Privacy Policy

Tavelo is operated by Luis Angel Romero Castillo as an individual under the trade name "Tavelo":

• Tavelo, Luis Angel Romero Castillo
• Bremgartnerstrasse 118, 8953 Dietikon, Switzerland
• Email: support@tavelo.ch

For privacy requests, please contact support@tavelo.ch.

• Guest data (orders, reservations, loyalty memberships, marketing consent): the restaurant decides whether and how it uses Tavelo for this and is generally responsible for this data. Tavelo processes it on the restaurant's behalf and according to its instructions (as a processor).
• Tavelo's own data: Tavelo itself is responsible for administering restaurant and staff accounts, billing restaurants, security and abuse prevention, support and legal obligations.

Guests can contact the restaurant or Tavelo with questions about their data; we forward requests to the restaurant where needed.

• Restaurant operator accounts: name, email address, phone number (if provided), restaurant and location details, role and sign-in sessions. Passwords are managed by the authentication service; Tavelo never sees them in plain text.
• Staff accounts: name, email address, role (e.g. owner, manager, waiter, production), station assignments and records of actions in the dashboard (e.g. who accepted an order or marked it as paid).
• Guest order data: table, ordered items and options, quantities, prices, notes to the kitchen, timestamps, status and whether an order was marked as paid. Ordering requires no account. Tavelo does not process payment card data; payment happens outside Tavelo, directly with the restaurant.
• Reservation data: date, time, party size, name, email address (required for the confirmation), phone number, special requests, language, status history and the restaurant's internal notes.
• Loyalty memberships (where a restaurant offers a programme): email address, first name (optional), visits or points, rewards and voucher codes, linked paid orders and a random access key for the rewards page.
• Email one-time codes (OTP): when joining a loyalty programme, we email a six-digit code. We store the email address, the code only as a hash, timestamps and the number of attempts.
• Wallet identifiers: when a guest adds a loyalty card to Apple Wallet or Google Wallet, we store the card identifiers and, for Apple, the registration and push identifiers reported by the guest's device, so the card can be updated.
• Marketing consent: whether a guest agreed to receive offers from that restaurant, with the time, source and version of the consent wording, and any later withdrawal.
• Marketing through Apple / Google Wallet: a restaurant's offers are delivered only to guests who consented, as a message on their loyalty card. We store the campaign, the recipients and whether Apple or Google accepted the delivery.
• Billing metadata: values of paid orders and the number of successfully delivered marketing messages, from which Tavelo calculates its fees to the restaurant. No guest payment data.
• Operational analytics: aggregated sales, order and reservation overviews for the restaurant, calculated from the data above.
• Technical and security data: IP addresses, browser and device information, request and error logs of our hosting providers, and operational and security logs.
• Support requests: content and sender of your messages to support@tavelo.ch.
• Restaurant media: menu images, logos and cover images uploaded by restaurants; they are publicly accessible because guests see them on the menu.
• AI features (where enabled): text a guest types into the AI reservation assistant, and menu texts and order notes that are translated. When importing a menu, the restaurant uploads photos of its printed menu or a PDF (the PDF pages are converted to images in the browser; only these images are transmitted); they are sent to OpenAI for text recognition and are not stored by Tavelo. Only the recognised menu text (categories, dishes, descriptions, prices) and a design suggestion (template, colours, short reason) are stored as a draft in the restaurant's account, together with technical details of the import (time, account that started it, number of photos, status). The photos should not show people or personal data.
• Online orders (Click & Collect and delivery, where a restaurant offers them): name, phone number, email address (optional), for delivery the address (street, postal code, city, notes such as floor or doorbell), ordered items and options, notes, the chosen pickup or delivery time, the order status and its history (including the staff member who accepted, rejected or completed the order) and a random access code for the order status page. Online orders require no account and involve no online payment: the guest pays the restaurant at pickup or on delivery. The restaurant is responsible for this data; Tavelo processes it on the restaurant's behalf (see "Who is responsible for what").

• Providing the service: sending orders to kitchen and bar, managing tables and reservations, sending reservation emails.
• Loyalty programmes, rewards and digital loyalty cards where a restaurant offers them.
• Delivering a restaurant's offers to guests who consented.
• Overviews and analytics for the restaurant.
• Billing Tavelo's fees to restaurants.
• Security, access limited by restaurant and role, abuse prevention.
• Operation, troubleshooting and support.
• Compliance with legal obligations (e.g. keeping business records).
• Online orders: passing the order request to the restaurant, accepting or rejecting it, preparing and handing it over or delivering it, contacting the guest about the order (e.g. by phone), checking whether the address is in the restaurant's delivery area (by postal code only) and preventing abuse (e.g. limiting open orders per phone number).

