Privacy policy

Last updated: 4 November 2026

This privacy policy explains how personal data is processed in the Scandish service (scandish.app): the website, the table ordering pages that guests open by scanning a QR code, and the tools restaurants use (kitchen, waiter and management screens). It is written to meet the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018).

1. Who is responsible for your data

Scandish is provided by Scandish. Contact for all privacy matters: info@scandish.app.

Responsibility depends on how you use the service:

• Guests ordering in a restaurant: the restaurant is the controller of your order data. Scandish processes that data on the restaurant's behalf as a processor, under a data processing agreement. You can contact either the restaurant or us; we will help the restaurant answer your request.
• Restaurant staff, restaurant customers (businesses using Scandish), people who request a demo and visitors of our website: Scandish is the controller.

2. What data we process

Guests

• No account is needed to order. We do not ask for your name, phone number, email address or payment card details.
• When you open a table's ordering page, your browser gets an anonymous technical ID. It links your orders to your table visit so that you and the people at your table can share a cart and follow your orders.
• Your orders: dishes, extras, quantities, prices, time of order and status.
• Allergies and diets you choose to select and any note you write to the kitchen. Allergy information can reveal health information; we only process it because you choose to give it so that the restaurant can serve you safely, and it is only shown to the restaurant.
• Requests such as calling a waiter or asking for the bill.
• Payment records entered by the restaurant (for example amount and whether paid by card or cash). Card payments are handled by the restaurant's own payment terminal; Scandish never sees card details.
• If you leave a rating: the stars, any feedback you write and your language.
• The language you choose.

Restaurant staff

• Name, email address, role and the restaurant you belong to.
• Login information (passwords are stored only in hashed form by our authentication provider).
• A log of important actions (for example menu changes, cancelled orders) for security and to resolve disputes.

Restaurant customers and demo requests

• Contact person's name, email address, phone number, restaurant name, city and the message you send us.
• For customers: package, prices, invoices and payment status.

Everyone

• Technical data needed to deliver and protect the service, such as IP address, browser type and time of request in server logs.

3. Why we process data and on what legal basis

• To provide the ordering service and deliver your order (GDPR art. 6(1)(b), performance of a contract, and for the restaurant its contract with you).
• Allergy and diet information you choose to give: your explicit consent given by selecting it (art. 9(2)(a)). You can leave it out and tell the staff instead.
• To run the service for restaurants, manage staff accounts and invoice our customers (art. 6(1)(b)).
• To keep accounting records as required by the Finnish Accounting Act (art. 6(1)(c), legal obligation).
• To keep the service secure, prevent misuse and fix errors (art. 6(1)(f), legitimate interest).
• To answer demo requests and contact restaurants that asked to hear from us (art. 6(1)(f), legitimate interest). You can object at any time.

We do not use your data for advertising, we do not sell it and we do not make automated decisions that have legal or similarly significant effects on you.

4. Cookies and local storage

We only use cookies and browser storage that are strictly necessary for the service:

• a login cookie (the anonymous table ID for guests, or the staff login),
• a cookie that remembers the language you chose,
• local storage for things like your unsent cart.

We use no advertising, analytics or tracking cookies, so we do not need to ask for cookie consent.

5. Who processes data for us

We use the following service providers (sub-processors). They may only process data on our instructions and under data processing agreements:

• Supabase, Inc. – database, login and file storage. Data is stored in the EU (Stockholm, Sweden).
• Vercel Inc. – website hosting; our server functions run in the EU (Stockholm, Sweden).
• Cloudflare, Inc. – domain name service and email forwarding.

We do not sell or rent data, and we only disclose it to authorities when the law requires it.

6. Transfers outside the EU/EEA

Our data is stored in the EU. Some of our providers are US companies and may access data, for example for support or security. Such transfers are protected by the EU–US Data Privacy Framework where the provider is certified, and by the European Commission's standard contractual clauses.

7. How long we keep data

• Links between a guest's device and a table visit, notes to the kitchen and ratings: deleted automatically after the period set by the restaurant (365 days by default, at least 30 days).
• Orders and payment records: kept as long as accounting law requires (in Finland generally 6 years after the end of the financial year). Notes to the kitchen are removed from them as described above.
• Staff accounts: until the account is removed by the restaurant or the restaurant's contract ends.
• Customer and invoicing data: for the contract period and then as accounting law requires.
• Demo requests: up to 24 months after our last contact, unless you become a customer.
• Server logs: a short period, normally no more than 30 days.

Backups are overwritten on a rolling basis.

8. Security

Data is transferred encrypted (HTTPS). Access to data is limited by restaurant and role: each restaurant only sees its own data, and guests only see their own table. Staff passwords are hashed. We keep the number of people with access to production data to a minimum.

9. Your rights

You have the right to:

• access the data we hold about you,
• have incorrect data corrected,
• have your data deleted ("right to be forgotten"),
• restrict processing,
• object to processing based on legitimate interest,
• receive your data in a machine-readable form (data portability),
• withdraw your consent at any time, without affecting earlier processing.

Send requests to info@scandish.app. We answer within one month. Because guests are anonymous, we may ask for details (for example the restaurant, table and time of visit) to find your data.

You also have the right to lodge a complaint with the supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi), PO Box 800, 00531 Helsinki.

10. Children

The service is not aimed at children and we do not knowingly collect data about them. Ordering is anonymous and does not require any personal details.

11. Changes

We may update this policy when the service or the law changes. The date at the top shows the latest version. We will tell restaurant customers about significant changes in advance.

12. Contact

Scandish – info@scandish.app