Privacy Policy

1.The essentials at a glance

2.Who we are

Sip & Pay is operated by its owner, an individual entrepreneur (autonomo) under Spanish law identified in the summary table above, with address at Calle Nunez de Balboa 35A, 28001 Madrid, Spain ("we", "us"). We are the data controller for the processing described in this policy, except where section 4 says otherwise. Full identification details are in the Legal Notice at sipandpay.com/aviso-legal. Contact for anything related to your data: info@sipandpay.com.

Sip & Pay is a QR ordering and prepaid payments platform for party venues and their guests. It covers the website sipandpay.com, the guest app at app.sipandpay.com, and each partner venue's menu pages on its own subdomain.

3.What we collect in the guest app

When you create a guest account and use the app, we process:

• Account details: your first name and last name, a username generated from your name, your phone number and your age. Your phone number is your identifier: you log in with a one-time code sent by SMS or WhatsApp. We ask your age because the app is used to order in venues that serve alcohol and is for adults only.
• Order data: what you order, at which venue, at which table and when, plus your order history and receipts.
• Payments: your card details go directly to Stripe, our payment processor. They never touch our servers and we never store card numbers. We keep the payment outcome and the receipt.
• Split bill groups: if you join a group, the other members of your group can see the group's orders and amounts, and you can see theirs.
• Loyalty: your points balance and history at each venue. Points are per venue, at rates the venue sets.
• Preferences: your language choice.

Ordering without an account: you can order and pay without registering. In that case we process only the order, the table, the session and the payment through Stripe. This data is still personal data where it can be linked to you (for example through your card payment) and this policy applies to it.

The venue you order at sees the details of your order that it needs to prepare, serve and account for it.

4.Venue staff and admin accounts

Staff, managers and administrators of partner venues sign in with email and password on their venue's subdomain. For these users we process account details and activity data, including per-staff service metrics shown to the venue's managers and administrators.

For staff service metrics the venue, as employer, is the data controller and we process the data on the venue's behalf under a data processing agreement. Staff members should direct questions and rights requests about those metrics to their employer; we will assist the venue in answering them.

5.What we collect on the website

On sipandpay.com we only collect:

• Demo requests from venues: venue details (name, city, country, venue type, number of tables, capacity, current POS, challenges, plan interest) and contact details (name, email, role, preferred date and time).
• Security data: IP address and browser information when the demo form is submitted, used only to prevent spam and abuse.

The website has no user accounts and no advertising or analytics trackers.

6.Purposes and legal bases

• Run your account and the app, take your orders, process payments, operate split bill and loyalty: performance of the contract with you (art 6.1.b GDPR).
• Issue receipts and simplified invoices on behalf of the venue, and keep transaction records: compliance with legal obligations, in particular Spanish invoicing and tax rules (art 6.1.c GDPR).
• Respond to demo requests and prepare proposals for venues: steps taken at the venue's request before a contract (art 6.1.b).
• Keep the platform secure and prevent abuse, including error monitoring: our legitimate interest in the security of the service (art 6.1.f).
• Send service messages: the SMS or WhatsApp messages needed for login and order confirmations, and transactional emails to venue staff accounts (art 6.1.b).
• Produce anonymized, aggregated statistics (for example sales per night or top-selling items) that no longer identify anyone. These power the analytics we provide to venues and help us improve the service.

We send no marketing communications. If we ever introduce them, we will ask for your consent first and every message will include an easy way to opt out.

7.Recipients and service providers

The venue you order at receives your order data, as described in section 3. Beyond that, we use the following providers, who process data on our behalf under data processing agreements:

• Stripe: card payment processing. Your card details go directly to Stripe and are never stored by us.
• Twilio: sending the SMS and WhatsApp one-time login codes and order confirmations.
• Meta (WhatsApp Business Platform): delivery of WhatsApp messages.
• Twilio SendGrid: transactional email to venue staff accounts (for example password resets).
• Amazon Web Services: hosting of the app and its database, in the Frankfurt region (EU).
• Cloudflare: network and subdomain infrastructure.
• Sentry: error monitoring, EU data region.
• A software development and maintenance provider located in Ukraine, with strictly limited access, under EU Standard Contractual Clauses.
• For the website only: Vercel (hosting), Neon (demo request database), Resend (demo confirmation emails) and Cloudflare Turnstile (bot protection).

We never sell your data and we do not share it with advertisers.

8.International transfers

Our servers are in the EU. Some providers listed above are US companies (Stripe, Twilio, Meta, Cloudflare, Sentry, Amazon, Vercel): transfers to them are covered by the EU-US Data Privacy Framework, in which each of them is certified, with Standard Contractual Clauses as fallback. Access by our development provider in Ukraine is covered by EU Standard Contractual Clauses with supplementary measures.

9.Cookies and local storage

We use no advertising or analytics cookies on any of our sites or in the app, which is why you see no cookie banner. What we store in your browser is strictly technical: an essential cookie that confirms you passed the human check on the demo form (demo_captcha, 30 minutes), and in the app the technical session data needed to keep you logged in. The website takes its language from the page address and stores nothing for it.

10.How long we keep it

• Account data: while your account is active, deleted when the account is deleted.
• Orders, receipts and invoicing records: kept for the legally required periods, 4 years for tax purposes (art 66 General Tax Law) and up to 6 years for commercial records (art 30 Commercial Code).
• Demo requests: for as long as needed to follow up and keep a record of the conversation.
• Security and error logs: short technical retention periods.

11.Your rights

Under the GDPR you can ask us at any time to access, correct, delete or export the data we hold about you, to restrict how we use it, or to object to its use. Email info@sipandpay.com and we will handle it.

To delete your Sip & Pay account and the data in it, email us at info@sipandpay.com from the details linked to your account. Data we must keep by law (invoicing and tax records) is kept blocked for the legal period only.

If you are unhappy with our answer, you can complain to the Spanish supervisory authority, the AEPD (www.aepd.es).

12.Age

The Sip & Pay app is for adults: we ask your age at signup and you must be 18 or older to create an account. The website is not directed at anyone under 18 and we do not knowingly collect data from minors.

13.Changes to this policy

If we change this policy, we will update this page and the date at the top.