Privacy Policy

1. Controller and contact

The controller is Marco Heller, Brinkweg 11, 45721 Haltern am See, Deutschland. Contact us at [email protected] or send privacy enquiries to [email protected]. Full provider details are in the legal notice.

2. Website and hosting

Our server infrastructure processes your IP address, access time, requested address, HTTP status, transferred data volume and browser and operating system information to deliver the website, diagnose errors and prevent misuse. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in secure, reliable operation. Hosting provider: [Hosting provider], [Hosting provider address]. Logs are deleted when no longer required; security incidents may require longer retention for that specific purpose.

3. Essential cookies and local content

Session and security cookies support requested functions, including form security and contact submission results. Essential device access relies on section 25(2)(2) of the German TDDDG; subsequent processing relies on Article 6(1)(b) or (f) GDPR. Fonts are served from our website. The native site does not use analytics or advertising trackers.

4. Contact forms, email and telephone

We process your name, email and message, plus any optional telephone and business details. Enquiries are stored in our inbox and may be forwarded by email for handling. Article 6(1)(b) GDPR applies to contract-related enquiries; otherwise our legitimate interest in responding applies under Article 6(1)(f). Mandatory fields are needed for a reply. Enquiries are not used for advertising without a separate legal basis.

5. Orders and customer administration

We process contact, business, billing and, where relevant, VAT details together with the plan, billing period, payment status and order identifiers. The purposes are performance, provisioning and billing under Article 6(1)(b) GDPR, and legal obligations under Article 6(1)(c). Orders cannot be processed without the required contract data.

6. Stripe payments

When paying with Stripe, you are redirected to its payment page. We transmit necessary order and contact details; you enter payment details directly with Stripe. We receive status and transaction identifiers, not full card numbers. Stripe also processes data independently for payment services, fraud prevention and legal obligations. Our legal bases are Article 6(1)(b), (c) and (f) GDPR. Details of the relevant Stripe entity and international processing: https://stripe.com/privacy.

7. AI text assistance through Mistral

When you use AI text assistance, we send your message and included conversation history through our server to Mistral AI to generate a reply. The assistant uses artificial intelligence and may make mistakes. It cannot access restaurant accounts. Article 6(1)(b) GDPR applies to pre-contractual enquiries, otherwise Article 6(1)(f) applies to the requested product guidance. The visible history stays in your browser during the page visit; provider processing and retention follow its terms: https://legal.mistral.ai/terms/privacy-policy/. Please avoid confidential data. The contact form is also available.

8. Recipients and international processing

Data is received by people and providers who need it for these purposes, including hosting, communications, payment and AI providers. Processing on our behalf is governed by Article 28 GDPR agreements. External providers may process data outside the EEA; hosting the platform in Germany does not mean AI or payment services process data only in Germany. Appropriate transfer grounds and safeguards apply where required. Contact our privacy address for details of the providers and safeguards used.

9. Retention

Data is kept for its stated purpose. Completed enquiries are deleted once no longer needed, unless retention obligations or necessary legal defence apply. Contract and accounting records are retained in accordance with applicable commercial and tax law. Further use during mandatory retention is restricted to that purpose.

10. Your rights

Subject to statutory conditions, you may request access, rectification, erasure, restriction and portability. You may withdraw consent at any time for future processing. You may object to legitimate-interest processing on grounds relating to your particular situation and to direct marketing at any time. Proportionate identity verification may be necessary.

11. Complaints and automated decisions

You may complain to a supervisory authority, particularly where you live, work or suspect an infringement. Our competent authority: [Competent supervisory authority], [Supervisory authority website]. We do not make solely automated decisions with legal or similarly significant effects through this website. Payment providers may perform their own security checks as described in their notices.