Privacy Policy
Last updated: October 2026
1. Data controller
Vezzoly is the name of the project and of the digital platform available at https://vezzoly.com, currently in a development and free-launch phase. The data controller is Salma Kadimi Ed Dini, owner of Vezzoly.
Contact: info@vezzoly.com, or the WhatsApp contact button available on the website. The remaining identification details of the owner (tax ID and address) will be published before the service starts to be charged for, including fees on integrated payments.
Vezzoly determines how the data of platform accounts and of people who contact the project is processed. When a restaurant uses Vezzoly to manage its diners' orders, the restaurant is the controller of that data and Vezzoly processes it on the restaurant's behalf, under the terms applicable to the service.
2. Data we collect
- Registration data: name, email address, a password stored using appropriate protection techniques, preferred language and, if configured, a security PIN.
- Sign-in with Google: the identifier of the Google account linked to the user, if this feature is used. Vezzoly does not receive your Google password.
- Restaurant data: name, logo, menu link, brand colour, Google reviews link, tables, products, prices, allergens and menu translations, when the restaurant enters them.
- Operational data: orders, amounts, statuses and related technical data. If the payments integration is activated, Vezzoly may store Stripe identifiers but does not store full card numbers.
- WhatsApp contact data: phone number, profile name and message content, when a person contacts Vezzoly through that channel.
- Technical and security data: access logs, IP address and browser type, to the extent they are recorded to maintain the security and operation of the service.
3. Purpose and legal basis
We process data for the purposes below, and only when the corresponding feature is used. We do not make automated decisions with legal effects on individuals.
- Creating and managing accounts and providing the requested features: performance of a contract or pre-contractual measures where applicable (Art. 6(1)(b) GDPR).
- Answering requests for information, demos or help: handling the request of the person concerned and, where appropriate, taking pre-contractual steps (Art. 6(1)(b) GDPR).
- Maintaining security, preventing abuse and resolving incidents: legitimate interest, after weighing the rights of the people concerned (Art. 6(1)(f) GDPR).
- Complying with applicable legal obligations (Art. 6(1)(c) GDPR).
4. Diners' data
When a restaurant uses Vezzoly's QR menu and table ordering, the restaurant is the controller of its diners' data. Vezzoly processes it only on the restaurant's behalf and following its instructions, as a processor (Art. 28 GDPR), under the annex to the Terms of Service.
Vezzoly does not ask diners for their name, email or phone number. The data processed are the order, the table, the amounts, the IP address and technical data, and any free-text notes the diner chooses to write, which may include information about allergies or intolerances and are used only to prepare the order.
If the restaurant activates integrated payments, card payment takes place on Stripe's page; Vezzoly does not receive or store full card details.
5. Data retention
- Account and restaurant data: while the account is active and the data is needed to provide the service. If cancellation is requested, the data will be deleted or made unavailable within a maximum of 30 days, unless certain data must be kept for legal obligations, security or the defence of claims.
- Contact messages (by email or WhatsApp): while the request is being handled and, if the person does not become a user, for up to 12 months after the last message.
- Technical and security logs: for the time needed to maintain security and resolve incidents, which is generally a few weeks.
6. Recipients and international transfers
The platform's database and server are hosted in the European Union (IONOS, Frankfurt, Germany). Depending on the features used, Vezzoly relies on the following providers, with whom the processing terms required by law are put in place:
- IONOS — hosting of the platform server (Frankfurt, Germany, EU).
- Cloudflare R2 — image storage (dish photos, logos), Western Europe (EU) region.
- Resend — sending account emails (welcome and password or PIN recovery).
- OpenAI — importing and translating menus with artificial intelligence; only menu content is sent, never diners' data.
- Google Ireland Limited — sign-in with Google.
- Stripe Payments Europe, Ltd. — payments, when the restaurant activates integrated payments; Stripe also verifies the restaurant's identity as an independent controller.
- WhatsApp Ireland Limited (Meta) — contact channel, if the person decides to use the WhatsApp button.
Some of these providers (for example Resend, OpenAI, Stripe and Meta) may process data outside the European Economic Area. In that case, the transfer relies on appropriate safeguards under Chapter V GDPR, such as adequacy decisions or standard contractual clauses.
7. Security
Appropriate technical and organisational measures are applied: encrypted communications over HTTPS, protected storage of passwords, lockout after failed PIN attempts and role-based access control within each restaurant.
8. Your rights
Individuals may exercise the rights granted by data protection law: access, rectification, erasure, restriction, objection and, where applicable, portability and withdrawal of consent. To make a request, write to info@vezzoly.com. We will reply within a maximum of one month.
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at https://www.aepd.es.
If your request concerns data from an order placed at a restaurant, contact the restaurant first, as it will normally be the controller of that data.
9. Changes to this policy
This policy may be updated if features, providers or applicable obligations change. The current version will be available on the website. Where necessary, changes will be notified by email or through a notice on the platform.