Privacy Policy

How Qrantz Sàrl collects, uses, and protects personal data

Version 1.3 — effective 30 October 2026. This policy describes how Qrantz Sàrl actually handles personal data today. It has been checked against our systems but has not yet been reviewed by external legal counsel; it will be updated when that review takes place. Questions: privacy@qrantz.com.

Contents

• 1. Who we are
• 2. Scope and roles
• 3. Personal data we process
• 4. Why we process data and legal bases
• 5. How we share data
• 6. Sub-processors and international transfers
• 7. Data retention
• 8. Your rights
• 9. Cookies and analytics
• 10. Data security
• 11. Children
• 12. Changes to this policy
• 13. Contact

1. Who we are

Qrantz Sàrl (“Qrantz”, “we”, “us”) operates a QR-code-based digital ordering platform for hospitality businesses. This Privacy Policy explains how we handle personal data across our three applications: the Customer ordering app (PWA), the Business Portal, and the Backstage / Kitchen Display app, as well as our marketing website.

For diners, we generally act as a data processor on behalf of the restaurant or venue (the controller) for order data, and as an independent controller for limited platform-operation data. The distinction is set out in Section 4. For our business customers (venues), and for our marketing-site visitors, we act as the controller.

2. Scope and roles

2.1 When Qrantz is the controller

We are the controller when we decide why and how data is processed — for example: account data of our business customers, billing, platform security, and communications with you.

2.2 When Qrantz is a processor

When a diner places an order through a venue using Qrantz, the venue is the controller of that order data and we process it on the venue’s instructions under a Data Processing Agreement. The venue’s own privacy notice may also apply.

3. Personal data we process

Depending on how you use Qrantz, we may process the following categories:

Diners (Customer PWA)

• Order details: items selected, quantities, notes, table/location identifier.
• Payment-related data: handled by Stripe; we receive payment status and limited transaction metadata, not full card numbers.
• Technical data: device/browser type, language, IP address, session identifiers.
• Optional contact data: where a venue collects it (e.g., for order status).

Business customers (Business Portal / Backstage)

• Account & identity: name, business name, email, role, login credentials.
• Business data: menus, locations, pricing, operational settings.
• Billing data: subscription tier, invoices, Stripe Connect account references.
• Usage & support data: logs, support communications.

Website visitors

• Information you submit via contact or sign-up forms.

We do not knowingly process special categories of data. Allergen or dietary preferences entered by a diner are treated with care and only used to fulfil the order.

4. Why we process data and legal bases

Under the GDPR and revFADP we rely on the following legal bases:

• Performance of a contract — to provide the ordering service, manage subscriptions, and process payments.
• Legitimate interests — to secure the platform, prevent fraud, and improve the service, balanced against your rights.
• Legal obligation — to meet accounting, tax, and regulatory duties.
• Consent — where required, e.g., certain cookies/analytics or optional communications. Consent can be withdrawn at any time.

5. How we share data

We share personal data only as necessary to operate the service:

• Venues — diners’ order data is shared with the relevant venue to fulfil the order.
• Sub-processors — trusted providers that process data on our behalf (see Section 6).
• Payment provider — Stripe, for payment processing and Stripe Connect payouts to venues.
• Authorities — where legally required.

We do not sell personal data and do not use it for third-party advertising.

6. Sub-processors and international transfers

We rely on the following categories of sub-processors. A current, itemised list is maintained in this document — see sub-processors below.

• Cloud compute & hosting (Fly.io — Frankfurt region).
• Managed database (Neon — PostgreSQL).
• Caching / queue (Upstash — Redis).
• Object storage (Tigris).
• Transactional email (Resend).
• Payments (Stripe).

Where a sub-processor processes data outside Switzerland/the EEA, we ensure an adequate transfer mechanism is in place (e.g., an adequacy decision or Standard Contractual Clauses with supplementary measures). Details are available on request from privacy@qrantz.com.

Sub-processors

Only sub-processors that process personal data on our behalf are listed. Infrastructure vendors that do not process personal data (for example, our metrics/alerting provider) are excluded.

7. Data retention

We keep personal data only as long as necessary for the purposes described, or as required by law (for example, Swiss accounting records are generally retained for ten years). Feedback you submit through the service is retained for up to 90 days. Our server logs, which include IP addresses, are kept for up to 30 days. Staff invitation records are retained for up to 90 days after they are revoked or expire. We also keep encrypted backups of our database, retained for a maximum of 92 days and automatically erased when each backup expires; these backups are used only to recover from data loss and to test that this recovery works.

If you ask to join our pilot through the form on our website, we receive your name, your venue's name, city and type, your e-mail address, the language of the page and, if you give it, your phone number. We use them only to answer your request (steps taken at your request before a contract, GDPR Art. 6(1)(b)). The request reaches us as an e-mail sent through our e-mail provider, Resend, which keeps its copy for 30 days (its published retention period). It is not stored in our application database and is not used for marketing. We delete the e-mail from our mailbox within 6 months of receiving it, or earlier if you ask.

8. Your rights

Subject to applicable law, you have the right to: access your data; rectify inaccurate data; erase data; restrict or object to processing; data portability; and to withdraw consent. Where Qrantz acts as processor for a venue, we will forward your request to that venue or assist them in responding.

• To exercise your rights, contact privacy@qrantz.com.
• You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, in the EU, with your local supervisory authority (in Romania, the ANSPDCP).

9. Cookies and analytics

Qrantz does not currently deploy any analytics tracking, and we do not use Google Analytics or third-party advertising cookies. If we introduce cookies or similar technologies that are not strictly necessary for the service to function, we will request your consent before doing so. Full details are in our separate Cookie & Analytics Notice.

10. Data security

We apply appropriate technical and organisational measures — including encryption in transit, access controls, network isolation, and logging — to protect personal data. No system is perfectly secure. Where a personal-data breach occurs, we will notify the competent supervisory authority and affected individuals as and when the law requires.

11. Children

The service is not directed at children. We do not knowingly collect data from children below the applicable age of digital consent without appropriate authorisation.

12. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top reflects the latest version; material changes will be communicated through the service or by email where appropriate.

13. Contact

Questions about this policy or your data: privacy@qrantz.com, or by post to Qrantz Sàrl, 1028 Préverenges, VD, Switzerland.