Privacy policy

Who processes your data

The data controller is the entity named in the Legal notice, available on this site. During this pilot phase it is a Brazilian company — that is, outside the European Economic Area.

Although the controller is outside the EU, your data is hosted on servers in Ireland (European Union), and you have the same GDPR rights, which you can exercise at the address below.

For anything about your data, write to us at privacidad@mesarela.com.

What we collect, and why

If you join the waiting list, we collect only your email address. We use it for exactly one thing: to tell you when we open registration.

We don't use it for third-party advertising, we don't sell it and we don't share it. This form doesn't ask for your name, your phone number or details about your business.

If you have a mesarela account

If you register as a restaurant, we also process: your venue's name and details, your email and password (hashed, never in the clear), the menu you publish — including the photos you upload to create it — and, if you enable QR ordering, the orders your customers place.

A customer who scans a table's QR code needs no account, and we ask them for no personal data at all: they simply see the menu.

Legal basis

For the waiting list: your consent, given when you submit the form (GDPR Art. 6(1)(a)). You can withdraw it at any time, without affecting the lawfulness of processing before that point.

For your account and the service: performance of the contract (GDPR Art. 6(1)(b)). Without this data we cannot provide the service.

Who else processes your data

We do not sell or share your data. To run the service we work with providers who act as processors and handle data only on our instructions:

Amazon Web Services (AWS) — servers, database, storage for your menu photos, and outbound email. Data is hosted in their Ireland region (eu-west-1), within the European Union.

Cloudflare — serves your digital menu to your customers from its network, and handles inbound mail for our addresses.

If we add payments in future, we will update this list before doing so.

How long we keep it

Waiting list: until we open registration and notify you, or until you ask us to delete it — whichever comes first. If the project doesn't go ahead, we delete the list.

Account and menu: for as long as your account is active. If you delete it, we delete your data and your menu.

Two things do not disappear entirely, and you should know why. First: the record of whether you accepted or declined commercial email. We don't delete it, but we do anonymise it — what was decided, when, and the exact wording shown all remain; anything identifying you is removed. That lets us demonstrate the decision (GDPR Art. 7(1)) without keeping your data. Second: if you use QR ordering, the orders are retained for the period Spanish tax law requires.

Cookies

This site uses no analytics, advertising or personalisation cookies, and stores nothing on your device. That's why there's no cookie banner: there is nothing to consent to.

Your rights

You can ask us to access, correct, delete, restrict or object to the processing of your data, and to port it. Write to privacidad@mesarela.com and we'll sort it out.

If you think we've handled your request badly, you can complain to the Spanish Data Protection Agency (www.aepd.es).