Privacy notice

Updated 20 October 2026

Here you will find, in plain words, what data slashfood processes, why, for how long and with whom. It covers people visiting slashfood.it, requesting access and using the dashboard. Venue customers (menus, orders, bookings) find the venue’s own notice on its menu: there the controller is the venue, and slashfood processes that data only on its behalf.

Who processes your data

Controller: slashto s.r.l.
Registered office: Via Galdo 32, 84038 Sassano (SA)
VAT number: 05491010657
Email: info@slashfood.it

We have not appointed a data protection officer (it is not mandatory for us): for any privacy question write to info@slashfood.it.

What we process, why and for how long

The access request on the home page

What data: The name of your venue and your phone number; your name, the town, what kind of venue it is and your email, if you write them (the full form asks for them); what you write under «What would help you», if anything; the language and the page you wrote from; if you came from one of our posts, the name of that post (the «?da=» part of the link); when you gave consent and which version of this notice was in force.
Why: To read the request, see whether we can welcome your venue, get back to you by phone, email or WhatsApp and, if so, send you the invitation to create your login. The post name tells us which content brings requests.
Legal basis: Your consent (Art. 6(1)(a)) and steps you ask us to take before a possible contract (Art. 6(1)(b)).
How long: If the request doesn't become a venue on slashfood, we delete it 12 months after the last thing that happened (the request, our reply, a «not now»), automatically. You can ask us to delete it sooner. If you join with the invitation, it stays linked to your venue while you are a customer.
Do you have to?: No. But without the name of your venue, your phone number and consent we can't read or answer the request. In the short form, the one that starts with two fields, the rest is optional; in the full form we also need your name, the town, what kind of venue it is and your email.

The dashboard account

What data: Email and password (the password is kept by the login service in a non-readable form: we don't see it); first name, last name and phone in your profile; the venue details and legal details you enter; the names of connected devices and the role chosen on each; the name you type to sign in the Board; the messages you send to slashfood from Suggestions and Messages.
Why: To let you in, run the dashboard for you and your staff, and support you.
Legal basis: Performance of the contract (Art. 6(1)(b)).
How long: While the contract is active. Afterwards we delete or anonymise what is no longer needed, except what the law requires us to keep.
Do you have to?: Email and password are needed to have an account; the rest is optional.

Subscription payments

What data: Your customer ID and subscription status at Stripe, the invoices. Card details are handled by Stripe: we don't see or store them.
Why: To collect the subscription and keep the accounts.
Legal basis: Performance of the contract (Art. 6(1)(b)) and tax and accounting obligations (Art. 6(1)(c)).
How long: Accounting records for 10 years (Art. 2220 of the Italian Civil Code); the rest while the contract is active.

Push notifications on your devices

What data: The technical address your browser creates when you allow notifications (and its keys); the content of the notifications, which is about orders and tables.
Why: To send you the alerts you switched on (a call from the kitchen, a new order).
Legal basis: Performance of the contract (Art. 6(1)(b)): you switch them on, and off from the device or dashboard settings.
How long: Until you switch them off or the browser revokes them.

Security and running the site

What data: The IP address, to block anyone sending too many requests in a row (only the count, for at most an hour); records of technical errors, written without personal data; the hosting provider's technical logs; the log of actions taken by slashfood inside venues (who, what, when).
Why: To keep the service secure, find faults and be able to reconstruct what happened.
Legal basis: Our legitimate interest in a secure, working service (Art. 6(1)(f)). You can object by writing to us.
How long: The IP count for an hour; resolved errors for 30 days; the rest for as long as security requires.

Who we share it with

We don’t sell data or use it for advertising. We only entrust it to the providers that run slashfood, who process it on our behalf and following our instructions:

Supabase: database, dashboard login and service emails (such as password recovery). The data sits on servers in the European Union, in Ireland.
Vercel: the service that hosts the site and delivers it to your browser. Through Speed Insights it also measures, anonymously, how fast pages are (loading times, device type, browser and connection, country, the page without its parameters): no cookies, nothing stored in your browser, no identifier linking the measurements to you.
Stripe: subscription payments. For its own processing (for example fraud prevention) Stripe is an independent controller.
Upstash: the counter that limits repeated submissions, when active.
Your browser’s notification service (Google, Apple or Mozilla), only if you switch on push notifications.

Outside the European Union

Vercel, Stripe, Upstash and some of Supabase’s providers are companies based in the United States, or rely on it. When data leaves the European Union it does so with the safeguards required by the GDPR: the EU-US Data Privacy Framework, for companies that are part of it, or the standard contractual clauses approved by the European Commission. You can ask for a copy of the safeguards at info@slashfood.it.

Your rights

At any time you can ask us to:

know what data we hold about you and get a copy;
correct or complete it;
delete it;
restrict its use;
receive it in a machine-readable format, to take it elsewhere;
object to processing based on our legitimate interest;
withdraw your consent: from then on we won’t contact you, and what we did before stays valid.

Write to info@slashfood.it. We reply free of charge within one month; if the request is complex, we tell you within one month why we need more time. If you think we are not handling your data properly, you can complain to the Italian data protection authority (Garante).

Automated decisions

None. A person reads access requests, and we don’t do profiling.

Cookies

The public site uses no cookies. The dashboard uses only technical cookies, needed to keep you logged in and remember the device’s choices. The full list is on the Cookies page.

If this notice changes

The date at the top says when we last changed it. With every access request we store the version you had in front of you when you consented.