Privacy Policy — Pratzu

Last updated: 6 November 2026 · Version: 1.0

Pratzu is the platform restaurants use to offer a digital QR-code menu, receive real-time orders (dine-in, take-away and delivery), manage kitchen and waiters, and take payments. This policy explains what personal data the platform processes, why, who we share it with, and how you can exercise your rights.

We were designed to collect as little as possible: we use no marketing cookies and no third-party tracking. The only cookies are technical (session, language, country and menu preview — see section 11).

1. Who is responsible for your data

Pratzu acts in two roles, and this changes who you address:

a) Pratzu as controller. For the data of our own customers and visitors — restaurant owners and staff, leads (people interested in signing up) and the operation of the platform — the controller is:

Octidomain Unipessoal LDA, registered office at Rua Soeiro Pereira Gomes, 9, 2000-209 Santarém, Portugal,
represented by Eduardo Hidemi Namba.
Privacy e-mail: privacy@pratzu.com
Data Protection Officer (DPO): not appointed. For privacy matters, use privacy@pratzu.com.

b) The restaurant as controller, Pratzu as processor. When you place an order at a restaurant using Pratzu, the restaurant decides what happens to your data (it is their menu, their table, their order and their service). Pratzu supplies the platform and processes that data on the restaurant's behalf under a data processing agreement (Art. 28 GDPR / Art. 39 LGPD). In that case, to exercise rights over the order data, contact the restaurant first; a request sent directly to Pratzu is covered in section 10.

The customer account belongs to one restaurant. The account a customer creates to sign in to the Menu (e-mail access code, or Google) is created inside that restaurant. The same e-mail, or the same Google account, at another restaurant is a different account, with that restaurant's orders. There is no single platform-wide account. The restaurant is the controller of the data for that account and the order history at that restaurant; Pratzu processes it as a processor under Art. 28 GDPR and Art. 39 LGPD. To exercise rights over that data, you may contact the restaurant or write to privacy@pratzu.com (section 10); in the latter case, Pratzu will cooperate with the restaurant to handle the request.

In this document, "Pratzu" means the platform operator and "restaurant" means each business customer (owner and staff) of the platform.

2. Who this policy applies to

• Restaurant owners and staff who create an account in the management dashboard.
• End customers who scan a restaurant's QR code, sign in to the Menu by e-mail (access code) or Google, and place orders (dine-in, take-away or delivery) — including guest customers, who can order without creating an account (identified by a random identifier stored in the browser for that restaurant).
• Leads and visitors who leave their contact on the Pratzu website ("notify me" and "more information" forms and the waitlist at /register).

3. What personal data we process

3.1 Restaurant owners and staff

• Identity and contact: display name; e-mail; phone, when the access code is sent by SMS; Google account identifier, when signing in with Google; last login date.
• Account security: 6-digit access codes (OTP) — stored only as a hash (HMAC-SHA256), valid for 10 minutes with a maximum of 3 attempts; rotating session tokens (the sr_refresh HttpOnly cookie) and access tokens valid for at most 1 hour, revocable at any time.
• Dashboard notifications (staff): Web Push subscription for the floor or the kitchen — the browser push-service address and the subscription keys — for order and call alerts.
• Restaurant data (mostly not personal, but linked to the account): name, address, time zone, currency/taxes, opening hours, delivery regions, menu (products, ingredients, allergens, images), branding and payment settings, table QR codes.
• Subscription billing: billing data is handled by Stripe; the platform never receives or stores card numbers — payment happens directly at the gateway and Pratzu receives only the transaction identifier.

3.2 End customers of restaurants

• Customer account (optional, for order history): e-mail; with Google sign-in, the Google account identifier and the display name when the Google account provides one. Each sign-in creates or finds the account for that restaurant.
• Guests without an account: a random identifier (device_id, dev_ plus 32 hexadecimal characters), generated on the first order and stored in the browser for that restaurant, to tie history to that session. It is not a hardware identifier and not a marketing profile.
• Orders: table (or take-away/delivery channel), items and customizations, reference name (to know who ordered what at a shared table), order notes, amounts, tip, status.
• Delivery: delivery address.
• Fiscal identification: VAT/tax ID for the country (NIF, CPF or equivalent), when the restaurant requires it to issue an invoice (optional or mandatory per each restaurant's configuration).
• Payment: handled by Stripe (or equivalent gateway); the platform never sees card data.

