Privacy Policy

MobiTaste is operated independently. For all privacy questions, the controller is the operator of MobiTaste, contactable at hello@mobitaste.com. We will update this section with the registered legal entity once it is in place.

Account data: email address, hashed password (argon2), preferred language, and an optional display name. If you sign up via an organization invite, the email of the inviting account is also stored.

Restaurant data: information you enter into your workspace — restaurant name, slug, currency, menu categories and items, table names and tokens, business policies (waiter approval, session caps), staff invites.

Order data: guest carts, orders, prices at the time of order, table session identifiers, audit-log entries for status transitions. Guests are not asked to identify themselves — orders are tied to a table session token, not to a person.

Billing data: when you start a paid subscription, our billing partner (Paddle) collects payment-method data on its own infrastructure. We receive only a non-sensitive subscription identifier and your plan tier. We never see your card details.

Technical data: server access logs (IP, user-agent, path, timestamp) kept for 30 days, used for abuse detection and incident response. Cookies for authentication (httpOnly + Secure). We run a self-hosted Umami analytics instance for aggregate page views — it does not use third-party cookies or build cross-site profiles.

To provide the service you signed up for: render your menu, route orders to staff, send transactional emails (email verification, password reset, billing receipts).

To bill you accurately and process payments via our subscription partner.

To investigate incidents: abuse, security events, performance issues. Server logs are accessed by us only, on an as-needed basis.

To improve the product: aggregate, anonymous usage analytics (which pages get traffic, which features get used). We do not profile individual users.

Contract performance: storing your account, restaurant configuration, and orders is necessary to deliver the service you signed up for (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

Legal obligation: retaining billing records is required by tax law (GDPR Art. 6(1)(c); KVKK Art. 5(2)(a)).

Legitimate interest: keeping access logs to detect abuse and operate the service securely (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

Paddle.com inc. — our merchant of record for payments. Paddle receives your name, billing email, and payment details directly; we receive only an identifier and subscription state.

Hosting: our infrastructure is operated on Hetzner Cloud servers in Germany. Hetzner is a data processor for storage and network purposes only — they do not access your data.

Transactional email: we send signup confirmations and billing receipts via a third-party SMTP provider. Only the recipient address and message content (subject, body) are shared.

We do not sell data, share it with advertisers, or hand it to third parties for marketing purposes.

All primary data is stored in Germany (EU). Backups are kept in the same jurisdiction. No data is transferred outside the EU/EEA, except for payment processing performed by Paddle (which has its own SCCs and adequacy framework).

Account and restaurant data: until you delete your account. After deletion, we retain a 90-day soft-delete window in case of accidental removal, then we hard-delete.

Order data: retained as long as your account is active. After deletion, hard-deleted along with the account except where law requires us to keep billing-related records (typically 5 years for Turkish tax law, 7 years in some EU jurisdictions).

Audit log: 7 years from the event, then hard-deleted. This supports fraud investigation and statutory obligations.

Access logs: 30 days.

We set a small number of cookies, all first-party:

access_token / refresh_token: httpOnly + Secure, used to keep you signed in.

locale: stores your language preference.

We do not use third-party advertising or tracking cookies. Our self-hosted analytics uses cookieless visitor counting.

Under GDPR and KVKK you can: access the data we hold about you, correct inaccuracies, request deletion, request a portable export, object to processing, withdraw consent (where consent is the basis), and lodge a complaint with your data protection authority.

To exercise any of these rights, email hello@mobitaste.com from the address on your account. We respond within 30 days.

MobiTaste is not intended for users under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.

We may update this policy as the service evolves. If we make a material change (anything that meaningfully affects what we collect or how we use it), we will email all account holders at least 14 days before it takes effect.

Privacy questions, data requests, or complaints: hello@mobitaste.com.