1. Our Commitment to Privacy and the LGPD
At Cardapage, privacy and information security are fundamental pillars of our technology architecture. This Privacy Policy describes clearly and transparently how we process personal data in full compliance with the Brazilian General Data Protection Law (Federal Law No. 13,709/2018 - LGPD) and the Brazilian Internet Civil Framework (Law No. 12,965/2014).
We apply the principle of Privacy by Design and by Default: our architecture collects strictly the amount of data needed to fulfill the order and provide the hospitality or food service.
2. Roles in Data Processing (Controller vs. Operator)
As defined by the LGPD, Cardapage acts in two distinct roles:
Cardapage as Controller
We are the controller of the registration data of partner venues, administrators, operators, and business and technical support contacts.
Cardapage as Operator
When processing orders placed by guests and end customers through the QR codes on tables, rooms or cabins, we act as Operator (processor) on behalf of the partner venue, which acts as the primary Controller of the food service or lodging.
3. What Data We Collect and Why
We collect data according to how each person uses the platform:
A. Data of Managers and Team Users (Web Dashboard)
- Full name, business email and phone number;
- Legal name, trade name, tax ID (CNPJ) and address of the venue;
- Encrypted access credentials (password protected by hashing);
- Billing data for the SaaS subscription (processed through a secure gateway).
B. Data of Customers and Guests (Progressive Profiling in the Menu)
- Spot identification: Number of the room, table, cabin or lounger that was scanned;
- Contact data: Name and phone number (with country/area code) to send order status and delivery confirmation;
- Optional document (when required by the inn or hotel): CPF, RG or international passport, to reconcile with the hotel's PMS;
- Order details: Items selected, preparation notes and time of the request.
C. Technical Browsing Data
- IP address and access date/time records (Art. 15 of the Internet Civil Framework);
- Browser type, preferred language and screen resolution.
4. Guests and International Tourists
Cardapage was built to serve venues that welcome international tourists. We offer multilingual support (Portuguese, English and Spanish), support for the international phone format (E.164), and acceptance of a passport or DNI.
The processing of data of foreign citizens (such as residents of the European Union under the GDPR) follows the same criteria of data minimization, legitimate purpose and security established in the LGPD.
5. Legal Bases for Processing
All processing of personal data at Cardapage is grounded in one of the legal bases set out in Article 7 of the LGPD:
- Performance of a contract or preliminary procedures (Art. 7, V): To enable the transmission and delivery of orders requested by the customer to the venue, and to manage the SaaS subscription;
- Compliance with a legal or regulatory obligation (Art. 7, II): Keeping connection logs as required by the Internet Civil Framework, and issuing tax documents;
- Legitimate interest (Art. 7, IX): For fraud prevention, ensuring stability and improving system performance.
6. Sharing Data with Third Parties
Cardapage does not sell or monetize the personal data of users or guests. Data is shared only in the following circumstances:
- With the venue that was ordered from: Transmission of the order data (name, room/table, items) to the kitchen/bar KDS screen and to the partner venue's PMS;
- Cloud infrastructure providers: Servers and databases with high levels of physical and logical security (such as AWS, Vercel and Cloudflare);
- Payment processors: PCI-DSS certified financial gateways for secure processing of charges;
- Court order or competent authority: In strict compliance with the law or a formal court order.
7. Information Security and Retention
We adopt rigorous technical and administrative measures to protect personal data against unauthorized access, loss or unlawful alteration:
- Encryption in transit (HTTPS / TLS 1.3);
- Encryption of sensitive data at rest (AES-256);
- Strict role-based access control (RBAC);
- Audit logs and active monitoring against threats;
- Retention period: Data from order sessions at tables/rooms is kept for the period needed to provide the service and for tax and operational accountability, and is then archived or anonymized.
8. Your Rights as a Data Subject (Art. 18 LGPD)
In accordance with Article 18 of the LGPD, you have the following rights upon formal request:
10. International Data Transfers
Our cloud computing services operate with data centers in Brazil and abroad under international-standard contractual clauses that ensure levels of protection compatible with the LGPD and the GDPR.