Privacy Policy
Last updated: 5 October 2026
1. Who we are
PoftaQR is a digital menu platform for restaurants, cafés and bars. The data operator is a private individual, Ivan Zhantalay, Constanța, Romania, contact: contact@poftaqr.ro. For venue owners’ data the Operator is the controller; for venue guests’ data it is a processor acting on behalf of the venue (section 8). This Policy explains how we collect, use and protect personal data.
2. Data we collect
- Account information: email address, name or company name, VAT number (for business accounts), country.
- Usage data: pages visited, features used, timestamps.
- Payment information: no payments are accepted at present. Once paid plans launch, payments are handled by Stripe as the seller; card details are never passed to the Operator.
- Cookies: technical cookies for authentication and performance analytics.
3. How we use your data
- To provide and maintain the service (create menus, generate QR codes).
- To send transactional emails (account confirmation, technical alerts).
4. Legal basis (GDPR)
We process your data on the basis of: (a) contract performance — to deliver the service you signed up for; (b) legitimate interest — to improve the platform; (c) your consent — for optional cookies and marketing communications.
5. Data retention
We retain your data for as long as your account is active. If you delete your account, all personal data is removed within 30 days, except where we are required to keep it for legal or tax purposes.
6. Your rights
- Access: request a copy of your personal data.
- Rectification: correct inaccurate data.
- Erasure: request deletion of your account and all associated data.
- Portability: receive your data in a machine-readable format.
7. Third-party services
We use Supabase (database and authentication), Vercel (hosting), Zoho (email), Telegram (notifications to the venue about orders, waiter calls and reservations, if the venue enables them), machine translation services (DeepL, Google — menu texts only) and Stripe (payments after paid plans launch, as the seller). Each service has its own privacy policy.
8. Venue guests’ data
When a guest uses a venue’s menu (table order, delivery, reservation, review), we process the data they provide — name, phone, address, order contents, table number — on behalf of the venue and only for these purposes. The venue is the controller of this data; guests can contact the venue or us at contact@poftaqr.ro about it.
9. Contact us
If you have questions about this policy or want to exercise your rights, contact us at: contact@poftaqr.ro