Tavelo makes no automated individual decisions with legal effect for guests and does not build advertising profiles.

We process personal data in line with the principles of the FADP. Where the GDPR applies, we rely on:

• Contract or pre-contractual steps (Art. 6(1)(b) GDPR): order, reservation, loyalty membership, restaurant contract.
• Legitimate interests (Art. 6(1)(f) GDPR): security, abuse prevention, operating and improving the service.
• Consent (Art. 6(1)(a) GDPR): marketing offers through the loyalty card. Consent is voluntary and can be withdrawn at any time.
• Legal obligation (Art. 6(1)(c) GDPR): e.g. accounting and record-keeping duties.

For guest data that Tavelo processes on behalf of a restaurant, the restaurant, as controller, determines the legal basis.

The restaurant and its authorised staff see their restaurant's data. Other restaurants have no access.

Tavelo uses the following providers as subprocessors: Supabase (database, sign-in, file storage), Vercel (hosting), Resend (email delivery), Amazon Web Services (email delivery via Amazon SES) and OpenAI (only for AI features, where enabled). Details: https://tavelo.ch/subprocessors

Apple and Google operate their Wallet apps as independent providers under their own terms and privacy policies. When a guest adds a card, they receive the card content (restaurant, first name, balance, membership code, offer message). Apple and Google do not sponsor or endorse restaurants' loyalty programmes.

Authorities receive data only where we are legally obliged to disclose it.

Online orders: the restaurant's authorised staff see the guest's name, phone number, email address and delivery address. The guest sees the order through the status link; anyone who knows this link sees the status, items, notes, name and delivery address (but not the phone number or email address) and can cancel the order until the restaurant accepts it, so the link should not be shared. Tavelo sends the guest no messages about online orders.

Some providers process data outside Switzerland, in particular in the United States (for example, Tavelo's server functions run at Vercel in the US). Where a country does not offer an adequate level of data protection, we rely on recognised safeguards, in particular the European Commission's standard contractual clauses with the adaptations required for Switzerland, or — where a provider is certified — the Swiss-U.S. Data Privacy Framework. Details per provider: https://tavelo.ch/subprocessors

Tavelo uses no advertising or analytics trackers and sets no advertising cookies. The browser only stores what the requested function needs: the staff sign-in session, chosen languages, the selected location and kitchen station in the dashboard and — after joining a loyalty programme — a random access key for the rewards page. You can remove it with "Forget me on this device" on the rewards page or in your browser settings.

Tavelo does not currently delete all data automatically. Specifically:

• Orders, reservations, loyalty memberships, Wallet identifiers and campaign data are kept while the restaurant uses Tavelo. After the contract ends they are exported on request and then deleted in accordance with the data processing agreement; export and deletion are currently carried out manually by Tavelo.
• Email one-time codes expire after 10 minutes; the related requests (including the email address) are deleted automatically after 30 days.
• The marketing consent history is kept while the loyalty membership exists, so that consent and withdrawals can be proven.
• Records of sent reservation emails contain neither the email address nor the message content.
• Billing records are kept for the statutory retention period (in Switzerland generally 10 years, Art. 958f Code of Obligations).
• Tavelo does not store conversations with the AI assistant; they exist only in the guest's browser tab.
• Providers' technical logs are deleted according to their retention periods. Backups are overwritten in the backup cycle.
• Online orders, including contact details and delivery address, are kept like other orders while the restaurant uses Tavelo (see above). No automatic deletion is currently set up.

You can request deletion at any time at support@tavelo.ch, subject to statutory retention obligations.

• All connections are encrypted (HTTPS).
• Access is limited by restaurant and role and enforced in the database itself.
• Credentials for external services stay on the server and are never sent to browsers.
• Guest links use long, random, unguessable codes; one-time codes are stored only as hashes.

No system is perfectly secure. We keep improving our measures.

Within the applicable law, you have the right to access, rectification, erasure, receipt or transfer of your data, to object to processing and to withdraw consent. Write to support@tavelo.ch. We may need to verify your identity; for data a restaurant is responsible for, we involve that restaurant.

You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC): https://www.edoeb.admin.ch. People in the EU/EEA may also contact the data protection authority of their country.

Consent to offers is voluntary, applies per restaurant and is separate from joining the loyalty programme. You can withdraw it at any time with the "Marketing offers" switch on your rewards page or by emailing support@tavelo.ch. After withdrawal you no longer receive offers from that restaurant; your points, rewards and loyalty card are not affected.

An online order does not create a loyalty membership or marketing consent. Tavelo does not use the phone number or email address from an online order for offers.

We update this Privacy Policy when our processing changes. The version shown above applies.