Privacy policy

For the data of the site, the forms and the panel accounts, the controller is POSMI, owner of posmi.app; its identification details are on the Contact page. For any question about your data, write to contact@posmi.app.

For the data of each restaurant's guests (section 5), the restaurant is the controller and POSMI acts as processor.

Sign-up form on the site:

• restaurant name and a link to its Google Maps listing
• your name
• WhatsApp number
• email address
• the language you filled the form in
• the POSMI Partner's code, if you arrived through their link

Article subscription: your email, language and the page you subscribed from.

Panel accounts (restaurant owners and staff):

• name, email, role and assigned branches
• the one-time access codes we email you from noreply@posmi.app
• a session token the panel keeps in your browser's local storage to keep you signed in; it is deleted when you sign out

Subscription and payments: the modules subscribed, subscription status, dates, amounts, the payment identifier and the billing details Dodo Payments shares with us (such as name, email and country). We never receive or store your card number or security code.

QR generator (posmi.app/qr): your email, to send you the sign-in link, and the QR codes and logos you save in your account.

Technical data: IP address, browser and device type, pages visited and time of visit (server logs), and the cookies and storage described in the Cookie policy.

What you write to us by email or WhatsApp when you ask for help.

We do not collect sensitive data. The service is aimed at businesses, not at minors.

• to contact you via WhatsApp or email to activate your account and answer your request
• to provide the service: give you access to the panel, display your menu and process orders
• to manage the free trial, the subscription, charges and refunds
• to send service emails: access codes, trial-ending notice, billing notices and notices of price or terms changes
• to send you articles, news and offers from POSMI if you agreed (you can unsubscribe at any time)
• to give you support
• to run, secure and improve the site and the panel and measure their use in aggregate
• to prevent abuse and comply with legal, accounting and tax obligations

We do not sell personal data or use it for third-party advertising.

We process your data on the basis of your consent (forms, article subscription), the performance of the contract with your restaurant (panel accounts, subscription and payments), compliance with legal obligations (accounting and tax records) and our legitimate interest in running the service securely and measuring how the site is used and our advertising (Google Analytics and the Meta pixel, which you can turn off in the cookie settings). You can withdraw consent at any time by writing to contact@posmi.app; withdrawal does not affect the lawfulness of prior processing.

Restaurants using POSMI record data about their guests: name, phone or WhatsApp, email, birthday, orders and visits, reviews, favourites, stamps and points, and staff notes. That data belongs to the restaurant, which is its controller and decides what it is used for; POSMI only hosts and processes it on the restaurant's behalf, under the Terms of service.

We do not use that data for our own purposes, sell it or use it for our advertising. If you are a guest of a restaurant and want to access, correct or delete your data, contact the restaurant; if you write to us, we forward your request to the restaurant and help it respond.

We do not sell or transfer your data to third parties for their own purposes. We share it only with providers who deliver services to us and act on our instructions:

• Railway: hosting of posmi.app (servers in the United States)
• our virtual server (VPS) provider: hosting of the panel, the digital menus and their databases
• Cloudflare: DNS for our domains
• Brevo (France): sending the service emails from noreply@posmi.app, such as access codes and subscription notices
• Resend (United States): sending the sign-in link of the QR generator
• Telegram: internal notifications to the POSMI team about new sign-up requests and subscriptions
• Google (Analytics) and Meta (pixel): if we enable them, they run until you turn them off in the cookie settings; the Cookie policy shows which are active

Dodo Payments processes card payments as Merchant of Record. For the data it collects at checkout — card, billing and tax details — it is an independent controller and handles it under its own privacy policy.

Some of these providers are located outside Argentina. By using the service you consent to this international transfer, which is made to countries or companies with adequate levels of protection or under contractual clauses in line with Law 25.326. We may also disclose data where a law or a competent authority requires it.

• Sign-up form: while there is a commercial or potential relationship with you and for up to 24 months after the last contact, unless you ask for deletion earlier.
• Article subscription: until you unsubscribe.
• Panel accounts: while the restaurant's account is active; after it is closed we delete them within 90 days. Access codes work once and expire shortly after they are sent.
• Restaurant guests' data: for as long as the restaurant keeps it in its account; after the account is closed it is deleted within 90 days.
• Subscription and payment records: for the period required by accounting and tax rules (in Argentina, up to 10 years).
• Server logs: up to 12 months.
• Cookies and browser storage: the periods listed in the Cookie policy.

We may keep data longer where a legal obligation requires it or to defend against a claim.

We use cookies and browser local storage only for what is necessary: remembering your cookie choice (90 days), the Partner's code if you arrived through their link (90 days) and your session in the QR generator and the panel. If we use Google Analytics or the Meta pixel, they are active from your first visit and you can turn them off in the cookie settings.

The details, with names and periods, are in the Cookie policy. You can change your choice at any time with the "Cookie settings" link at the bottom of every page.

The demo menu (/demo) is a static prototype: it sends no data to any server and keeps its state only in browser memory.

You have the right to access your data, rectify and update it, request its deletion, object to its processing and withdraw your consent. To exercise them, write to contact@posmi.app from the email address you registered; we reply within the 10 calendar days (access) or 5 business days (rectification and deletion) set by law.

Under Article 14(3) of Argentine Law 25.326, data subjects may exercise their right of access free of charge at intervals of no less than six months, unless a legitimate interest is demonstrated.

The Agencia de Acceso a la Información Pública (AAIP), as the supervisory authority under Law 25.326, is empowered to handle complaints and claims filed by those whose rights are affected by non-compliance with personal data protection rules.

If you are in the European Union or the European Economic Area, you also have the rights under the General Data Protection Regulation (GDPR): access, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent, and you may lodge a complaint with the data protection authority of your country. We answer such requests within one month.

We apply reasonable technical and organisational measures to protect your data: encrypted traffic (HTTPS), panel sign-in with one-time codes instead of passwords, role-based permissions for each restaurant's staff, restricted access to data within POSMI and providers with recognised security standards. No system is infallible; if we detect an incident affecting your data, we will inform you in accordance with applicable law.

We may update this policy to reflect changes in the service or the law. The current version is always published on this page with its update date. If a change is material, we will notify you by email.

For any privacy question: contact@posmi.app. The controller's details are on the Contact page.