Privacy Policy

For the website orderhero.net, the back office dashboard.orderhero.net and the orderhero apps (POS and kiosk). Last updated: October 2026 · Deutsche Fassung (the German version is legally binding)

1. Who we are

orderhero is a point-of-sale, ordering and reservation platform for restaurants. CAPSOFT is the controller for this website and for our customer contracts. For data that restaurants process with orderhero (orders, reservations, staff), the restaurant is the controller and CAPSOFT acts as processor under Art. 28 GDPR.

2. Website and hosting

The website, back office and database run on servers of Hetzner Online GmbH in Helsinki, Finland (European Union). When you visit, the server processes technically necessary data (IP address, time, requested URL, status code, browser identifier) for delivery, security and troubleshooting. We use no analytics, no advertising services and no tracking cookies.

3. Customer account and billing

When a restaurant registers, we store the business name, address, VAT ID, email address and a password (hashed only). Invoices and payments are handled by Stripe Payments Europe, Ltd., Dublin, Ireland; data may be transferred to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework.

4. orderhero in operation

• POS and kiosk: orders, payments, receipts, shifts and staff logins (PINs hashed only).
• Card payments: processed by Stripe; orderhero never stores full card data.
• Fiscal signing (TSE): via fiskaly GmbH, Vienna, Austria.
• Reservations: guest name, contact details and reservation time; confirmations by email.
• AI allergen suggestions: on the restaurant's request, a dish's name, description and category are sent to Anthropic PBC (USA) to suggest allergens. No personal data is sent.

5. Google Business Profile

Restaurants can optionally connect their Google Business Profile (Google Search and Google Maps) to orderhero in the back office under "Google". The connection is only made at the restaurant's explicit request, using Google sign-in and the permission "Manage your business profiles" (scope https://www.googleapis.com/auth/business.manage).

Data we access

• The list of business profiles managed by the signed-in Google account (name, address, Maps link), so the restaurant can choose its own listing.
• The existing action links of the chosen listing (such as "Reserve a table" or "Order online"), so we can create, update or remove our own links.

We do not read reviews, messages, insights, photos or any other content of the listing, and we do not access other Google data of the user.

How we use the data

orderhero writes to the chosen listing only what the restaurant switches on in the back office: a link to its reservation page, a link to its online shop, its menu (dishes, prices, descriptions, allergens) and its regular and special opening hours. We use Google user data solely to provide this feature to the restaurant that connected it.

Storage and protection

We store only the access token issued by Google (encrypted), the identifier and name of the chosen listing, and the time and result of the last update, on our servers in the European Union. Access is limited to the restaurant's own back office; CAPSOFT staff access it only where necessary for support, security or legal obligations.

Sharing

We do not sell Google user data, do not share it with third parties, do not use it for advertising, and do not use it to develop, improve or train AI or machine learning models.

Retention and deletion

The restaurant can disconnect Google at any time in the back office under "Google". orderhero then removes its links from the listing and deletes the stored access token and listing information. When the contract ends or the restaurant is deactivated, orderhero disconnects in the same way automatically. The menu last sent remains in the Google listing, where the restaurant can edit or delete it. You can also revoke access at any time at myaccount.google.com/permissions.

Limited Use

orderhero's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany. Contact us at service@orderhero.net.

7. Changes

We update this policy when orderhero or the law changes. The version published here applies.