Privacy Policy

For the Zento Menu website, account administration and our own support and security activities, the controller is:

For personal data in restaurant menus and guest orders, the restaurant determines why the data is used. Zento processes that data to provide the restaurant’s service. Please contact the restaurant first about an order or its handling of your information; you can contact us for assistance identifying the right contact.

Accounts and restaurant administration: email addresses, authentication information, restaurant details, staff access and content you create, such as menus, prices and images. We use this information to provide accounts, protect access and operate the features you request. The legal basis for our account administration is performance of a contract or steps before entering one (Article 6(1)(b) GDPR).

Guest orders: table identifiers, session identifiers, selected items, quantities, prices, order times and status, and any notes submitted with an order. These allow the restaurant to receive and fulfil orders. Guests can browse the menu and order without creating a Zento account. The restaurant is responsible for identifying its legal basis, typically performance of the guest’s order contract.

Technical and security information: connection addresses, request times, requested resources, browser information and error or security events may be processed by the infrastructure serving the website and database. We use this to deliver the site, investigate faults and prevent misuse, based on our legitimate interest in a secure and reliable service (Article 6(1)(f) GDPR).

Support: if you email us, we process your contact details and the information in your message to respond. The basis is handling contractual requests or our legitimate interest in responding to other enquiries. Please avoid sending unnecessary sensitive information.

Billing: when paid checkout is available, Paddle collects the information needed to complete your purchase. Zento receives customer and subscription references, plan, status and billing-period information to manage access. We do not receive your full payment-card details. Our basis is performance of the subscription contract; statutory record-keeping may also apply (Article 6(1)(c) GDPR).

Zento uses self-managed application servers and image storage, hosting infrastructure providers, and Supabase for database and authentication services. Authorised administrators may access information when necessary for support, maintenance or security. Restaurant account owners and authorised staff can access their restaurant’s data. Published menus and their images are accessible to people with the menu link.

For paid purchases, Paddle processes payment and transaction data as merchant of record under its own privacy notice. Resend delivers authentication emails. Email and infrastructure providers may also process information needed to deliver service messages and support correspondence. Information may be disclosed where legally required.

Some providers operate internationally and may process information outside the EEA. Transfers subject to GDPR require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses. Contact info@zento.menu for information about the providers and safeguards relevant to your data.

Necessary storage: local browser storage maintains your sign-in session and cookie preferences. Session storage holds a table-order session identifier so you can access your own orders. This storage is needed for the functionality you request. Clearing browser storage can sign you out or remove access to your current table session.

Optional analytics: only with your consent, Zento counts landing-page visits. Session storage limits recording to once per browser session. The server temporarily hashes the connection address to suppress repeat requests for 30 minutes. Only the cumulative visit count is saved by this counter; it does not persist addresses, hashes or individual visitor records. This description concerns the optional counter, not separate infrastructure security logs.

The basis for optional analytics is your consent (Article 6(1)(a) GDPR). You can refuse or withdraw it at any time without losing access to the service. Withdrawal affects future processing and does not make earlier consent-based processing unlawful. No advertising or cross-site marketing tool is currently enabled.

Account and restaurant data is retained while needed to provide the service. Contact info@zento.menu to request account closure or deletion. We assess deletion requests against any applicable legal retention duties and the need to resolve disputes or protect against abuse. Restaurant order records are managed for the restaurant; contact it about the retention of your order.

Technical and support information is retained for as long as needed for the stated security, operational or enquiry-handling purpose, or to meet legal obligations. Encrypted recovery backups follow a 90-day retention schedule, so deleted records may remain in restricted backups until those versions expire. Backups are used for recovery rather than normal service access.

Where applicable, you can request access, correction, deletion, restriction of processing or a portable copy of your data. You can object to processing based on legitimate interests for reasons relating to your situation, and withdraw consent at any time. We do not use personal data to make solely automated decisions with legal or similarly significant effects.

Email info@zento.menu to exercise your rights. We may need to verify your identity and will normally respond within one month, subject to lawful extensions. For data controlled by a restaurant, we will help direct your request to that restaurant.

You can complain to a supervisory authority, including the authority where you live or work. Our local authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

We may update this notice when the service or its data processing changes. The date above identifies the current version. Contact info@zento.menu with privacy questions or to request further information about retention or service providers.