Privacy Policy

GoRunny ("we", "us") is a QR ordering, payment and loyalty platform for restaurants. This policy explains what personal data we process when a guest scans a table QR code, orders and pays, or joins a venue's loyalty program, and what data we process for restaurant owners and staff who use the GoRunny dashboard.

Data controller: Avant Systems, trading as GoRunny, Van den Boschstraat 284, 2595 AH Den Haag, Netherlands (KVK 42115024). Contact: [email protected]. Full entity details are on our Impressum.

Who controls what. For most guest data the restaurant you are ordering from is the controller and we act as its processor under a Data Processing Agreement. We are the controller in our own right for a narrower set of things: keeping the platform secure, billing venues, and our own product analytics. If you want data removed from a specific venue's records, contacting either us or the venue works — we will coordinate.

Guests ordering via QR code:

• Order contents, table/session identifiers, timestamps — needed to run the table session and hand the order to the kitchen/POS.
• A device identifier stored in your browser, used to distinguish participants sharing one table session and to recognise you as a returning guest at that venue. It is not linked to your real identity unless you also join a loyalty program.
• Payment data — handled directly by the venue's payment provider. We receive a confirmation and an amount; we never see or store your card number.

Guests who join a loyalty program:

• Name, email and/or phone number, and your order and visit history at that venue — needed to run the loyalty program (stamps, streaks, rewards) you opted into.

Restaurant owners and staff:

• Account details (name, email, role), sign-in and trusted-device records, and — where a venue connects a point-of-sale or payment provider — the credentials needed to operate that connection, which we store encrypted.

What we ask you not to enter. Order notes are free text and we do not inspect them. Please do not type health information, and be aware that a dietary or allergen preference you enter may reveal something about your health.

• Performance of a contract — taking and fulfilling your order, processing payment, running the loyalty program you joined.
• Legal obligation — fiscal receipt signing and retention required by Austrian RKSV and equivalent rules in other markets we operate in.
• Legitimate interest — keeping the service secure and reliable (rate-limiting abusive requests, fraud prevention), and product analytics run on our own infrastructure.
• Consent — push notifications (waiter-call and order-ready alerts), Google Analytics and Google Ads cookies on our public website if you accept them in the cookie banner (section 8), and marketing email if you tick the optional box when you join a loyalty program. Marketing consent is off unless you actively opt in, we record when and where you gave it, and every marketing email carries a one-click unsubscribe link. Withdrawing consent does not affect order receipts or account emails, which are not marketing.

We use the following processors to run the service, under data processing terms with each:

• Stripe — Card payment processing and subscription billing. (Stripe Payments Europe Ltd (Ireland); Stripe, Inc. (USA) — Standard Contractual Clauses.)
• Google (Firebase Cloud Messaging, Google Sign-In) — Push notifications to guest and staff devices, and Google sign-in where a user chooses it. (Google Ireland Ltd; Google LLC (USA) — Standard Contractual Clauses / EU–US Data Privacy Framework.)
• fiskaly — RKSV fiscal receipt signing for venues in Austria. (fiskaly GmbH, Austria — EU.)
• Cloudflare — Content delivery, TLS termination and DDoS protection for gorunny.com. (Cloudflare, Inc. (USA), with EU edge processing — Standard Contractual Clauses.)
• Mailjet — Transactional and, where consented, marketing email delivery. (Mailjet SAS, France — EU.)
• Sentry — Application error monitoring. Configured to scrub request bodies and personal identifiers. (Functional Software, Inc. (USA) — Standard Contractual Clauses.)
• The venue's point-of-sale provider — Sending order and invoice data to the till, where the venue has connected one (ready2order, Lightspeed, gastronovi, helloCash, SumUp). (Determined by the venue's own provider agreement — EU providers unless the venue chooses otherwise.)
• The venue's payment provider — Processing guest payments where the venue selects a provider other than Stripe (Mollie, SumUp, Unzer). (Determined by the venue's own provider agreement — EU providers unless the venue chooses otherwise.)

Menu translation and dish tagging use an AI model that runs on our own hardware. No menu content and no guest data is sent to an external AI provider.

We do not sell personal data, we do not share it with third parties for their own marketing purposes, and we do not use one venue's guest data for another venue.

Personal data is hosted in the European Union. Some processors above are US-based or transfer data to the US; where that happens we rely on the EU Standard Contractual Clauses, an adequacy decision, or the EU–US Data Privacy Framework where the recipient is certified.

• Table-session participant identifiers — the device identifier attached to a table session is erased 7 days after the session ends. The short window exists so we can still answer "which device placed this order?" if a bill is disputed.
• Returning-guest records — if you have not visited a venue for 12 months, the device identifier on that record is irreversibly replaced with a random value. The venue keeps its order counts; what remains can no longer be linked to you or matched on a future visit. You can trigger this immediately — see section 7.
• Order and payment records — kept for the statutory retention period for fiscal and tax records (7 years in Austria). This obligation overrides an erasure request, which is why we sever the link to you rather than deleting the record.
• Loyalty account data — kept while your account is active, and deleted on request.
• Guest analytics telemetry — deleted after 90 days.

Under the GDPR you have the right to access, correct, erase, port, restrict and object, and to withdraw consent at any time.

You can exercise most of these yourself, without asking us:

• Loyalty members — export everything we hold, and delete your account, from your account settings.
• Guests without an account — open Your data on this device from the browser you ordered with. It shows every record held against that device and lets you erase the identifier linking them to you. No account, no proof of identity — having the device is the authorisation.
• Marketing — unsubscribe from the link in any marketing email, or from your account settings.
• Push notifications — turn off in your browser or device settings.

For anything else, or if a self-service route does not work for you, email [email protected]. We respond within one month. You also have the right to complain to your local data protection authority.

GoRunny itself only uses cookies and local storage that are strictly necessary to run the service: keeping you signed in, keeping your table session and cart in sync across devices, remembering your light/dark theme preference, and — for staff who opt in — enabling push notifications. The guest menu, receipts and the admin set nothing else and show no cookie banner. On www.gorunny.com, one strictly necessary cookie (gorunny_lang, kept for a year) remembers the language you chose for the site when you picked one; it holds nothing but that choice.

Google Analytics and Google Ads, with your consent. On our public website (www.gorunny.com: the home page, the pages for restaurant owners, pricing, checkout) we ask before setting any other cookie. If you accept, we load Google Tag Manager, which sets Google Analytics 4 cookies (to see which pages bring venues to us and how they move through the site) and Google Ads cookies (to tell which of our ads led to a request or a purchase). The processor is Google Ireland Limited; data may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework and standard contractual clauses. Analytics data is kept for 14 months. If you decline, nothing from Google is loaded at all; the choice is stored in your browser for this site only, and you can change it any time under “Cookie settings” in the footer. Declining changes nothing about how the site works.

Separately, and without cookies, we count visits per page and per day on our own servers, with the site or search engine you came from. Nothing is stored in your browser for this, and no IP address or other identifier is kept. If you send us a request through the website, we note which of our pages your visit started on and where it came from, so we know which pages help venues find us.

GoRunny is not directed at children. The guest ordering flow does not knowingly collect personal data from children beyond what placing an order at a table requires, and loyalty sign-up asks for an email or phone number.

Traffic is encrypted in transit, integration credentials are encrypted at rest, each venue's data is isolated from every other venue's, staff accounts are individual and protected by a trusted-device check, and backups are encrypted with a restore procedure that is tested on a schedule. Card details never reach our servers. No system is perfect; if you believe you have found a vulnerability, please tell us at [email protected].

We update the "last updated" date above when this policy changes, and post material changes here before they take effect.