Privacy Policy

This policy explains which personal data Qaro processes, for what purpose, with whom it is shared and what your rights are. It applies to the website, the web application and the "Qaro Serveur" mobile application.

1. Data controller

The data controller is Qaro Sàrl (CHE-187.788.885), Chemin de Richesson 35, 1000 Lausanne 26, Switzerland. For any question about your data: support@qaro.ch.

When you order at a restaurant via Qaro, that restaurant is also a controller of the data related to your order. Qaro then acts as the provider of the technical solution.

2. Data we process

Guests (diners) who order and pay via a QR code:

• Order details (items, table, any notes, amount).
• Payment data processed by our provider Stripe — Qaro never stores your card number.
• Email address and/or phone number, only if you provide them (receipt, invoice or "order ready" notice).
• Any tip.

Restaurant staff (servers, managers, administrators):

• Email address and password (stored encrypted, never in plain text) for authentication.
• Role and permissions, associated restaurant(s), log of operational actions.
• Device notification token (if push notifications are enabled).

Technical data: information strictly necessary for operation and security (session cookies, technical logs in the event of an error).

3. Purposes and legal bases

We process this data to:

• Enable order taking and payment — performance of the contract.
• Run the floor service, kitchen and administration — performance of the contract and legitimate interest.
• Send a receipt/invoice or an "order ready" notice — on the basis of your request/consent.
• Meet our legal and accounting obligations (retention of supporting documents) — legal obligation.
• Ensure security and fix malfunctions — legitimate interest.

4. Recipients and processors

We never sell your data. It is accessible to the restaurant where you order, and to technical providers (processors) acting on our behalf:

• Stripe — payment processing (PCI-DSS certified).
• Supabase — database and authentication, hosted in Switzerland (Zurich).
• Vercel — hosting of the application and website; application servers in Germany (Frankfurt).
• Sentry — technical error logging.
• Crisp — support messaging (professional area only).
• Apple (APNs) — delivery of push notifications, where applicable.

5. Location and transfers

Your data is hosted in Switzerland (database in Zurich) and in the European Union (application hosting in Frankfurt, Germany). Some providers may process data outside these areas; where applicable, appropriate safeguards (standard contractual clauses) govern these transfers.

6. Retention period

Data related to orders and payments is kept for as long as the applicable accounting and tax obligations require (in principle 10 years in Switzerland, art. 958f CO). Staff accounts are kept as long as access is active, then deleted or anonymized. Data provided solely for a receipt/notice is kept only for as long as strictly necessary.

7. Your rights

In accordance with the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data. To exercise these rights, write to support@qaro.ch.

You may also lodge a complaint with the competent authority (in Switzerland, the Federal Data Protection and Information Commissioner — FDPIC).

8. Security

We implement appropriate technical and organizational measures: encryption of communications (HTTPS), isolation of access by restaurant, permission controls and encrypted storage of sensitive data. As no system is infallible, we cannot, however, guarantee absolute security.

9. Cookies

The service uses only necessary technical cookies (in particular to maintain the session of professional accounts). We do not use advertising cookies or marketing tracking tools.

10. Minors

The service is intended for restaurant guests and their staff. We do not knowingly collect data about children separately from an order placed at the restaurant.

11. Changes

We may update this policy. The applicable version is the one published on this page, with its update date shown at the top of the document.

12. Contact

Qaro Sàrl — Chemin de Richesson 35, 1000 Lausanne 26, Switzerland — support@qaro.ch.