Privacy

Controller and processor

For the data of whoever subscribes (name, email, billing), Sergio Agustín Paredes Medina is the controller.

For the restaurant STAFF data — their name, their voice notes and what is said in them — the restaurant is the controller and we act as processor on its behalf, under the terms of Article 28 GDPR, which form part of the service terms.

What is processed

Subscriber: name, email, password (stored hashed, never in the clear) and billing data handled by Stripe.

Staff: name and a PIN (stored hashed). No ID number, phone or address is requested.

Notes: the recorded audio, its transcription, the products extracted from it, and the time and location it was left.

The newsletter and the inventory template

If you ask for the inventory template or join the newsletter, we process your email address, the language you asked in, the page you asked from, and the dates you signed up, confirmed and unsubscribed. Nothing else is requested.

The legal basis is your consent (article 6.1.a GDPR), given in two steps: you tick the box and you confirm from the link we email you. Without that confirmation we do not write to you, and the address is deleted after 30 days.

We use it to send you the template and, now and then, tips and news about the service. You can withdraw consent at any time with the one-click unsubscribe link in every email; after unsubscribing we keep the address only as a "do not write" mark, so that we never do again.

If you are also a customer and switch off commercial emails in your account, that setting overrides any newsletter subscription.

Who it is shared with

With the providers needed to run the service, processing data on our behalf under contract. Some are outside the EEA; those transfers rely on the European Commission’s standard contractual clauses.

Separately from those, and ONLY if you accept the cookie banner, Meta Platforms Ireland Limited receives your visit to the public pages of this site so we can measure our ads. Meta does not act on our behalf: it decides on its own what to do with that data. The legal basis there is your consent, which you can withdraw at any time by deleting the oido_consent cookie. It is explained in the cookie policy.

• OpenAI, L.L.C. (EE. UU.) — Transcripción de las notas de voz (el audio se envía y se transcribe). Cláusulas contractuales tipo de la Comisión Europea.
• Anthropic, PBC (EE. UU.) — Extracción de productos del texto y redacción del resumen y del pedido. Cláusulas contractuales tipo de la Comisión Europea.
• Stripe Payments Europe, Ltd. (Irlanda) — Cobro de la suscripción. Los datos de la tarjeta no pasan por nuestros sistemas. Tratamiento en la UE.
• Brevo (Sendinblue SAS, Francia) — Envío de los correos del servicio y del boletín. Tratamiento en la UE.
• Fly.io, Inc. (EE. UU.), servidores en Madrid — Alojamiento de la aplicación y de la base de datos. Datos alojados en la UE; cláusulas contractuales tipo.

Retention and rights

Data is kept while the account is active. On cancellation, audio, transcriptions and notes are deleted within 30 days; billing data is kept for as long as tax law requires.

Write to info@speakkitchen.com to exercise access, rectification, erasure, restriction, objection and portability. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).