Privacy Policy

What Ordevia collects, why, who it reaches, and the rights you have over it.

Version 2.4 · Effective 3 October 2026

Who is responsible

Ordevia is a digital menu and ordering service for restaurants, operated by a registered business. The operator's full registration details, country of registration included, are provided on request to any customer, data subject, or competent authority — write to support@ordevia.app. Throughout this policy, "Ordevia", "we" and "us" mean that operator.

Ordevia provides restaurants with a digital menu that diners open by scanning a QR code at their table, together with the ordering, kitchen and service tools behind it. Questions about this policy, or any request about your data, go to support@ordevia.app.

Two different relationships are covered here. When a restaurant signs up, we hold data about that business and its team. When you scan a QR code as a diner, we hold a small amount of data about that visit — you never create an account, and we want to keep it that way.

If you scanned a QR code (diners)

Scanning a QR code opens a temporary session so the menu can remember your basket and show you the orders you placed. We collect the minimum needed for that to work and for the restaurant to spot abuse of its QR codes.

Session record: The public IP address of the device you scanned with, a coarse device marker, and the start and expiry times of the session. The IP address lets us recognise a returning device during the same visit and helps a restaurant see when its QR image has leaked outside the venue.
Information about your device: What kind of device you opened the menu on: whether it is a phone, tablet or computer, its operating system and major version (for example Android 14), and which browser you used. On Android devices we also record the model code the browser reports, such as SM-S911B. We do not store the full technical description your browser sends, and we never use any of this to recognise you on other websites. Restaurants use it to answer practical questions — whether their menu needs to work well on older phones, or whether most of their guests arrive from a link shared in a messaging app. It is attached to your ordering session and deleted with it.
Location check: If you allow it, your browser gives us your coordinates so we can measure how far you are from the restaurant. We store only the result of that measurement — a flag meaning near, far, permission refused, or unavailable. Your latitude and longitude are used for that calculation and are never written to our database.
Your phone number, for a takeaway order only: If you order to take away, the restaurant may ask for a phone number so it can call you when your food is ready. It is used for that and nothing else: it is shown to the restaurant's own staff on the screen holding your order, it is never used to market anything to you, and it never leaves the restaurant that took the order. Each restaurant decides whether to ask at all — if yours does not, no number is collected. You are asked on the ordering screen, before the order is sent, so choosing not to give one simply means not placing that order.
How long the restaurant keeps your number: Until it deletes it. The restaurant can see the numbers that have ordered from it, how many times each one has ordered and what it spent, so that it can recognise a regular. Ask the restaurant to erase your number and it can do so in one action: the number is removed from every order it appears on, and the orders stay without it. A restaurant can also refuse a number, in which case that number cannot place another order there — that decision belongs to that restaurant alone and means nothing at any other.
Your name and number, when you book a table: If you ask the restaurant for a table, it needs a name to hold the booking under and a phone number to reach you on — to confirm it, or to tell you if it cannot. If you ask the staff in person instead — at the door while the restaurant is full, or over the phone — they can write you onto the same list themselves: a name is needed, and a number only if you choose to give one. Both are shown to that restaurant's own staff on the screen that holds the booking, are used for nothing else, are never used to market anything to you, and never leave the restaurant you booked with. Anything you type in the note is passed straight to the same screen, so please do not put personal details there. Each restaurant decides whether it takes bookings at all — if yours does not, the button is not shown and nothing is collected.
How long the restaurant keeps a booking: Until it deletes it. A restaurant keeps its past bookings so it can count how many people it seated, how much notice guests give, and how often a booked table went empty. Ask the restaurant to erase your details and it can remove them. You can cancel a booking yourself from the menu at any time before you arrive, and a booking you cancel is kept only as a cancelled entry in that restaurant's own record.
Your name, number and address, for a delivery: If you order a delivery, the restaurant needs a name, a phone number and where to bring the food: an address you type, any directions you add — a floor, a door, a landmark — and a pin on a map. If you tap "Use my current location", your browser gives us your position once to place that pin; you can move it before you confirm, and only the pin you confirm is kept. We also keep the distance from the restaurant and the delivery fee it produced. All of this is shown to that restaurant's staff and to the courier who brings your order — the courier sees your name, number, address, directions, pin and the amount to collect, and only while the order is his. It is never used to market anything to you and never leaves the restaurant you ordered from. The random device number described below is attached to the delivery, so that a restaurant can stop a device that keeps placing fake orders.
Your delivery details, saved on your phone: So you do not have to type them again, your name, your number and up to five delivery addresses are saved in your browser's own storage on your phone. They stay on your phone — we receive them only as part of an order you place. "Forget my details" on the delivery screen removes them, and so does clearing your browsing data for this site.
How long the restaurant keeps delivery details: Until it deletes them, exactly like a takeaway number. Ask the restaurant to erase your number and it removes, in one action, the number, your name, your addresses, the map pins and the device link from every delivery it appears on; the orders and their amounts stay. The restaurant sees whether a number has ordered from it before and how many of its deliveries could not be completed, so it can be careful with a new or unreliable order. A restaurant can refuse a number, which also refuses the phones that ordered deliveries with it — at that restaurant only. Ordevia itself may refuse a number on every restaurant when it has been used for fake orders at several.
Your courier's name and number: While your delivery is being prepared and brought to you, the order screen shows the first name of your courier, and — only once he has your food and is on his way — the phone number on his account, so you can call him. That number disappears from the screen once the order is delivered. The restaurant's own number is shown with every delivery so you can always reach it.
A robot check on online orders: Orders placed from a restaurant's general link — the one it shares online, not the QR code on your table — pass an invisible check by Cloudflare Turnstile that confirms a person is ordering. Cloudflare receives your IP address and information about your browser for that check and nothing else.
Orders and messages: The items you order, any note you attach to them, and any message you send when calling a waiter. Please do not put personal details in a free-text note — it is passed straight to the restaurant's kitchen and service screens.
Three cookies: The first holds the identifier of your ordering session, so the menu can remember your basket and your orders. The second holds a random number that stands for your device, so the restaurant's visitor count does not go up every time you reload the page — a device counts once a day, however often it looks. The third simply remembers which language you are reading the menu in, so it opens in that language next time: it holds a restaurant's short name and a language code, nothing more. None of them holds your name, your location, or anything about you. The first two are signed so they cannot be tampered with and are not readable by scripts; all three are ours alone — they are never sent to any other company and cannot follow you to any other website. We use no advertising cookies and no cross-site tracking cookies.
A copy of the device number, kept in your browser: The same random device number is also stored in your browser's own storage, so that a device is still recognised as itself if the cookie is removed by the browser — which happens routinely, for reasons that have nothing to do with you. It is the same number and nothing more; clearing your browsing data for this site removes both copies together.
A fourth cookie, only on a restaurant's own devices: If somebody who works at the restaurant opens their own menu from their dashboard, we mark that device so their visits are not counted as customer visits. The mark holds the restaurant's short name, nothing about the person, and the menu shows a small badge saying so with a one-tap way to remove it. It never appears on a guest's device.

