Allunora Privacy Policy

1. Controller

[Pending: legal name] (tax ID [Pending: tax ID]), registered office [Pending: registered office], [Pending: registry data], email [Pending: contact email]. Privacy contact / DPO: [Pending: privacy contact / DPO].

2. What data we process and why

• Platform customer account (valid at every restaurant): email, name, phone, saved address and hashed password. Purpose: running your account and identifying you when you order or book. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Owner and staff login accounts: name, email, role and hashed PIN. Purpose: secure access to the platform. Legal basis: the contract with the restaurant and our legitimate interest in security (Art. 6(1)(b) and (f)).
• Subscription billing: the business customer's tax and payment data (bank details of the transfer and, if the Customer pays online, through Stripe). Legal basis: contract and tax and accounting obligations (Art. 6(1)(b) and (c)).
• Support: problem reports, with an optional screenshot. Legal basis: contract and our legitimate interest in fixing issues.
• Security: technical and audit logs. Legal basis: legitimate interest and the security obligation (Art. 32).

3. Retention

The customer account is kept until you delete it (you can do so yourself from "My account"). Staff accounts, for as long as the restaurant keeps them active. Billing data, for the periods the law requires (for example 6 years for accounting records in Spain). Resolved support reports are deleted after 90 days and audit logs after 3 years.

4. Recipients and transfers

We use providers that process data on our behalf (list at /platform-legal/subprocessors). Some AI features are provided by Anthropic PBC in the USA, under the EU-US Data Privacy Framework and/or Standard Contractual Clauses. We do not sell personal data.

5. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [Pending: privacy contact / DPO] or [Pending: contact email]. From "My account" you can download your data and delete your account.

If you think we have not handled your request properly, you can complain to a supervisory authority, such as the Spanish Agencia Española de Protección de Datos (www.aepd.es).