Privacy Policy
Last updated: September 2026 · Binding language: German
1. Controller
The controller under the GDPR is:
Mario Margarone
ASERVIO
Kastanienweg 7
74417 Gschwend
Germany
Email: info@aservio.app
2. Data we process and purposes
We process the following personal data:
- Account data: email address and encrypted password (Supabase Auth) — to sign operators and platform admins in.
- Shop data: restaurant name, hours, tables, areas, menu, news fly-in, booking rules, and the restaurant’s own imprint — to run the operator app and the public widget.
- Guest bookings: name, phone, optional email, party size, date/time, notes, consent to restaurant email — so the restaurant can confirm, seat, and (if agreed) email the guest. Legal basis towards operators: Art. 6 (1)(b) GDPR (contract). Guests book with the restaurant; we host the data to provide that service.
- Push notifications: device token (Firebase Cloud Messaging) when the operator enables notifications — to alert the shop of new reservations.
- Payments: Stripe and/or Apple In-App Purchase. Card details are processed only by Stripe/Apple, not stored on our servers. We store subscription and entitlement status per shop.
- Transactional email: guest confirmation and optional rating request via Resend, only with guest consent collected in the widget or operator sheet.
- Technical data: IP address, browser/app information, error logs — to operate website, widget, and apps (Art. 6 (1)(f) GDPR).
We do not use advertising SDKs, do not sell personal data, and do not read Apple Health or similar health APIs.
3. Processors
- Supabase (database, auth, Edge Functions)
- Vercel (hosting, the web app)
- Google Firebase (push / FCM)
- Resend (guest email, if enabled)
- Stripe (website billing)
- Apple (App Store In-App Purchases, if used)
4. Retention
Account and shop data last for the life of the account. Bookings stay as long as the restaurant keeps them for operations. Push tokens are removed when the app unregisters or the account is deleted. Logs are kept only as long as needed to run the service.
5. Your rights
You have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR, and the right to lodge a complaint with a supervisory authority (in Germany: the authority of your Land, or the LfDI of the controller’s seat). To exercise rights: info@aservio.app.