Privacy Policy

This policy explains which personal data Qaro processes, for what purpose, with whom it is shared and what your rights are. It applies to the website, the web application and the "Qaro Serveur" mobile application.

1. Data controller

The data controller is Qaro Sàrl (CHE-187.788.885), Chemin de Richesson 35, 1000 Lausanne 26, Switzerland. For any question about your data: support@qaro.ch.

When you order at a restaurant via Qaro, that restaurant is also a controller of the data related to your order. Qaro then acts as the provider of the technical solution.

2. Data we process

Guests (diners) who order and pay via a QR code:

• Order details (items, table, any notes, amount).
• Payment data processed by our provider Stripe — Qaro never stores your card number.
• Email address and/or phone number, only if you provide them (receipt, invoice or "order ready" notice).
• Any tip.
• For a pickup or delivery order: your name, the desired pickup time and, for delivery, your address.

Guests who book a table:

• Name, phone number and/or email address, date, time and number of guests.
• These details are used to manage the booking and to send you a confirmation and a reminder (by SMS or WhatsApp), from which you can confirm or cancel.

Restaurant staff (servers, managers, administrators):

• Email address and password (stored encrypted, never in plain text) for authentication.
• Role and permissions, associated restaurant(s), log of operational actions.
• Device notification token (if push notifications are enabled).

Technical data: information strictly necessary for operation and security (session cookies, technical logs in the event of an error).

3. Purposes and legal bases

We process this data to:

• Enable order taking and payment — performance of the contract.
• Run the floor service, kitchen and administration — performance of the contract and legitimate interest.
• Send a receipt/invoice or an "order ready" notice — on the basis of your request/consent.
• Manage table bookings and send you a confirmation and a reminder (SMS or WhatsApp) — on the basis of your request.
• Meet our legal and accounting obligations (retention of supporting documents) — legal obligation.
• Ensure security and fix malfunctions — legitimate interest.

4. Recipients and processors

We never sell your data. It is accessible to the restaurant where you order, and to technical providers (processors) acting on our behalf:

• Stripe — payment processing (PCI-DSS certified).
• Supabase — database and authentication, hosted in Switzerland (Zurich).
• Vercel — hosting of the application and website; application servers in Germany (Frankfurt).
• Google (Maps Platform) — address autocomplete and travel-time estimation for pickup or delivery orders; only the address you enter is transmitted.
• Telnyx — delivery of SMS and WhatsApp messages ("order ready" notice, booking confirmations and reminders); WhatsApp messages transit through Meta's WhatsApp platform.
• Resend — sending of transactional emails (receipts, invoices, sign-in links, booking confirmations).
• Apple — push notifications (APNs) and, for restaurants that use it, contactless card reading (Tap to Pay on iPhone; the payment itself is processed by Stripe).

5. Location and transfers

Your data is hosted in Switzerland (database in Zurich) and in the European Union (application hosting in Frankfurt, Germany). Some providers may process data outside these areas; where applicable, appropriate safeguards (standard contractual clauses) govern these transfers.

6. Retention period

Data related to orders and payments is kept for as long as the applicable accounting and tax obligations require (in principle 10 years in Switzerland, art. 958f CO). Staff accounts are kept as long as access is active, then deleted or anonymized. Data provided solely for a receipt/notice is kept only for as long as strictly necessary.

7. Your rights

In accordance with the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data. To exercise these rights, write to support@qaro.ch.

You may also lodge a complaint with the competent authority (in Switzerland, the Federal Data Protection and Information Commissioner — FDPIC).

8. Security

We implement appropriate technical and organizational measures: encryption of communications (HTTPS), isolation of access by restaurant, permission controls, two-factor authentication (2FA) available for professional accounts, and encrypted storage of sensitive data. As no system is infallible, we cannot, however, guarantee absolute security.

9. Cookies

The service uses only necessary technical cookies (in particular to maintain the session of professional accounts). On the client side, after a payment, a temporary technical cookie (about 2 hours) may be set to avoid an accidental repeat order, and your cart contents are kept locally in your browser; these items serve only the proper functioning of the order. We do not use advertising cookies or marketing tracking tools.

This public website sets no cookies and uses no analytics tool. It only stores, in your browser's session storage, a technical flag used to avoid replaying the intro animation; it contains no personal data and is discarded when the tab is closed.

10. Minors

The service is intended for restaurant guests and their staff. We do not knowingly collect data about children separately from an order placed at the restaurant.

11. Changes

We may update this policy. The applicable version is the one published on this page, with its update date shown at the top of the document.

12. Contact

Qaro Sàrl — Chemin de Richesson 35, 1000 Lausanne 26, Switzerland — support@qaro.ch.