Website privacy notice
Updated 22 September 2026. This website uses Vercel hosting and Supabase for owner authentication, restaurant content and uploaded media. This notice describes the application; the restaurant’s legal identity and final public privacy notice must be confirmed before launch.
What this website uses
Authorised editors sign in using Supabase with their restaurant account and two-factor authentication. The application uses their account identity and email to control access. It stores a Supabase account identifier against approved changes, restaurant content, proposed changes and uploaded media. Supabase handles password authentication and stores password hashes. The restaurant content database does not store passwords, visitor booking details or chat transcripts.
Retention and control
Pending changes expire after 10 minutes. The application removes expired proposals and change history older than 30 days when the dashboard is opened; the current published content remains. Rate-limit records are removed after about one day on the same schedule. Uploaded files remain until an editor removes them. Provider logs, recovery copies and original design backups have separate retention arrangements that must be checked with the site administrator.
Maps and external services
The embedded Google map is off by default. Selecting “Load Google map” contacts Google and shares connection information such as your IP address. Google may use cookies. “Remove map” stops the embed; it cannot undo information already sent. External links to social networks and Google have their own privacy practices.
The guided assistant processes commands in the restaurant application without an AI provider. External AI is disabled by default. If explicitly enabled, the selected request and an allowed-field catalogue are sent to OpenAI’s API; uploaded files, account identifiers and change history are not included. Do not include guest, staff, payment or sensitive personal information in requests.
Photos, video and guest reviews
Only publish media and review excerpts with an appropriate lawful basis and the necessary rights. Images may identify people even when metadata is removed. Dashboard JPEG uploads have metadata removed, and standard MP4 privacy metadata boxes are cleared. Visible faces, voices, private details and material embedded in the footage are not automatically removed.
Your questions and rights
For requests concerning restaurant media or guest review excerpts, contact Pas To Kima at E704, Argaka 8873, Cyprus, or +357 97 717607. Ask the site administrator about owner account records, exports or erasure. Applicable rights can include access, correction, erasure, restriction, objection and portability, subject to the circumstances and legal exceptions. You can also contact the competent data protection authority, including Cyprus’s Commissioner for Personal Data Protection.
Before public use
The restaurant must finalise its controller identity and contact, purposes and lawful bases, supplier and processor agreements, international transfer safeguards, retention schedule and incident procedure. Hosting region, provider retention and EU-only processing have not been verified. This prototype is not a certification of GDPR or other legal compliance.