Protecting your data is at the heart of Qarteo. This policy explains what data we process, why, for how long and how to exercise your rights, in accordance with Algerian Law No. 18-07 of 10 June 2018 on the protection of individuals with regard to the processing of personal data and, where it applies, the General Data Protection Regulation (GDPR).
Who is responsible for your data?
The Qarteo Platform (https://qarteo.com) is published by Qarteo. For any question about your data, write to us at web@qarteo.com.
Our role depends on who you are:
- Restaurateurs, their team members and website visitors: we are the data controller.
- Guests (people who order, book, call a waiter or leave a review from a menu): the restaurant concerned is the data controller; Qarteo acts as a technical processor, only on its instructions and to provide the service.
The data we process
Restaurateur and team accounts
- Name, email address, phone number, profile photo, interface language;
- password, stored only in an irreversible encrypted form (hash) — nobody, including our team, can read it;
- venue information: name, address, contact details, opening hours, social networks, menu, photos.
Subscription and payments
- Chosen Plan, subscription history, amounts, invoices, transaction references and the proofs of payment you upload;
- no full card data: card payments are entered directly with the provider (SATIM, Paddle, NOWPayments), which only sends us the outcome of the transaction.
Guest data (on behalf of restaurants)
- Order: name, phone number, delivery address, table number, items chosen, notes, promo code used;
- booking: name, phone number, email, party size, date and time, notes;
- review: rating, comment and, if you provide them, name and contact details;
- waiter call or bill request: table number and time.
Restaurant staff (management module)
When the restaurateur uses staff management: name, position, contact details, hourly or monthly pay, schedule and clock-in records. The time clock PIN code is stored in hashed form.
Menu visit statistics
To measure menu audiences, we record anonymously: a random browser identifier, the QR code or source used, device type, operating system, browser, language, approximate country and time of the visit. Your IP address is never stored in clear text: it is immediately turned into an irreversible fingerprint, used only to count unique visitors and prevent abuse.
Contact, security and activity log
- Messages sent through the contact form: name, email, subject, message;
- log of sensitive actions (sign-ins, settings changes, payments) linked to an IP address fingerprint, for account security.
Why do we use this data?
- To provide the service (performance of the contract): create and manage your account, publish your menu, pass on orders and bookings, show your statistics, provide support.
- To manage subscriptions and invoicing (contract and legal obligations): collect payments, issue invoices, keep accounts.
- To ensure security (legitimate interest): prevent fraud, spam and unauthorised access, limit abuse (bot protection, rate limiting).
- To keep you informed (contract and legitimate interest): service emails (account verification, renewal reminders, getting-started tips, weekly report, important announcements).
- To improve the Platform (legitimate interest): aggregated, anonymous usage statistics.
We never sell or rent your data, and we display no targeted advertising.
Cookies and local storage
We only use cookies that are necessary for the service to work or for anonymous audience measurement:
- Session and security: keeping you signed in and protecting forms (anti-forgery token). Duration: the session.
- Anonymous visitor (qrg_vid): random identifier used to count a menu's unique visitors. Duration: 12 months.
- Referral (qrg_ref): remembers the referral code of an invitation link. Duration: 30 days.
- Preferences: language, messages already dismissed in the dashboard.
Your browser's local storage also keeps, on your device only: your favourite dishes, the current cart, light or dark mode and whether the menu was added to your home screen. Public forms may be protected by a bot check (Cloudflare Turnstile) used only to tell humans from bots. You can delete these items at any time from your browser settings.
Who can access your data?
- The restaurant concerned, for the guest data relating to it, and its team members according to the rights it grants them;
- our team, only when necessary (support, payment approval, security), with restricted and logged access;
- our technical providers, acting on our instructions: hosting and backups, email delivery, payment (SATIM and Algerian banks, Paddle, NOWPayments), artificial intelligence (Anthropic or OpenRouter, for reading menu photos and translation, without any guest data), bot protection (Cloudflare) and fonts (Google Fonts);
- WhatsApp, when you choose to send an order via WhatsApp: the message is sent from your own app;
- authorities, only upon a lawful request.
Transfers outside Algeria
Some providers (international payment, artificial intelligence, bot protection, fonts) are located outside Algeria. We limit the data sent to what is strictly necessary and choose providers offering recognised security and confidentiality guarantees, in compliance with the conditions set by Law No. 18-07.
How long do we keep your data?
- Restaurant account and content: as long as the account is active. After the account is deleted, access is disabled immediately and the data is then deleted or anonymised, except for what the law requires us to keep.
- Invoices and accounting records: 10 years, in line with accounting and tax obligations.
- Visit statistics: 13 months, then automatically deleted.
- Guest data: for the period chosen by the restaurant, at most as long as its account exists.
- Contact messages: the time needed to handle the request, then 3 years at most.
- Order tracking links: valid for 24 hours.
How do we protect your data?
- Encrypted connection (HTTPS) across the whole Platform;
- hashed passwords and PIN codes, IP addresses turned into irreversible fingerprints, encrypted technical keys and credentials;
- strict separation of data between restaurants and role-based access control (owner, team, administrator);
- bot protection and limits on the number of attempts on sensitive forms;
- log of sensitive actions and regular backups.
In the event of a data breach likely to put your rights at risk, we will inform you and the competent authority under the conditions set by law.
Your rights
You have the following rights over your data:
- information and access: know what data we hold and get a copy of it;
- rectification: correct inaccurate data — most of it can be edited directly from your account;
- erasure: delete your account from the "Account" page or ask us to do it;
- objection: object, on legitimate grounds, to certain processing, in particular non-essential emails;
- portability: export your menu and statistics (CSV formats) from the dashboard.
To exercise your rights, write to web@qarteo.com stating the email address of your account. We reply within 30 days at most. If you are a guest, please contact the restaurant concerned first: we will help it answer your request. You may also lodge a complaint with the Algerian National Authority for the Protection of Personal Data (ANPDP) or with the data protection authority of your country.
Minors
Restaurateur accounts are reserved for adult professionals. Public menus can be viewed by anyone; we do not knowingly collect any data about a child beyond what is strictly necessary for an order or a booking.
Changes to this policy
We may update this policy to reflect changes in the service or in regulations. The date of the last update is shown at the top of the page; in the event of a significant change, you will be informed by email or in your dashboard.
Contact us
For any question about your data or this policy: web@qarteo.com or through our contact form. See also our Terms of use.