Spiceuplite

Privacy Policy

Last Revised: Monat/Jahr

⚠ TEST VERSION (BETA) — Spiceup-Lite is currently in a test phase. This document applies together with our Beta Program Terms, which take priority on points where they differ from this document. Features, data handling, and pricing described here may change before general availability.

1. Introduction

This Privacy Policy explains how Spiceup-Lite collects, uses, and shares ("processes") personal information in connection with the Spiceup-Lite restaurant ordering platform ("Restaurant Services"). It also explains your privacy rights.

Spiceup-Lite provides software that lets restaurants ("Restaurant Partners") run their own branded ordering website, covering delivery, pickup, and table reservations.

As used here, "personal information" means information relating to an identified or identifiable individual — for example, your name, address, email, phone number, or order history.

2. Scope

This Privacy Policy covers:

  • Guests — when you place an order or make a reservation through a Restaurant Partner's Spiceup-Lite-powered page, we process your contact and transactional information.
  • Restaurant Partners — individuals who own, operate, or manage a restaurant using Spiceup-Lite.

This Privacy Policy does not cover our processing as a data processor on behalf of a Restaurant Partner. When you place an order, the Restaurant Partner is the party responsible for deciding how your data is used to fulfil that order — Spiceup-Lite processes it only on their instructions, under a data processing agreement between us and the Restaurant Partner. Restaurant Partners are independent businesses with their own policies; if you have questions about how a specific restaurant handles your data, contact that restaurant directly using the details on their ordering page.

3. Who Is Responsible

Spiceup-Lite Legal Operations, operating Spiceup-Lite, registered at Av. da Liberdade 110, 1250-146 Lisboa, Portugal, is responsible for the processing described in this Privacy Policy. Contact: contact@spiceuplite.com.

Operating entity. Until Spiceup-Lite reaches 50 active Restaurant Partners, the platform is operated under a single sole-trader (freelancer) tax registration in Portugal, NIF 309746590, and all invoicing and administration for the platform currently runs through this one registration. This freelancer status is compatible with Portugal's VAT exemption regime (Article 53 of the Portuguese VAT Code) for annual turnover up to €15,000; Spiceup-Lite will review its legal structure, including potential incorporation as a company, before this threshold or the 50-partner milestone is reached, whichever comes first.

4. What We Process

Depending on whether you are a Guest or a Restaurant Partner, we may process:

  • Contact information: name, email, phone number, delivery address
  • Order information: items ordered, order value, payment method used, delivery or pickup preference, reservation details
  • Restaurant Partner account information: business name, login credentials, dashboard configuration (menu, delivery zones, pricing rules)
  • Support information: messages sent to us requesting help
  • Technical information: IP address, device/browser type, cookie identifiers (see our Cookie Policy)

We collect this directly from you when you place an order, make a reservation, or register a Restaurant Partner account. Some information is required for the service to function — for example, we cannot deliver an order without a delivery address.

5. Why We Process It

We process personal information to:

  • provide the ordering, reservation, and dashboard functionality of the Restaurant Services;
  • generate aggregated, anonymized analytics for Restaurant Partners — never identifying an individual Guest to a Restaurant Partner beyond what the order itself already discloses;
  • respond to support requests;
  • maintain the security and proper operation of our systems; and
  • comply with legal obligations (e.g. tax and accounting record-keeping).

6. Legal Basis (GDPR)

For individuals in the EU/EEA and UK:

  • Processing needed to provide the Restaurant Services relies on contractual necessity.
  • Aggregated analytics for Restaurant Partners relies on our legitimate interest in helping our Restaurant Partners understand and improve their business.
  • Where required, certain processing relies on compliance with a legal obligation.

7. Retention

We retain personal information only as long as necessary for the purpose it was collected, or as required by law (for example, invoicing records are generally kept for the statutory period applicable in Portugal).

8. Who We Share Information With & Third-Party Sub-Processors

We share personal information with the following service providers that assist in operating our platform:

  • Supabase (Database & authentication) — primary data storage hosted within the EU (Frankfurt region).
  • Vercel (Frontend hosting) — website delivery via global CDN with EU edge locations.
  • Render (Backend API hosting) — application servers processing backend API requests.
  • Cloudflare R2 (Object storage) — secure cloud storage for uploaded menu images and import files in EU jurisdiction.
  • Trigger.dev (Background jobs) — asynchronous task queueing and job execution.
  • Upstash Redis (In-memory caching) — temporary caching and API rate limiting.
  • Resend (Transactional email) — sending order receipts, booking confirmations, and account notifications.
  • Mapbox, Inc. (Geocoding & maps) — processing delivery addresses to calculate delivery zones and render map pins.
  • FormSubmit (Contact submissions) — processing messages submitted through our public contact form.
  • Stripe & PayPal (Payment processors) — handling subscription payments and customer order checkouts.

Local thermal printing note: Automated thermal receipt printing using local utilities (such as QZ Tray) operates locally within the Restaurant Partner's network hardware and does not transmit data to external third-party printing cloud servers.

We do not sell personal information. We may disclose information where required by law, or in connection with a business transfer (e.g. merger), subject to the same protections described here.

9. International Transfers

Your personal information is primarily stored within the EU/EEA. Where third-party service providers (such as Stripe or PayPal) process data outside the EU/EEA as part of their global infrastructure, such transfers are governed by standard contractual clauses or equivalent legal transfer frameworks.

10. Cookies

Spiceup-Lite and, where applicable, Restaurant Partners use cookies and similar technologies as described in our Cookie Policy.

11. Your Rights

Subject to applicable law, you have the right to:

  • access the personal information we hold about you;
  • correct inaccurate information;
  • request deletion;
  • restrict or object to certain processing;
  • request a portable copy of your data; and
  • lodge a complaint with your local data protection authority.

To exercise these rights, contact contact@spiceuplite.com. If your question concerns a specific order, we may need to direct you to the relevant Restaurant Partner, who is the responsible party for that transaction.

12. Contact

Questions about this Privacy Policy can be sent to contact@spiceuplite.com.