Privacy Policy

In short

• Each restaurant signs up on its own and has its website, its orders, its kitchen and its dining room here. The restaurant decides about its diners' data, and we process it on its behalf.
• We keep what the kitchen, the dining room and the reports need: what was ordered, the name, phone, email and delivery address, the order notes and the allergies the diner declared.
• Diners' personal data is encrypted in our database and removed from orders 90 days after each order.
• Diners' money goes to each restaurant's Stripe account. It never passes through us and we charge no commission per order.
• We do not sell personal data or show ads. Restaurant websites set no cookies, except the session cookie when a diner signs in to their account.
• When a restaurant closes its account, we delete its data within 30 days.

Who we are

Eats All Over is a product of All Over Apps. Write to us at [email protected] for anything about this policy or your data.

Who decides about the data

Account and restaurant data. For the data we need to run a restaurant's account (the people on its team, the restaurant's details, its kitchen and dining room staff and the plan billing), All Over Apps decides how it is used and is responsible for it (controller).

Diner data. The data of the people who order from a restaurant belongs to that restaurant, which is its controller. We process it only to provide the service on its behalf (processor), following its instructions, our Data Processing Agreement and this policy. If you ordered from a restaurant, contact the restaurant first; we help it answer.

Payments. Stripe processes card payments in each restaurant's own account and is also an independent controller of the payment data, under its own privacy policy.

Data about restaurants and their team

When a restaurant signs up and uses the platform we keep:

• Sign-in account: each person's email, their name if they give it, their language and last sign-in, and which restaurant they belong to and with which role (owner or manager).
• Sign-in without passwords: you sign in with a one-time link sent by email, which expires in 15 minutes and works only once (team invitation links last 7 days). We store only a SHA-256 hash of the link. The session lasts 30 days in a cookie, and the server stores only a hash of the session id.
• Restaurant details: the name and legal details (company name, tax ID, address, contact email and phone) for the legal notice on its website; the locations, with their address, phone, opening hours and map coordinates obtained from the address; the delivery zones; the menu (categories, dishes, options, prices, allergens and photos); the stations, printers, tables and settings; and the emails of the team members.
• Kitchen and dining room staff: name, role, locations and a personal PIN, which we keep only as a salted hash.
• Plan billing: the Stripe customer and subscription ids, the plan status, its dates and the number of locations billed. Stripe keeps the card and we never see its number. Stripe Checkout collects the billing address and, if you give it, the tax ID.

Data about diners

• Orders. For each order we keep the number, the dishes and their options, the amounts, the service (delivery, pickup or at the table), the time slot, the name, phone, email (optional), the delivery address and its coordinates, and the notes.
• Allergies. The allergies a diner declares are health data. They are stored with the order, and the kitchen sees them on screen and on tickets.
• Encryption. Diners' personal data is encrypted in our database. The phone number also has a blind index so the restaurant can search orders by phone.
• Dining room. A table's tab keeps the rounds, the dishes, the table's allergies and anonymous diner ids. No names are asked for at the table.
• Payments. Each restaurant connects its own Stripe account. Card details go only to Stripe; we keep the payment status, the amounts and the Stripe ids. The restaurant can also take payment at the venue, in cash or with its card terminal.
• Emails. If the diner gives their email, we send them the order confirmation, and we notify the restaurant of each new order. We send these emails on the restaurant's behalf, through Amazon SES.
• Address search. When a diner types an address on a restaurant's website, our server (not their browser) sends that text to Photon to suggest addresses and to Nominatim to place it on the map (see Providers). The locations' addresses are also placed on the map with Nominatim.
• On the diner's device. The website keeps the cart, the choices made for the order and the contact details of their last order in the browser's storage, without cookies (see Cookies and local storage).
• The restaurant's customers. We group each restaurant's orders by email or, if there is no email, by phone, so the restaurant can see each customer's history: name, contact details, orders, spending and the dates of the first and last order. Each restaurant sees only its own customers. If a customer has no account, their personal data is deleted 90 days after their last order and only the figures remain.
• Customer accounts. A diner can create an account on a restaurant's website with a link sent to their email, without passwords. In it they see their orders, can repeat them and can save delivery addresses. If they ask, we also keep the allergies they want flagged on their next orders (health data, with their consent, which they can withdraw by removing them). They can delete their account whenever they want from the website itself.
• News. If the diner chooses to receive news from the restaurant (when ordering or in their account, never ticked in advance), we keep their consent with the date and where they gave it, and they can withdraw it in their account. The restaurant decides on the news and sends it; we do not write to diners to advertise to them.
• We do not sell diners' data or share it between restaurants.

Kitchen screens, handhelds and printers

• A kitchen screen or a waiter's phone is paired with a 6-digit code that expires in 10 minutes. A waiter's phone can also be paired with a personal one-time link, valid for 3 days, that the restaurant sends them.
• The device keeps a long random token in its local storage. We store only its hash, with the device name, the restaurant and its last activity. The restaurant can revoke a device at any time.
• A waiter's session lasts 12 hours and is tied to their device.
• Printers (Star CloudPRNT and Epson Server Direct Print) check a private address with a token, which we also store only as a hash.
• To prevent abuse we count pairing and PIN attempts. Counters by IP address last 10 minutes, and a locked PIN works again the next day.

Why we use the data

Providers who help us

We do not sell or rent personal data. We share it only with these providers (subprocessors), and only to run the platform:

Stripe is also an independent controller of the payment data, under its own privacy policy. We may also disclose data when the law requires it.

International transfers

Our servers are in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred there. We rely on the European Commission's Standard Contractual Clauses and, where a provider is certified, on the EU-US Data Privacy Framework.

How long we keep data

• Account and restaurant data: while the account is active.
• Diners' personal data in orders: the name, phone, email, address and its coordinates, notes and allergies are removed 90 days after each order. Kitchen history and reports keep the dishes, the amounts, the city and the postal code.
• Customers without an account: their personal data is deleted 90 days after their last order; the figures (number of orders and spending) remain for the restaurant's reports.
• Customer accounts: for as long as the diner keeps them. If they delete their account, or 24 months go by without signing in or ordering, we delete their personal data. Sign-in links expire in 30 minutes and sessions last 90 days.
• Dish photos: until the restaurant changes or removes them.
• Access: sign-in links expire in 15 minutes and invitation links in 7 days. Dashboard sessions last 30 days and waiter sessions 12 hours.
• Devices: pairing codes expire in 10 minutes and personal waiter links in 3 days. Attempt counters last 10 minutes and print jobs are kept for 7 days.
• Backups: kept for 30 days.
• When the account is closed: we delete the restaurant's data within 30 days. Backups that still contain it disappear within another 30 days at most.

How we protect it

• All connections are encrypted (TLS).
• Diners' personal data is encrypted in our database.
• For device and printer tokens, sessions, sign-in links and PINs we store only hashes.
• Pairing codes expire in 10 minutes and pairing and PIN attempts are limited.
• Access to the data is limited to the people who need it to run the platform.
• We make backups of the database.
• If a security incident affects personal data, we notify the affected restaurants without undue delay and within 72 hours of becoming aware of it.

Your rights

You can ask to access, correct, delete or receive your data in a portable format, and to restrict or object to its use. You can also complain to a data protection authority; in Spain, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

Diners: contact the restaurant you ordered from first. We help it answer.

Restaurants and their team: write to [email protected].

Children

Eats All Over is a tool for businesses. We do not knowingly collect data from children under 14 to create accounts.

Changes to this policy

When we change this policy we publish the new version here. If an important change affects how data is used, we tell restaurants by email or in the dashboard with reasonable notice.