Privacy Policy
Last updated: 21 September 2026
1. Who we are
Servd ("we", "us", "our") operates the Servd platform — a QR-based ordering and analytics service for bars and restaurants. Our contact address is info@servd-ai.com.
We are the data controller for the personal data of venue owners and staff who use our dashboard. For personal data processed through a venue's ordering system (customer orders), we act as a data processor on behalf of the venue operator.
2. What data we collect and why
Venue owners and staff (dashboard users)
- Account information — name, email address, and (if you set one) a hashed password. Collected when you create an account or sign in via Google, Facebook, or Microsoft. Used to authenticate you and provide access to your dashboard.
- Business information — venue name, address, phone number, and related details you add to your account. Used to power your ordering system and menus.
- Usage data — pages visited and actions taken within the dashboard, collected via Google Analytics (where enabled). Used to improve the product.
- Subscription and payment information — if you subscribe to a paid plan, payments are processed by Stripe. We store your Stripe customer and subscription identifiers and status, but never your card details.
- Connected accounts — if you link a Facebook, Instagram, Google Analytics, Google Business Profile or Square account, we store encrypted access tokens and the analytics, listing and order data needed to power your dashboard insights.
Customers placing orders
Customers can order as a guest or with an optional customer account. We collect:
- Order content — items ordered, quantities, modifiers, tips, and any notes, stored against the table and venue.
- Contact details — if you create a customer account we store your name and email address; guests may optionally provide an email to receive a receipt. Used to send order receipts and, for account holders, to show your order history.
- Payment information — card payments are processed by Stripe. Your card details are entered directly with Stripe and never reach our servers; we only store non-sensitive payment metadata such as the payment reference, amount, and status.
- Order IDs— stored in your browser's local storage so you can view your order status. These stay on your device unless you make an order-status request to our server.
We never see or store full payment card numbers — these are handled entirely by Stripe, our PCI-compliant payment processor.
3. Legal basis for processing (UK GDPR)
- Contract — processing your account and business data is necessary to provide the service you have signed up for.
- Legitimate interests — we process limited analytics data to improve and secure the platform, where this does not override your rights.
- Consent — where we use analytics cookies (Google Analytics), we will seek your consent before setting those cookies.
4. Cookies and local storage
Essential cookies (no consent required)
We set a single session cookie to keep you signed in to the dashboard. This cookie is strictly necessary and cannot be disabled without breaking authentication.
Analytics cookies (consent required)
If Google Analytics is enabled on a page, it sets cookies to measure traffic and usage patterns. These are non-essential and will only be set if you have given consent. You can withdraw consent at any time by clearing your browser cookies.
Local storage
The customer ordering pages store your order IDs in your browser's local storage so you can track your order status. This data stays on your device and is not a cookie. You can clear it at any time via your browser settings.
5. Third-party services
We use the following sub-processors to deliver the service:
| Provider | Purpose | Location |
|---|---|---|
| Neon | PostgreSQL database hosting | EU / US |
| Vercel | Application hosting and deployment | EU / US |
| Stripe | Card payment processing (orders and subscriptions) | EU / US |
| Resend | Transactional and receipt emails | US |
| Twilio | SMS notifications (where enabled) | US |
| Google (Gemini AI) | Menu-photo scanning and the in-dashboard help assistant | US |
| Google Analytics | Usage analytics (where enabled) | US |
| Meta (Facebook / Instagram) | Social account data connections (where linked) | US |
| Google (Business Profile) | Listing and review data connection (where linked) | US |
| Square | Point-of-sale data connection (where linked) | US |
Where data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses or equivalent safeguards approved by the ICO.
6. How long we keep your data
- Account data — retained for as long as your account is active. Deleted within 30 days of a verified account deletion request.
- Order data — retained for up to 12 months to support venue reporting, then anonymised or deleted.
- Analytics data — retained for 14 months in Google Analytics (the platform default), after which it is automatically deleted.
7. Your rights under UK GDPR
You have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your personal data ("right to be forgotten").
- Restriction — ask us to limit how we use your data.
- Portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email us at info@servd-ai.com. We will respond within one calendar month.
You also have the right to lodge a complaint with the UK supervisory authority — the Information Commissioner's Office (ICO) at ico.org.uk.
8. Security
We use industry-standard measures to protect your data, including encrypted database connections (TLS), AES-256-GCM encryption for any stored OAuth tokens, and HTTPS-only access. No system is completely secure; if you believe your data has been compromised, please contact us immediately.
9. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of this page will always reflect when it was last revised. Continued use of the service after a change constitutes acceptance of the updated policy.
10. Contact
For any privacy-related questions or requests, contact us at info@servd-ai.com.