Data and privacy

Where the data sits#

On servers in Germany. Orders, menus and guest data are not passed on to third parties and not used for advertising. Data only goes to an app if you connect it yourself, and only as far as the permissions you agreed to.

There is no resale of guest data, to anybody. That is the difference an ordering channel without a middleman makes: your guest's address belongs to you and to them.

Measuring#

Without the visitor's consent nothing is measured, not even anonymously. Whoever agrees is counted: page views, where they came from, kind of device, country.

The country comes from the browser's time zone, not from the IP address. That is less precise, and in exchange it is not location data.

No Google Analytics runs alongside, and no other outside service either.

What the restaurant has to do itself#

In law the ordering page belongs to the restaurant. The legal notice and the privacy policy are therefore its responsibility, and Flavoso supplies building blocks for them that describe what happens technically on that page.

You enter both under Settings, Contact & legal (or in the setup wizard), and both then appear as their own line at the foot of your ordering page, on the table and reservation pages too. The easiest way to do the legal notice is the form, which turns into the text in every language of the ordering page; alternatively you link your own page (the address has to start with https://) or write the text yourself. As long as one of the two is missing, your ordering page isn't live: guests see “This page is being set up”, you see it as a preview, and the dashboard tells you what is missing.

• Legal notice: required by § 5 of the German Digital Services Act. Name, legal form, an address that can be served with process, phone and e-mail, plus register entry and VAT ID where they exist. The form asks for exactly that.
• Privacy policy: required by Art. 13 GDPR, because your ordering page collects names, phone numbers and delivery addresses. You are the controller for them, not Flavoso; there we are your processor.
• Terms: optional. Without them the law applies.
• Right of withdrawal: not your problem. There is none for prepared food (§ 312g(2) nos. 2 and 9 German Civil Code), and the ordering page says so by itself, in the guest's language.
• Allergens: required by Art. 14 of the Food Information Regulation, and BEFORE the order is sent. The ordering page shows them on the dish as soon as you have entered them in the menu.

Not a substitute for legal advice#

The building blocks are a draft and not legal advice. If you want to be safe, have somebody who is allowed to do that look at them once.

And one special case that is easily missed: since 28 June 2025 the German Accessibility Strengthening Act applies to ordering systems too. Micro-enterprises (fewer than ten employees and at most two million euros in annual turnover) are exempt. Anyone above that checks the requirements for their own offering; Flavoso aligns its interfaces with WCAG 2.1 level AA anyway.

Who else is involved#

A few features need service providers, and every one of them is named in the dashboard and in the privacy policy: the server operator in Germany, the payment provider for online payment, the SMS sender for SMS, Google for maps, address suggestions and reviews, and Google Gemini for the menu import and the AI help.

For the AI import the uploaded menu is processed, not stored permanently and not used for training.