Privacy notice

DATA VALUT AI LTD, company number 16841685, is the data controller for sales enquiries, café account administration and its own website operations.

For guest orders and café loyalty contacts, the relevant café normally decides why and how the information is used. That café is the controller and Café QR processes the information to provide the service on its instructions.

• Enquiry details, including name, café name, email, phone number and message.
• Café owner and staff account details, roles and service settings.
• For café owners and staff, when they sign in: IP address, approximate location (country and city from that address), time zone, browser language and device type. We use it to secure accounts, support the café and check its clock and region are set correctly, and keep the last 20 sign-ins per person. Guests are not included.
• Guest order details, table references, receipts and payment references.
• Loyalty contact details, channel preferences, consent records and unsubscribe requests.
• Technical security logs, campaign attribution and anonymised website usage information.
• Menu photos or PDFs and extracted item details when you request the public menu preview.

Payment card details are entered into Stripe’s payment service. Café QR does not store complete card details or hold guest funds.

We use enquiry details to respond and take steps requested before a contract. We use café account information to provide and secure the contracted service, administer billing and meet legal obligations.

Where we rely on legitimate interests, those interests are operating, protecting and improving Café QR and responding to business enquiries. We do not use an enquiry as permission to add someone to a marketing list.

Loyalty marketing is based on the guest’s recorded choice for the relevant café. A guest can withdraw that choice or unsubscribe at any time.

We use service providers for hosting, database storage, authentication, payment processing and message delivery. These may include Vercel, Neon, Clerk, Stripe, Resend, Meta and OpenAI where the corresponding feature is used. When you request a menu preview, the uploaded file and prompt are sent to OpenAI to extract menu items. We may also disclose information when required by law or to professional advisers under confidentiality.

If a café owner or manager connects Café QR to an AI assistant such as Claude or ChatGPT, that assistant receives the answers to the questions they ask about their own café: sales figures, orders, menu items, busy times and guest ratings and comments. Guests’ names, phone numbers and email addresses are not shared through the connector. Sign-in uses Clerk, and Café QR never sees or stores the assistant’s password or the conversation itself. What the assistant’s provider (Anthropic or OpenAI) does with the conversation is governed by the owner’s own account with that provider. We do not use café data to train AI models. The owner can disconnect at any time in the assistant’s settings.

Some providers process information outside the UK. Where required, we use recognised transfer safeguards or rely on an applicable adequacy regulation. Provider privacy information and safeguard details are available from us on request.

We keep information only while it is needed for the purpose described, the café’s instructions, dispute handling, security and legal or accounting duties. Enquiries that do not become customers are reviewed and deleted when they are no longer needed for follow-up.

Account and transaction records may be retained after service closure where a legal, tax, fraud-prevention or dispute requirement applies. An unsubscribe record may be retained so that the marketing choice is respected.

The public menu preview does not save the uploaded file or extracted sample in a Café QR account; the sample remains in the browser page until it is closed or reloaded. To limit misuse, a keyed hash of the request IP and an attempt counter are retained for rate limiting, with old entries cleaned during later preview requests after 24 hours. If you ask for follow-up, your contact details are saved as an enquiry; the menu file is not attached to it.

The public website uses Vercel Web Analytics for aggregated usage information. Vercel states that this service does not use cookies and does not associate analytics events with an identifiable visitor. Our enquiry conversion event contains no form values or contact details.

If you accept cookies in the banner, the public marketing pages and blog also use Microsoft Clarity, which records how visitors click, scroll and move around a page so we can see where the site is confusing. Clarity sets cookies to link page views in a visit and masks text typed into form fields. Nothing is loaded if you reject, and you can change your answer at any time with “Cookie settings” at the bottom of the page. Clarity does not run in the café dashboard, on staff screens, or on the menus and ordering pages guests use. Microsoft’s privacy statement explains its processing.

If you accept cookies in the banner, the public website may also use Google Ads conversion measurement. When you start a free trial or send us an enquiry after clicking one of our adverts, Google’s tag can record that it happened (for a sign-up, together with a Stripe checkout reference; for an enquiry, nothing you typed), so we know which adverts work. We do not use it to build advertising audiences or to personalise adverts. It does not run in the café dashboard, on staff screens, or on guest ordering pages, and nothing is loaded if you reject. Google’s privacy policy explains its processing.

When you arrive from one of our Google adverts, the link carries a click reference from Google (gclid). If you then start a free trial or send us an enquiry, we keep that reference with your sign-up or enquiry, together with the campaign tags on the link, so we know which adverts and campaigns bring venues to us. We may send the reference back to Google Ads with the date of the sign-up or enquiry, and nothing else, so Google can count which adverts led to one. No cookie is set for this, and no names or contact details go to Google.

If you accept cookies, the public website also uses Google Analytics through the same Google tag, to count visits and see which pages and sources lead to sign-ups. It sets cookies (named _ga) to link page views in a visit. We do not use it for advertising audiences, it does not run in the café dashboard, on staff screens or on guest ordering pages, and nothing is loaded if you reject.

If you accept cookies, the public website also uses the TikTok pixel, so we can tell when a free trial or an enquiry follows one of our TikTok adverts. It sets cookies (named _ttp) to link visits, and records page views and those two events (for a sign-up, together with a Stripe checkout reference; for an enquiry, nothing you typed). No names or contact details go to TikTok. It does not run in the café dashboard, on staff screens or on guest ordering pages, and nothing is loaded if you reject. TikTok’s privacy policy explains its processing.

If you accept cookies, the public website also loads Google Tag Manager, which we use to manage the measurement tags described above. It does not run in the café dashboard, on staff screens or on guest ordering pages, and nothing is loaded if you reject.

If you arrive through a campaign link, this website keeps the campaign labels, landing path and referring hostname in session storage for the current browser tab. They are saved with an enquiry if you submit one. We do not store the full referring address or put contact details in campaign labels.

Sign-in and payment services may use cookies or similar storage that is necessary to authenticate users, prevent fraud or complete a payment. Their own notices explain their processing.

Depending on the circumstances, you may have rights to access, correct, erase or restrict personal information, object to processing, receive portable information and withdraw consent. You also have the right to object to direct marketing at any time.

Use the contact form for a request. You can also email contact@cafeqr.app. If your request concerns a café’s guest or loyalty records, contact that café first because it normally controls that information.

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint ↗.