You never need an account, and we never ask for your email. A name, a phone number or an address is asked for only when what you are doing needs one — a takeaway, a delivery or a booking. We do not track you across restaurants or across the web, we do not build a profile of you, and we do not sell or share your data with advertisers.

You pay the restaurant directly — at the table, at the counter, or in cash to the courier at your door. No payment is ever taken through Ordevia, so we hold no card or banking details of any kind.

If you run or work at a restaurant

Your account: Your email address and a securely hashed password, held by our authentication provider, plus your role in the restaurant and when you signed in.
Your restaurant: Its name, address, coordinates, phone number, opening hours, menu, photographs and settings. For a small owner-run venue some of this identifies a person, so we treat it with the same care.
Team activity: An activity log recording who did what — publishing a menu, changing settings, inviting a colleague — with the name, email and role of the person who did it. It exists so an owner can see what happened in their own restaurant.
Invitations: The email address, and optionally the phone number, of a colleague you invite, until the invitation is accepted or revoked.
Notifications: Your notification preferences, the notifications sent to you, and — if you enable them — the browser subscription details needed to deliver push notifications, including your browser's user-agent string.
Subscription: Your plan, trial and billing period dates, and a history of the changes made to them. Invoices are issued and paid outside the platform; we hold no card details.
Security records: IP addresses of failed staff-PIN attempts, kept to block brute-force guessing of the code that unlocks kitchen and service screens.
If you deliver for a restaurant: A courier has an account like any team member. We also keep the deliveries the restaurant gave you, when you picked each one up and delivered it, why a delivery could not be completed, the cash you collected and the cash you handed back. The restaurant sees all of it. A customer waiting for a delivery you carry sees your first name and, only while their food is on its way, the phone number on your account. "Directions" opens Google Maps on your phone with the customer's pin, under Google's own terms.
Setting up a new restaurant: You can set up a restaurant with our setup wizard, with or without an account. While you do, we keep what you type — the restaurant's name, address, city, country and phone number, and the Google listing you pick — the menu photographs you choose, the languages you ask for, and a record of your progress: which steps you reached, when, and how long each took. We also record what kind of device you used — phone, tablet or computer, its operating system and major version, and your browser — but never the full technical description your browser sends. We use this to build your restaurant and to see where people stop while setting one up, so we can make it easier. If you do this before having an account, then create one or sign in to keep the restaurant, this record is linked to your account.
A setup cookie: While you set up a restaurant without an account, a cookie holds a random key that lets this browser continue where you left off and, later, keep the restaurant as yours. It holds no name, email or anything about you, cannot be read by scripts, is ours alone, and lasts up to 400 days — it is removed when you keep the restaurant. If you clear your browsing data before then, this browser can no longer continue or keep that restaurant.

