Privacy Policy

The controller of your personal data is Melvyn Mollard-Grech, sole trader operating the service under the trade name Plate (“Plate”, “we”), located at 19 Les Balcons de la Save, 31530 Montaigut-sur-Save, France.

Contact: support@plate.center

• Identity and account: email address, display name, password (hashed, never stored in plain text), language.
• Where your sign-up came from: when you create your account on the website, the page you arrived on, the page from which you opened the sign-up form, the domain name of the site you came from (never the full address) and, if any, a campaign name. This is recorded without any cookie or storage on your device, and is used only to know which pages of the site are useful.
• Establishment: name, address, phone number, opening hours, social links, Google review link, location (if you set it), logo, cover photo.
• Menu: dishes, prices, descriptions, photos, categories, allergens, options — and, if you use stock tracking, your items, suppliers and movements.
• Subscription and payments: Stripe or Apple customer and subscription identifiers. Plate never sees or stores a card number.
• QR kit delivery: postal address, format and quantity.
• Mobile app: notification token (to alert you of a new order).
• Point of sale: if you connect HubRise, an encrypted access token (AES-256-GCM), unreadable without a key kept outside the database.

When a guest uses a restaurant's menu, the data they leave is collected on behalf of that restaurant, which is the controller. Plate acts as a processor within the meaning of Article 28 of the GDPR: we only use this data to run the restaurant's service, we never sell it and never use it for advertising.

• Loyalty programme (if the guest joins): phone number, optional first name, optional birthday (day and month, never the year), number of visits and rewards earned.
• Table or takeaway ordering: order contents, table number, first name and phone number for pickup. Payment is processed by Stripe; Plate never sees the card.
• Private feedback: the message a guest chooses to send to the restaurant. It is never published.
• Anonymous statistics: when the menu was opened and which dishes were viewed, with no identifying data.
• On the guest's device: the chosen language and, so they don't have to type it again, their loyalty number (deleted automatically after 12 months without a visit).

No location is requested: a visit is counted when the guest opens the menu from their table's QR code during service hours, or when they pay for an order with Plate and enter their loyalty number.

To exercise your rights (access, rectification, erasure…), contact the restaurant: it can delete your record from its account in one step. You can also write to us at support@plate.center, naming the restaurant and your number: we will forward and carry out the request.

These periods are enforced automatically, every night, by the service itself:

• Restaurant owner account: as long as the account exists. When it is deleted, everything is erased immediately, except accounting records of paid sales (amounts, dates), kept without any personal data.
• Accounting records (paid orders, transaction log): 10 years, without phone number or first name.
• Phone number and first name left on an order: deleted after 12 months.
• Loyalty guest: deleted after 3 years without any visit, or at any time on request.
• Private feedback: 24 months.
• Statistics (menu opens, dishes viewed, visits): rolling 24 months.
• IP addresses used against abuse: 7 days.
• Unpaid carts: 7 days.
• Photos: deleted with the dish or the account.

Your data may be shared with the following sub-processors, in strict compliance with the GDPR:

• Supabase Inc. — database, authentication and photo storage (servers in Europe, Stockholm)
• Vercel Inc. — web app hosting, server processing in Europe (Stockholm), cookieless audience measurement
• Stripe Payments Europe, Ltd — payment processing (Ireland, PCI DSS Level 1 certified)
• Resend — transactional emails (United States)
• Photoroom — background removal for dish photos (French company, servers in the United States)
• Crisp — support chat on the website and dashboard (France)
• Sentry — technical error monitoring (servers in Germany)
• Expo — delivery of mobile app notifications (United States)
• Apple and Google — sign in with an Apple or Google account, app distribution; Apple for subscriptions purchased in the iOS app
• RevenueCat — management of subscriptions purchased in the iOS app (United States)
• Anthropic — optional drafting of a dish description from its name and category only (United States); no personal data is sent
• HubRise — only if you connect your point of sale: sending orders to it

We never sell your data to third parties for advertising purposes.

Your data is hosted and processed in Europe. Some sub-processors are, however, based in the United States (Resend, Expo, RevenueCat, Anthropic, Apple, Google, and the parent companies of Supabase and Vercel). These transfers are governed by Standard Contractual Clauses approved by the European Commission, ensuring a level of protection equivalent to that required by the GDPR.

Under the GDPR (Articles 15 to 22), you have the following rights:

• Right of access: obtain a copy of your personal data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion of your data (“right to be forgotten”).
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Right to restriction: temporarily suspend processing.
• Right to withdraw consent: at any time, free of charge.

To exercise these rights, contact us at support@plate.center. We will reply within 30 days at most.

You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the supervisory authority of your country.

From your account, without writing to us: export all your data in a machine-readable file (Account → Export my data) and delete your account (Account → Delete my account), on the web and in the app. Deletion is immediate; only accounting records of paid sales are kept, without any personal data.

Restaurant guests: see section 3 — the restaurant can delete your record itself.

• TLS encryption in transit (HTTPS everywhere)
• Encryption at rest via Supabase (AES-256)
• Row-Level Security (RLS): each restaurant owner only accesses their own data
• JWT authentication with token expiry and rotation
• Hashed passwords (bcrypt) — never stored in plain text
• APIs protected by mandatory authentication, request origin checks and rate limiting
• Point-of-sale tokens encrypted (AES-256-GCM) with a key kept outside the database
• Append-only transaction log, chained by hash: a recorded sale can be neither modified nor deleted
• Full security and compliance audit carried out on September 26, 2026

Plate only uses what the service needs. No advertising cookies, no social media trackers.

• Session (sb-…-auth-token): keeps you signed in to your account. Until you sign out.
• Preferences (plate_theme, NEXT_LOCALE): light or dark theme, website language. 1 year.
• Digital menu, on the guest's device: chosen language; loyalty number so it doesn't have to be typed again (deleted after 12 months without a visit).
• Support (Crisp): nothing is loaded until you open the help bubble. If you open it, Crisp sets a cookie to keep your conversation — the service you just asked for.
• Payment (Stripe): only on the Stripe payment page, for transaction security and fraud prevention.
• Audience measurement (Vercel Web Analytics, marketing pages only): no cookie and no persistent identifier.

All of these are exempt from consent, so no cookie banner is needed.

We may update this policy to reflect changes in our practices or in applicable regulations. For any material change, we will inform you by email at least 30 days before it takes effect. The date of the last update is shown at the top of this page.