Privacy Policy — Restaurant Platform

1. Data Controller

The controller of your personal data is Viviane Silva, Italy. For any question about this policy or about how we handle your data, you can write to viverevivi37@gmail.com or by certified mail (PEC) to supporto@pec.incassa.eu.

2. Data We Collect

From the Restaurant Owner and Team Members, we collect:

• Email and password for account access
• Restaurant name, chosen slug/address, and any custom domain
• Billing data and subscription status (handled by Stripe)
• Data the Restaurant enters to operate: menu and prices, stock, costs, tables, cash register data, and data of invited Team Members

From End Customers who place an order through the Online Store, we collect on the Restaurant's behalf:

• Name and phone number
• Delivery address and neighborhood/zone
• Tax ID (e.g. CPF/CNPJ in Brazil, or local equivalent), when required by the payment provider enabled by the Restaurant to process payment
• Order contents (products, quantities, notes, amount)

We do not receive or store full subscription payment card data: this is handled entirely by Stripe. End Customer order payments are processed entirely by the payment provider enabled by the Restaurant (for example Pix via Asaas in Brazil).

3. Purpose and Legal Basis

We process the Restaurant Owner's and Team Members' data to provide access to the Platform, process the subscription payment, and provide support (legal basis: performance of a contract, GDPR Art. 6.1.b), as well as to comply with accounting and tax obligations required by law (legal basis: legal obligation, GDPR Art. 6.1.c).

End Customer data collected through the Online Store is processed solely to allow the Restaurant to manage and fulfill the order and to process the related payment. The Restaurant remains the controller of this data towards its own End Customers; INCASSA acts as a processor on the Restaurant's behalf (GDPR Art. 28).

4. Providers and Data Recipients

To provide the Service, we rely on the following providers, which act as processors:

• Stripe — processing of the Restaurant's subscription payments
• Payment provider enabled by the Restaurant — processing of End Customer order payments (for example Asaas for Pix in Brazil; receives the End Customer's name, tax ID, and phone number, depending on the method activated)
• Supabase — database hosting and account authentication
• Resend — transactional email delivery
• Vercel — site hosting and custom domain routing

Some of these providers may process data outside the European Economic Area, based on appropriate safeguards described in their respective policies (e.g., standard contractual clauses).

5. Data Retention

We retain the Restaurant Owner's data for as long as needed to manage the subscription and, afterward, for the period required by applicable accounting and tax obligations. End Customer order data is retained for as long as needed to manage the order and for the Restaurant's applicable accounting and tax obligations. If the Restaurant Owner deletes their account, data entered on the Platform is deleted as described in Section 18 of the Terms of Service.

6. Your Rights

You have the right to access your data, rectify it, request its deletion, restrict or object to its processing, and request data portability (GDPR Arts. 15–22).

If you are the Restaurant Owner or a Team Member, you can exercise these rights by writing to viverevivi37@gmail.com. If you are an End Customer and want to exercise these rights over your order data, you can contact the Restaurant where you placed the order directly, or write to the address above, which will route the request to the relevant Restaurant. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or your own country's data protection authority.

7. Cookies

This site does not use profiling, analytics, or marketing cookies. We only use technical cookies necessary to maintain your account login session. Subscription payment happens on a page hosted by Stripe (stripe.com); End Customer order payments happen through the payment provider enabled by the Restaurant (for example Pix generated by Asaas in Brazil).

8. Changes to This Policy

This policy may be updated over time. The most recent version is always available at this address.