Privacy policy

1. Controller

Oy Sjoba Ab (business ID 3402091-5), Vaasa, Finland.

E-mail: [email protected]. Subject line: “Privacy enquiry”.

2. Data we collect

Which data we hold depends on how you use Smajl.

• Restaurant accounts: name, e-mail address, phone number, role, company name and business ID, sites and invoicing details.
• Logins: e-mail address and password for owner accounts, handled by our sign-in provider and stored only as a hash. Till PINs and API keys are also stored only as hashes.
• Website forms: name, e-mail address and, if you give them, phone number, restaurant, number of sites, point-of-sale system and your message.
• Club members (the restaurant’s guests): name, phone number and/or e-mail address, an optional date of birth, language, purchases (amount, time, site and what was ordered), points and rewards, marketing consent, a push subscription for those who opt in, and support messages. We never store card details. Payment happens on the restaurant’s card terminal.
• Message logs: recipient, content and delivery status of SMS and e-mails sent through the platform.
• Technical data: IP address, browser type, device information and error logs.

3. Why we use data

We use personal data:

• To create and run accounts, clubs, the till, the dashboard and the integrations a restaurant has switched on.
• To answer enquiries, set up pilots and onboard restaurants.
• To send messages on a restaurant’s behalf (SMS, e-mail, push), only when the restaurant sends them.
• To invoice and keep the books.
• To keep the service secure, prevent misuse and find faults.
• To improve the service. For this we use only aggregated and anonymised usage data, from which no restaurant, guest or purchase can be identified. Such data is not personal data.
• To meet legal obligations, such as bookkeeping and tax law, and to answer lawful requests.

4. Legal basis

We process personal data on these grounds under Article 6 of the GDPR:

• Contract (6.1 b): creating accounts, providing the platform, onboarding and invoicing.
• Legitimate interest (6.1 f): answering enquiries, security and troubleshooting, and improving the service.
• Legal obligation (6.1 c): bookkeeping and tax.
• Consent (6.1 a): the early-access list and any marketing from us. You can withdraw it at any time.
• For club members, the restaurant decides the legal basis as controller: usually the membership agreement, and consent for marketing and push notifications.

5. When we are the controller

We are the controller for:

• Accounts and contact details of restaurant owners and staff
• Enquiries, early-access sign-ups and pilot discussions
• Agreement, invoicing and bookkeeping data
• Technical and security logs

6. When we are a processor

For club members’ data, the restaurant that runs the club is the controller and we are its processor. We process this data only on the restaurant’s documented instructions and under a data processing agreement, and we may not use it for our own purposes.

Each club has its own privacy policy. If you are a club member, you use your rights with the restaurant, and we help it to answer.

The restaurant is responsible for:

• Having a legal basis for the processing
• Informing its members, including through its own privacy policy
• Answering members’ requests about their rights
• Deciding who on its staff can see what

7. Service providers

We use the providers below. They process data on our behalf under contract and may not use it for their own purposes. We never sell personal data.

• Supabase: the database and sign-in, hosted in the EU (Stockholm). Each restaurant has its own database.
• Netlify: hosting of this website and of the club apps.
• Resend and Brevo: delivery of e-mail.
• Bird: delivery of SMS.
• Push services run by browser and device makers (such as Apple, Google and Mozilla): delivery of push notifications to guests who have opted in.
• Partners a restaurant connects itself, such as a point-of-sale system or a delivery platform: they send purchase data to the club and are controlled by the restaurant, not by us.
• Authorities, where the law requires it.

8. Transfers outside the EU

Your data is stored in the EU. Some of our providers, such as Netlify and Resend, are US companies, so data may also be processed in the United States. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses. Ask us and we will send you a copy of the safeguards.

9. How long we keep data

We keep personal data only as long as it is needed:

• Website enquiries that do not lead to a customer relationship: deleted no later than 24 months after our last contact.
• Early-access list: until you ask us to remove you.
• Restaurant accounts and club data: for as long as the agreement is in force. After it ends we delete the restaurant’s data, including its members’ data, within two months, unless the law requires us to keep something. The restaurant can ask for an export first.
• Invoices and bookkeeping records: six years, as bookkeeping law requires.
• Club members: a member can delete their account in the app at any time. Personal details are then removed immediately, while purchases the restaurant must keep for bookkeeping remain without any personal details.
• Technical logs: only as long as needed for security and troubleshooting.

10. Security

We protect data with measures such as:

• Encrypted connections (HTTPS) everywhere.
• A separate database for each restaurant, so one restaurant’s members are never mixed with another’s.
• Access limited by role: owner, counter staff and read-only access for an accountant.
• Passwords handled by our sign-in provider, and till PINs and API keys stored only as hashes.
• QR passes that renew every 30 seconds, and single-use reward codes.
• An append-only points ledger: every change leaves a line and a reason.
• Signed integrations: the same receipt never counts twice.

11. Your rights

Under the GDPR you have the right to:

• Access your data (Article 15)
• Have inaccurate data corrected (Article 16)
• Have your data erased (Article 17)
• Ask us to restrict the processing (Article 18)
• Receive your data in a machine-readable format (Article 20)
• Object to processing based on legitimate interest (Article 21)
• Withdraw your consent at any time (Article 7)

12. Using your rights

E-mail us at [email protected]. If you are a member of a restaurant’s club, contact the restaurant that runs the club and we will help it. You can also delete your own account in the club’s app.

We answer requests within 30 days.

13. Cookies

This website uses no analytics or marketing cookies. One functional cookie remembers the language you chose.

In a club app, strictly necessary cookies keep guests signed in (up to 180 days) and staff signed in at the till (14 hours).

14. Children’s privacy

The platform is built for restaurants and business use. Restaurants decide who may join their club. We do not knowingly collect personal data from children for our own purposes.

15. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change is significant, we also tell restaurant customers by e-mail. If you keep using the service after a change, you accept the updated policy.

16. Supervisory authority

You have the right to complain to the Office of the Data Protection Ombudsman (tietosuoja.fi), e-mail [email protected], phone +358 29 566 6700.