Privacy Policy
Effective from 2026-08-08
1. Controller
Oleksii Pokrovskyi, sole proprietor registered in Ukraine
29 Dikkensa St., 50019 Kryvyi Rih, Dnipropetrovsk Oblast, Ukraine
support@machbaro.com
Full provider details: Legal Notice.
2. What this covers
Machbaro is software for hospitality businesses: a digital menu, QR codes for tables and a way to receive orders. This policy sets out what data is processed, for what purpose, on what legal basis and for how long.
Two groups need to be told apart: operators, who hold an account with us, and guests, who order at a venue. Guest orders are covered in section 5.
3. Processing at a glance
| Purpose | Data | Legal basis | Storage |
|---|---|---|---|
| Running the account and providing the service | name, email, password hash, confirmation of business use | contract, Art. 6(1)(b) GDPR | while the account exists |
| Managing the venue and its menu | venue details, menu, tables, uploaded images | contract, Art. 6(1)(b) GDPR | while the account exists |
| Securing the account | two-factor data, passkeys | contract, Art. 6(1)(b) GDPR | until the user turns them off |
| Sign-in, abuse prevention, fault diagnosis | session records with IP address and browser identifier, server logs | legitimate interest in a secure service, Art. 6(1)(f) GDPR | short term; sessions expire after inactivity, logs are rotated |
| Measuring use of the website with Google Analytics | pages visited, time of visit, referrer, approximate region, browser and device information, and random client and session identifiers | legitimate interest in understanding and improving the website, Art. 6(1)(f) GDPR | according to the retention period configured in Google Analytics; analytics cookies expire after no more than 2 years |
| Operating the subscription | subscription and transaction data | contract, Art. 6(1)(b) GDPR | for the duration of the subscription |
| Answering support requests | the content of your message, your email address and anything you choose to include | contract, Art. 6(1)(b) GDPR where you are a customer; legitimate interest in answering enquiries, Art. 6(1)(f) GDPR otherwise | until the request is settled and follow-up questions are no longer expected |
| Meeting record-keeping duties | billing-related data | legal obligation, Art. 6(1)(c) GDPR, where applicable | for the statutory period that applies |
We state retention in days or years only where it is actually fixed. Where it is not, the criteria above apply — which is what Art. 13(2)(a) GDPR expressly allows.
Providing account data is necessary to enter into the contract; without it no account can be kept.
4. Recipients
- Hetzner Cloud — hosting of the application and database, acting as a processor on our instructions. Servers: Helsinki, Finland (European Union).
- Zoho — provider of the support@machbaro.com mailbox; it processes the correspondence sent to and from that address.
- Paddle — Merchant of Record for subscription payments, acting in its own right.
- Google Ireland Limited — Google Analytics, acting as a processor. For devices in the EEA, Switzerland and the United Kingdom, Google says that IP addresses are used to derive coarse location and then discarded before they are logged. Analytics data may be processed outside the EEA under Google's data-processing terms and the applicable transfer safeguards.
No other recipients receive personal data. Fonts and content images are served from our own origin. The Google Analytics script loads when a page is opened. We do not use advertising tracking, sell data or pass it on for advertising.
Where the data is: the application and database are hosted in the European Union. The provider is established in Ukraine and accesses the data from there — that is the same legal person acting as controller, not a disclosure to a separate recipient.
5. Guest orders
When a guest orders through a venue's page, the following are processed: name and phone number (only for pickup or delivery), an optional comment, the items ordered with quantities and amounts, the time and status, and for table orders the table number. No guest account is needed.
For this data the venue is the controller: it decides whether to offer ordering at all, what is on the menu, and what happens with an order once placed. Machbaro processes the data on the venue's instructions and does not use it for any purpose of its own — it is not analysed, profiled or used for marketing. What the platform does determine is the technical shape of the processing: which fields exist and how the data is stored.
For questions about a specific order, the venue is the right point of contact.
When a guest calls a waiter or asks for the bill via the QR code, only the table, the type of request and the time are stored. No name or phone number is requested for this function.
6. Payments
Subscriptions are billed through Paddle. We do not receive or store full payment card details — they are entered with Paddle. To operate subscriptions we process metadata such as status, billing period and the outcome of a payment. Once the payment integration is live, this section will be updated with the data actually received.
Payments from guests to a venue do not go through Machbaro.
7. Cookies and storage on your device
The website uses the following cookies needed for the requested service:
| Cookie | Purpose | Duration |
|---|---|---|
laravel_session |
session and sign-in | 120 minutes |
XSRF-TOKEN |
request forgery protection | 120 minutes |
machbaro_locale |
language, stored only when explicitly chosen | 1 year |
appearance |
light or dark presentation | 1 year |
sidebar_state |
state of the sidebar in the admin area | 7 days |
Google Analytics additionally sets the following first-party cookies:
| Cookie | Purpose | Duration |
|---|---|---|
_ga |
distinguish visitors | up to 2 years |
_ga_<measurement-id> |
persist session state | up to 2 years |
Local storage additionally holds a guest's cart per venue and the chosen presentation. The cart stays on the device and is only transmitted when the order is submitted.
8. Your rights
Access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. You may also lodge a complaint with a data protection supervisory authority.
Write to support@machbaro.com.
Operators can delete their account themselves. This removes the account and the venue's data, except for information that still has to be kept for legal or security reasons or exists in backups.