3.3 Leads and visitors

• Contact and waitlist forms: chosen plan, name, e-mail, country (country: the one in the form, if there is one; otherwise the country saved in the cookie or chosen in the site selector; otherwise the one detected from an approximate location), country detected from the connection (detected_country, a two-letter code), page language and referring page. The form only sends it when that code exists, and it is stored separately from the country above.
• Consent: we record the exact version of the text you accepted and the date/time of acceptance (e.g. waitlist-consent-v1).
• Spam protection: Cloudflare Turnstile anti-bot protection and a decoy field; rate limits per IP and per e-mail stored for a few minutes in cache.
• Website chat: message text, page language and two values in tab storage (sessionStorage, cleared when the tab closes — not cookies): the conversation identifier (sr_chat_token) and the mark of the last read (sr_chat_since). The session expires 24 hours after the last message (the default; the configurable range is 1 to 720 hours) and a periodic cleanup deletes expired sessions and messages. The chat does not ask for a name or an e-mail.

The website chat is optional and does not ask for a name or an e-mail. We use it to reply to people who contact us about Pratzu. When the page language is not Portuguese, the message text may be sent to the same translation service described in section 6, only so support (in Portuguese) can understand it, and the translated version (or the original if translation is unavailable) is delivered via Telegram. Messages expire 24 hours after the last interaction. You have the right to object to this processing based on legitimate interests (section 9).

3.4 Technical and security data

• IP address and technical headers are used momentarily for rate limiting (anti-abuse) and security, with no profiling.
• Audit records (audit_logs) for sensitive actions — including support access on behalf of a restaurant, always logged. The trail stores the account identifier, the IP address and the browser identifier, with no e-mail in plain text.
• Operational logs are technical and contain no personal data.

4. Why we use the data and on what legal basis

We do not use personal data for advertising, we do not sell data, and we make no automated decisions with legal effect. AI menu reading and translation use the menu content (dish names, descriptions, prices) and not order data. When the page language is not Portuguese and translation is enabled, the website chat sends the message text to the same service, only to translate the conversation.

5. Who decides about the restaurant order

When a customer orders at a restaurant: the restaurant is the controller of the order data — it uses them to prepare, serve, deliver and invoice. Pratzu is the processor supplying the system and only processes that data per the restaurant's instructions and this policy. Deletion of a customer account (section 10.1) applies to that restaurant's account; the same contact at another restaurant is a different account.

6. Who we share data with

Pratzu only shares data with vendors acting as subprocessors, each under a data processing agreement:

About large language models in menu import and translation — what to know. To build the menu from a PDF, photo or web URL, and to translate the menu and interface strings, the owner submits the content and Pratzu processes it using large language models accessed through OpenRouter, Inc. OpenRouter acts as a processor and routes requests to downstream model providers (currently, depending on the task, services from OpenAI, Google and Anthropic). Those providers are generally outside the European Union, especially in the United States. Menu content (dishes, ingredients, prices, and sometimes the restaurant name) may therefore be transferred outside the EU. Menus rarely contain personal data, but they can (for example, a person's name in a dish name). Therefore: (i) we send only the content needed for reading or translation; (ii) the owner is responsible for having the right to use the content they submit; (iii) customer order data is never sent to these models; (iv) the website chat may send the message text to the same service, only for translation, as described in section 4. According to OpenRouter's policy (reviewed November 2026), OpenRouter does not store prompt or response content by default, reserves the right to retain content flagged as possible child sexual abuse material, and stores technical metadata (for example token counts and latency). Each model provider applies its own retention and no-training rules. Transfers rely on the European Commission's Standard Contractual Clauses or, where certified, the EU-U.S. Data Privacy Framework. We do not use these services to build customer profiles or for advertising.

We do not share data with advertisers, media networks or data brokers.

7. International transfers

Production database (D1) and files (R2) are provisioned in Cloudflare datacenters in Europe. Some Cloudflare components (especially Workers KV, Worker execution and possibly operational logs) and several vendors in section 6 process data outside your country, including in the United States (Stripe, Resend, OpenRouter and Google services, among others). Where applicable, the transfer relies on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. In Brazil, international transfers follow Art. 33 of the LGPD and ANPD rules.

• United States: Stripe, Resend, OpenRouter and part of Cloudflare. Where applicable, the transfer relies on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
• Brazil (LGPD): international transfers follow Art. 33 of the LGPD and ANPD rules (standard contractual clauses or an equivalent mechanism).

OpenRouter may forward content to downstream model providers (OpenAI, Google, Anthropic, or whichever provider the model chain uses). Those providers process the content to run inference and apply their own retention rules. An up-to-date list of providers in use can be requested at privacy@pratzu.com.

8. How long we keep data

This table sets out applicable retention periods; legal review is recommended.

