Privacy notice

DATA VALUT AI LTD, company number 16841685, is the data controller for sales enquiries, café account administration and its own website operations.

For guest orders and café loyalty contacts, the relevant café normally decides why and how the information is used. That café is the controller and Café QR processes the information to provide the service on its instructions.

• Enquiry details, including name, café name, email, phone number and message.
• Café owner and staff account details, roles and service settings.
• Guest order details, table references, receipts and payment references.
• Loyalty contact details, channel preferences, consent records and unsubscribe requests.
• Technical security logs, campaign attribution and anonymised website usage information.

Payment card details are entered into Stripe’s payment service. Café QR does not store complete card details or hold guest funds.

We use enquiry details to respond and take steps requested before a contract. We use café account information to provide and secure the contracted service, administer billing and meet legal obligations.

Where we rely on legitimate interests, those interests are operating, protecting and improving Café QR and responding to business enquiries. We do not use an enquiry as permission to add someone to a marketing list.

Loyalty marketing is based on the guest’s recorded choice for the relevant café. A guest can withdraw that choice or unsubscribe at any time.

We use service providers for hosting, database storage, authentication, payment processing and message delivery. These may include Vercel, Neon, Clerk, Stripe, Resend and Meta where the corresponding feature is used. We may also disclose information when required by law or to professional advisers under confidentiality.

Some providers process information outside the UK. Where required, we use recognised transfer safeguards or rely on an applicable adequacy regulation. Provider privacy information and safeguard details are available from us on request.

We keep information only while it is needed for the purpose described, the café’s instructions, dispute handling, security and legal or accounting duties. Enquiries that do not become customers are reviewed and deleted when they are no longer needed for follow-up.

Account and transaction records may be retained after service closure where a legal, tax, fraud-prevention or dispute requirement applies. An unsubscribe record may be retained so that the marketing choice is respected.

The public website uses Vercel Web Analytics for aggregated usage information. Vercel states that this service does not use cookies and does not associate analytics events with an identifiable visitor. Our enquiry conversion event contains no form values or contact details.

If you arrive through a campaign link, this website keeps the campaign labels, landing path and referring hostname in session storage for the current browser tab. They are saved with an enquiry if you submit one. We do not store the full referring address or put contact details in campaign labels.

Sign-in and payment services may use cookies or similar storage that is necessary to authenticate users, prevent fraud or complete a payment. Their own notices explain their processing.

Depending on the circumstances, you may have rights to access, correct, erase or restrict personal information, object to processing, receive portable information and withdraw consent. You also have the right to object to direct marketing at any time.

Use the contact form for a request. You can also write to Apartment 25, 17 Standish Street, Liverpool, England, L3 2BD. If your request concerns a café’s guest or loyalty records, contact that café first because it normally controls that information.

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint ↗.