is disabled; delivery, error and bounce processing remains active. The legal basis is Art. 6(1)(b), (c) or (f) GDPR depending on the message.
For terminal email records at least 90 days old, a daily monitored process removes subject, text, HTML, provider ID, error details and sensitive context. The recipient address is pseudonymised with a separate HMAC secret. Dedupe key, template, status, attempt count and timestamps remain as minimal evidence. Queued, running or retryable messages are never redacted.
When you contact us, we process contact data, chat or email contents, attachments, technical references, access and delivery status and timestamps to answer the request and, where applicable, perform the contract (Art. 6(1)(b) GDPR) or pursue our legitimate interest in effective support (Art. 6(1)(f) GDPR). Chat magic links expire after 7 days. Chat content is retained according to the effective configuration, with a standard period of 180 days, unless a shorter deletion request or a longer legal need applies. The local support-chat reference expires no later than 180 days or on closure; sales chat is stored only for the browser session.
For requested status or news updates, we process email address, selected language and topics, subscription and confirmation status, token data and dispatch records. Public subscriptions become active only through double opt-in; confirmation links expire after 24 hours. Signed-in users may activate directly and voluntarily, independently of their account and contract.
The legal basis is consent under Art. 6(1)(a) GDPR. Every grant and withdrawal is recorded append-only with channel, action, source, language, text version, user reference where available and timestamp. Consent can be withdrawn at any time through the unsubscribe option or by contacting us; limited evidence may remain where required for accountability or legal claims.
We use Sentry to detect, analyse and resolve application errors and performance problems. Error type, stack trace, route and release information, technical browser and device data, timestamps, request and trace identifiers and minimised user or tenant references may be processed. Default transmission of personally identifiable information is disabled, sensitive headers are removed and production tracing is sampled at 10 percent.
Processing is based on our legitimate interest in secure and reliable platform operation (Art. 6(1)(f) GDPR). Production events are sent to Sentry's US ingest. Transfers are protected by the EU-US Data Privacy Framework where applicable and Standard Contractual Clauses. Events are retained for 30 days in the Sentry account.
Access is limited to persons and service providers who need the data for the stated purposes. We conclude data processing agreements where required. Transfers outside the EEA take place only where an adequacy decision, the EU-US Data Privacy Framework, Standard Contractual Clauses or another lawful safeguard applies.
| Provider and role | Purpose and data | Location and transfer safeguard |
|---|---|---|
| Fly.io – processor | Dashboard and worker hosting; request, log, account and operational data. | Primary processing in Frankfurt; provider based in the US. DPF/SCCs for any US access. |
| Neon – processor | Managed PostgreSQL database; account, contract, communication and configuration data. | AWS Frankfurt; provider based in the US. DPF/SCCs for any US access. |
| STRATO GmbH – processor | Virtual-server hosting for our self-operated Matomo; pseudonymous analytics and technical log data. | Frankfurt data centre, Germany/EEA; no third-country transfer intended for the selected hosting. |
| Stripe – processor and partly independent controller | Checkout, subscriptions, payments, invoices and fraud prevention. | EU and potentially US; DPF/SCCs and Stripe's applicable transfer safeguards. |
| Brevo GmbH or Sendinblue GmbH – processor | Transactional email plus delivery, error and bounce data; the exact German entity and address are taken from the contract or invoice. | Germany/EU under the contracted DPA and transfer safeguards. |
| Google – independent controller/provider | OAuth login and account linking. | EU and potentially US; DPF/SCCs. |
| Cloudflare – processor and partly independent controller | Reverse proxy, CDN, DDoS/bot protection, DNS, Turnstile and possible NEL/network error data. | Global network and potentially US; DPF/SCCs. |
| Sentry – processor | Error and performance analysis, technical events and minimised references. | US production ingest; DPF/SCCs. |
We primarily receive data from you. Additional sources include Google during OAuth, Stripe webhooks, inviting team members and tenant runtimes for operational and order-related platform events. Fields marked as required are needed for the relevant contract, security check or communication; without them the requested function may not be available.
We delete or anonymise data when its purpose and legal basis cease to apply, unless statutory retention, security incident evidence or legal claims require further restricted storage. Backups follow their technical rotation and are overwritten; data is not restored from backups merely to re-enter normal processing after deletion.
| Data | Period or deletion criterion |
|---|---|
| Google link state | 5 minutes. |
| Verification, reset and subscription tokens | 24 hours. |
| Team invitations and chat magic links | 7 days. |
| Checkout reservation | 1 day. |
| Locale cookie | 1 year. |
| Analytics choice | 180 days; a changed text version triggers a new choice. |
| Support-chat browser reference | Up to 180 days, until closure or earlier invalidation. |
| Sales chat in the browser | Until the browser session ends. |
| Chat content | According to effective configuration; standard 180 days. |
| Accounts, tenants and contract data | For the user or contract term, then deleted or restricted subject to statutory duties and legal claims. |
| Status/news subscriptions | Until withdrawal or unsubscribe; limited consent and suppression evidence only while accountability or legal claims require it. |
| Terminal email content | Redacted after 90 days; pseudonymous minimal evidence remains. |
| Startklar materials | 90 days under the existing cleanup process. |
| Media Manager | No automatic deletion; files, share packages and associations remain until manual deletion. |
| Fly.io application logs | Generally 7 days; incident extracts until resolved. |
| Sentry events | 30 days. |
| Hard-delete evidence | 90 days. |
| Monitoring time series | 35 days. |
| Backup staging | No more than 24 hours. |
| Matomo data | According to the unchanged effective Matomo retention configuration. |
| Billing and audit records | For the contract term and applicable statutory evidence and retention periods. |
Subject to the statutory requirements, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to lodge a complaint with a supervisory authority (Art. 77). You may withdraw consent at any time with effect for the future.
To exercise your rights, contact [email protected]. We may request information necessary to verify your identity. The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).
You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR. We will then stop processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves legal claims. Voluntary Matomo consent can be withdrawn for the future using the control above.
We do not use solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR. Automated security checks may block suspicious requests, but do not make such decisions about a person.
We update this policy when processing operations, legal requirements or service providers change. The date shown above identifies the current version.
Speisando