9. Your rights

If you are in the European Economic Area (GDPR) or in Brazil (LGPD), you have the right to:

1. Access — know what data of yours we process and receive a copy.
2. Rectify — correct incomplete or inaccurate data.
3. Erase — request deletion of your data (right to be forgotten — section 10).
4. Portability — receive your data in a structured format. For now, requests are handled manually via privacy@pratzu.com; there is no automatic export in the app yet.
5. Object and restrict — object to processing based on legitimate interests and request restriction of processing.
6. Withdraw consent — at any time, for processing that relies on consent (e.g. the waitlist), without affecting what came before.
7. Complain — to the data protection authority: in Portugal, the CNPD (cnpd.pt); in Brazil, the ANPD; or your local authority.

How to exercise them: the end customer writes to privacy@pratzu.com (section 10.1). Owners, staff and leads write to the same address. We send a response within 30 days. Protecting the account may require minimal proof of identity.

10. Right to be forgotten

10.1 End customer — deletion request

The Menu has no control that deletes the account. The customer account exists per restaurant: the same e-mail, or the same Google account, at another restaurant is a different account. Deleting one does not delete the other.

To request deletion, write to privacy@pratzu.com and name the restaurant. We handle the request within 30 days (section 9). In general: we delete or anonymize that restaurant's account (e-mail, Google identifier and display name), sessions and associated guest identifiers; the same contact at another restaurant is unaffected. Fiscal documents already issued (invoices, corrective documents and the minimum data needed to reconstruct them, including the customer tax ID when it appears on the document) are not deleted while the legal retention period lasts — in Portugal, 10 years (Art. 52 of the VAT Code and Art. 19 of Decree-Law no. 28/2019). This retention is based on Art. 17(3)(b) GDPR and Art. 21(5) of Portuguese Law 58/2019. Mandatory records required by law follow the same principle. When certified issuance is live, those documents may be managed through the fiscal archiving provider then integrated (for example Fiskaly SIGN PT in Portugal, or the equivalent in the restaurant's country), which archives them for the legal period; an issued document is not erased, only voided or corrected with a later document. Orders that have not produced a fiscal document follow the deletion or anonymization above unless another legal obligation applies. A new visit to the same restaurant's Menu may create an empty account without the deleted history.

10.2 Owner — deleting the whole restaurant

When the restaurant's account is closed and deletion is requested:

• The restaurant's data (menu, settings, images, staff) is deleted or anonymized within 90 days after closure;
• That restaurant's end-customer data follows the same fate, respecting the tax retention periods in section 8;
• For 30 days after the closure request, deletion can be undone (recovery period); after that, deletion is final, subject to what tax law requires us to keep (section 8);
• What tax law requires keeping (e.g. issued invoices) is retained for the legal period, anonymized where possible.

11. Cookies

We use the minimum — no marketing or tracking cookies:

The Cloudflare Turnstile anti-bot check (public forms) runs in an isolated module on Cloudflare's own domain and may set technical cookies there, with no advertising profile. Because there are no marketing cookies, there is no cookie-consent banner; the consent requested on forms refers to e-mail contact, not cookies.

12. Security

• All external input is validated; credentials never live in code.
• HTTPS only; rotating, revocable session tokens; access codes stored as hashes.
• Card data never touches the platform — the gateway (Stripe) handles it directly.
• Support access on behalf of a restaurant is always logged in audit records, with a reason.
• Rate limits against abuse on all public endpoints.

13. Minors

The platform is not directed at minors and does not verify users' age. The digital menu and on-site ordering are the restaurant's responsibility; it knows its customers in person (including rules such as for alcoholic beverages). The Pratzu contract with the restaurant owner is intended for people aged 18 or over. Creating a customer account on the Menu (e-mail code or Google sign-in) assumes that the person has, in that restaurant's country, the age to consent to processing of their data in an information society service: in Portugal, 13 years (Art. 16(1) of Law 58/2019 implementing Art. 8 GDPR); in Brazil, processing children's data requires specific consent from at least one parent or legal guardian (Art. 14 LGPD). Other countries apply local age rules; in the EEA this is typically between 13 and 16. Below that age, consent-based processing is lawful only if given by a legal representative. If we learn that we collected a child's data in breach of these rules, we delete it, subject to legal obligations that prevent erasure (section 10).

14. Changes to this policy

If we change this policy materially, we notify owners in the dashboard and, whenever a consent text changes, we bump the text version (e.g. waitlist-consent-v1 → v2) and ask for fresh consent — we never rewrite an accepted text retroactively.

15. Contact

• Privacy and rights: privacy@pratzu.com
• Data Protection Officer (DPO): we have not appointed a DPO. For privacy and exercising rights, contact privacy@pratzu.com.
• Operator: Octidomain Unipessoal LDA, Rua Soeiro Pereira Gomes, 9, 2000-209 Santarém, Portugal
• Authorities: CNPD (Portugal) · ANPD (Brazil) · your local authority.