Last updated: 2026-10-09

Privacy notice

This notice explains which personal data SmartTag processes, why, and for how long, under Regulation (EU) 2016/679 (GDPR).

1. Roles

• SmartTag, as identified above, is the controller of the data of the business owners who sign up (account, venue, subscription).
• The data of a venue’s own customers (orders, reviews, comments) is collected on the venue’s behalf: the venue is the controller and SmartTag acts as processor (Art. 28 GDPR), only storing it and making it available to that venue.

2. Data we process

• Account: e-mail, name, phone, language and password (stored only as a hash, never in clear).
• Venue: name, address, contact details, opening hours, menu, images, stock, suppliers and printing settings.
• Staff: name and role of operators; the PIN is stored only as a hash.
• Customer orders: name, phone, e-mail and address (when the chosen channel needs them), table, notes, ordered items and amounts. We do not collect payment card data.
• Comments and likes: the text and name typed by the customer, plus a code derived from the IP address (not the address itself) to limit abuse.
• Technical data: IP address and time of requests, used for security, limiting login attempts and diagnosing errors.
• Subscription payments: handled by Stripe; SmartTag only receives the customer identifier, status and renewal dates.
• Contact form: the name, e-mail and message you write, used only to reply to you.

3. Purposes and legal bases

• Providing the requested service (account, menu, orders, stock, printing, subscription billing): performance of a contract, Art. 6(1)(b).
• Security, abuse prevention and service continuity: legitimate interest, Art. 6(1)(f).
• Accounting and tax duties linked to the subscription: legal obligation, Art. 6(1)(c).
• Answering contact form requests: pre-contractual steps or legitimate interest.

4. Cookies and local storage

We only use technical tools, which do not require consent: the session cookie (to keep you signed in and protect forms), the language cookie and, in your browser, the theme preference and cart contents. We do not use profiling, advertising or third-party analytics cookies.

5. Recipients

Data is processed by providers that help us run the service: hosting and infrastructure, e-mail delivery and Stripe for payments. We do not sell data or use it for advertising. If a provider is located outside the European Economic Area, transfers rely on the safeguards required by the GDPR (such as standard contractual clauses).

6. Retention

Account and venue data is kept while the service is active; you can ask for deletion at any time. Data needed for accounting and tax obligations is kept for the legal period. Technical data is kept only as long as strictly needed for security and diagnosis.

7. Your rights

You may request access, rectification, erasure, restriction and portability, and object to processing (Arts. 15-22 GDPR). If you are a venue’s customer, please contact the venue first. You also have the right to lodge a complaint with your data protection authority (in Italy, the Garante).

8. Contact

To exercise your rights use the contact form.