Privacy policy

Last updated: 2026-10-14

This is a translation; the Spanish version is the reference text.

1. Who is responsible

QR YA (qrya.es) is a service for bars and restaurants to publish their menu with a QR code. It is free and non-profit: nothing is charged for its use, it carries no advertising, no data is sold, and it earns its owner nothing; it is offered as a private individual. The controller of the data and owner of this website is:

• Owner: [to be completed]
• Email: colphilcolphil@gmail.com

2. What data we process

If you have an account (restaurant owners)

• Your email address and password. The password is stored scrambled so that nobody, including us, can read it.
• The language you use the site in.
• When you last logged in and the last day you used the site, to know whether the account is still in use (see point 5).
• The details of your restaurant that you choose to add: name, logo, opening hours, address, phone, email and website of the restaurant, and the menu (dishes, prices, allergens, photos). The restaurant's contact details and the menu are public: that is the purpose of the service.

If you are part of a restaurant's team

• The name the owner gives you and, if they add it, your email address.
• The phones you have logged in on: the type of browser (e.g. "Chrome on Android") and when it was last used, so the owner can log out a lost phone.
• Which dish you marked as sold out, and when.

If you only look at a menu (restaurant customers)

You need no account. We use no statistics, advertising or tracking. If you choose a language, that choice is kept in a cookie in your browser, and lists you make are kept on your own phone (see point 7).

• If the restaurant takes orders by QR code and the waiter scans your list, we save, on that restaurant's bill: the dishes, the name you typed for your list (if you typed one), the table, and a random code your phone made for itself, so the waiter can make your phone show "this one is yours" or "ready". The code is not linked to you or your phone number. Messages from the waiter to your phone are deleted after one day.
• For each menu we only keep the last day it was opened, not who opened it.

Technical data

• When someone tries to log in with a wrong password, we keep the email used, the IP address and the time for at most one day, to stop attacks.
• When you accept this policy (at sign-up) or a restaurant switches on customer orders, we keep which version of the text was accepted, by which account, when, and the IP address it was accepted from, as proof of what was agreed.
• If something goes wrong, the server keeps an error log with technical details (for example, the page that failed), so we can fix it.

3. Why, and on what legal basis

• To provide the service you ask for when you create an account (publishing and managing your menu, your team's access, necessary emails such as confirming your address or changing your password). Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• To keep the site secure and working (login attempts and error logs). Legal basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).

We do not sell or pass on your data, we do not use it for advertising, and we send no newsletters.

4. Who else processes it

• Our web hosting provider (site.eu), which stores the site and database in the European Union and sends the site's emails.
• Anthropic, PBC (United States), provider of the Claude AI model, which translates menus into other languages. Only the menu text is sent (names and descriptions of dishes and sections), never your email or account details, and it is not used to train their models. The transfer to the United States uses the safeguards of the GDPR (the European Commission's standard contractual clauses). Please do not write personal data in your menu.

5. How long we keep it

• Your account and restaurant: while you use them. You can delete them yourself at any time ("Delete my account" on your dashboard) or ask us to.
• Accounts nobody uses: if for 12 months nobody of the restaurant has used the site and no customer has opened its menu, we email the owner 30 and 7 days beforehand and then delete it. Logging in keeps it.
• Accounts whose email address was never confirmed: deleted after 30 days without use, unless we have already approved the restaurant.
• After an account is deleted, a full copy is kept for 30 days in case it was a mistake, then it is deleted too. For 5 years we keep only the account's email address and the record of the texts it accepted, blocked: they are used only if needed for a legal claim.
• Restaurant bills with customers' orders: with the restaurant's account.
• The menu's history of changes (so you can undo): 60 days. Photos of deleted dishes: 60 days.
• "Stay logged in" on a device: 30 days from its last use.
• Email confirmation links: 7 days. Password change links: 1 hour.
• Failed login attempts: 1 day. Messages from the waiter to a customer's phone: 1 day.

6. Your rights

You can ask at any time to see your data, correct it, delete it, restrict or object to its use, or receive it in a format you can take elsewhere (the whole menu can be downloaded as Excel / CSV from your dashboard). Write to colphilcolphil@gmail.com. If you think we have not respected your rights, you can complain to the Spanish Data Protection Agency (www.aepd.es).

7. Cookies and storage on your device

We only use cookies and storage the site needs to work, or that keep something you chose. There are no statistics, advertising or third-party cookies, which is why we don't ask for permission with a banner.

• qrya_session: keeps you logged in while you use the dashboard. Deleted when you close the browser. Customers who only look at a menu don't get it.
• qrya_login: only if you log in with "Keep me logged in on this device" ticked; keeps you logged in on that device for 30 days.
• lang: remembers the language you choose, for one year.

The site also keeps a few things in your browser's own storage (local storage). They stay on your device, are only used for what you are doing, and you can delete them by clearing this site's data in your browser:

• On a menu where the restaurant lets you make a list or order: your list (qrya-list-…), what you have already ordered, for 8 hours (qrya-sent-…), the name you typed (qrya-name), the names given to friends' lists (qrya-people-…), the table you scanned, for 4 hours (qrya-table-…), and your phone's random code (qrya-phone), which goes with your order only when the waiter scans it.
• qrya-book-hint: that you have seen the tip on turning the pages of a menu.
• For restaurant staff: the sections folded away in the menu editor (qrya-folded-sections) and the waiter's own list (qrya-waiter-…).

8. Children

QR YA is a service for businesses. You must be at least 14 to create an account.

9. Changes

If we change this policy, we will say so on this page with a new date. If the change is important, we will tell account owners by email.