During onboarding, if your browser cannot provide your location, you can ask us to estimate your restaurant's country and city from your IP address. That request sends your IP address to a third-party lookup service. It happens only when you are signed in and only for that purpose, and diners' IP addresses are never sent to it.

Why we process it

To run the service you asked for: showing the menu, taking orders, routing them to the kitchen and service screens.
To bring a delivery to your door: to price it by distance, to guide the courier there, and to account for the cash collected at the door.
To keep accounts and restaurants secure, and to prevent abuse — including brute-force protection and spotting QR codes that have leaked outside a venue.
To show a restaurant analytics about its own activity, so it can understand its menu and its service.
To send you notifications you have chosen to receive.
To manage subscriptions and issue invoices.
To fix faults, using error reports that tell us what broke.
To see where people stop while setting up a restaurant, so we can make setting one up easier.

We do not use your data for advertising, and we do not make automated decisions that produce legal effects about you.

Automated menu tools

When a restaurant uses our assisted menu features, the photographs and menu text it uploads are sent to Google's Gemini service to read the menu and, if asked, translate it. In the dashboard, the restaurant reviews the result and publishes it itself. In our setup wizard, the menu read from your photographs is published straight away, so you can see your restaurant working at once — you can correct or remove any of it afterwards. Uploaded menu photographs are deleted once they have been read; any left behind are removed by a daily clean-up.

A note for restaurant owners: photograph your menu somewhere quiet. If customers or staff are visible in the frame, their image is uploaded along with the menu.

Where your data is processed

Ordevia's infrastructure is not in the country the operator is registered in. The providers listed above host data abroad, so running the service involves transferring personal data across borders. The data-protection law that applies to us regulates those transfers, and we are working through the formalities it requires with the competent authority. We prefer to say so plainly rather than leave it unsaid. If this matters to you, write to support@ordevia.app.

How long we keep it

Diner sessions: A session expires shortly after your visit — each restaurant sets that window for itself, and you can ask us what it is. Expired session records are not yet deleted on an automatic schedule; we are introducing one, and until then you can ask us to delete yours.
The device cookie: The random number that stops a restaurant's visitor count rising every time you reload lasts up to 400 days on your device, and slides forward each time you visit. Clearing your browsing data for this site removes it — both the cookie and the copy your browser keeps — and the next visit simply counts as a new device. It is never linked to your name, an account, or anything you order.
The menu-language cookie: The language you are reading a menu in is remembered for a year, so the menu opens in it next time. Clearing your browser's cookies removes it.
Orders: Kept while they are useful to the restaurant for its own records and analytics.
Delivery details: Kept with the order until the restaurant erases them, as described above. The details saved on your own phone stay there until you remove them or clear your browsing data.
Accounts: Kept while the account exists. Closing it removes the account and its personal details.
Restaurant data: After a subscription ends, the restaurant can export its data for thirty days, after which it is deleted.
Security and audit records: Kept only as long as they serve their purpose — short for PIN attempts, longer for activity and subscription history.
Restaurant setup records: The record of a restaurant set up with the setup wizard is kept while that restaurant exists. If the restaurant was never finished, or has been removed, the record is deleted after 180 days. A restaurant that was set up but that nobody has kept stays online until we remove it.

How we protect it

Every connection to Ordevia is encrypted in transit.
Each restaurant's data is isolated at the database level, so one restaurant can never read another's — this is enforced by the database itself, not only by application code, and is covered by automated tests.
Passwords are stored hashed, never in readable form.
The session and device cookies are signed, restricted to our own site, and not readable by scripts.
Access to production data is limited to the operator.

No service can promise perfect security. If a breach ever affects your data, we will tell those affected and the competent authority.

Your rights

Under the data-protection law that applies to us, you may ask us to:

confirm what data we hold about you, and give you a copy;
correct anything inaccurate or incomplete;
delete data we no longer have a reason to keep;
stop a particular processing, including where it relies on your consent;
withdraw consent you previously gave — the location check being the clearest example.

Write to support@ordevia.app. We answer within a reasonable time and never charge for it. As a diner you will not have an account to prove ownership with, so tell us roughly when and where you scanned, and we will find the session.

You may also complain to the data-protection authority that supervises us. Write to us and we will name it and tell you how to reach it.

Children

Ordevia is meant for restaurant customers and staff and is not directed at children. We do not knowingly collect data from a child. A diner session holds no identifying details unless a phone number is given for a takeaway order, and that is asked for on screen, is never required to read a menu, and can be erased by the restaurant on request. If you believe a child's data reached us, tell us and we will delete it.

Changes to this policy

If this policy changes we update the version and effective date shown at the top of the page, and keep a record of what changed. Substantive changes are notified to subscribing restaurants.